Advisories » MGASA-2014-0436

Updated quassel packages fix security vulnerability

Publication date: 29 Oct 2014
Modification date: 29 Oct 2014
Type: security
Affected Mageia releases : 3 , 4
CVE: CVE-2014-8483

Description

Due to and out-of-bounds read issue in Quassel core in The ECB Blowfish
decryption function, a malicious client can cause either denial of service or
disclosure of information from process memory by using an improperly formed
message (CVE-2014-8483).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=14384
• http://bugs.quassel-irc.org/issues/1314
• http://openwall.com/lists/oss-security/2014/10/26/1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8483

SRPMS

4/core

• quassel-0.9.2-1.1.mga4

3/core

• quassel-0.9.2-1.1.mga3