Advisories » MGASA-2015-0009

Updated libevent packages fix CVE-2014-6272

Publication date: 07 Jan 2015
Modification date: 07 Jan 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-6272

Description

Updated libevent packages fix security vulnerability:

Andrew Bartlett of Catalyst reported a defect affecting certain applications
using the Libevent evbuffer API. This defect leaves applications which pass
insanely large inputs to evbuffers open to a possible heap overflow or
infinite loop. In order to exploit this flaw, an attacker needs to be able to
find a way to provoke the program into trying to make a buffer chunk larger
than what will fit into a single size_t or off_t (CVE-2014-6272).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=14970
• https://www.debian.org/security/2015/dsa-3119
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6272

SRPMS

4/core

• libevent-2.0.21-5.1.mga4