Advisories » MGASA-2014-0437

Updated konversation package fixes security vulnerability

Publication date: 29 Oct 2014
Modification date: 29 Oct 2014
Type: security
Affected Mageia releases : 3 , 4
CVE: CVE-2014-8483

Description

Due to and out-of-bounds read issue in Konversation in The ECB Blowfish
decryption function, a malicious client can cause either denial of service or
disclosure of information from process memory by using an improperly formed
message (CVE-2014-8483).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=14385
• https://bugs.kde.org/show_bug.cgi?id=210792
• http://openwall.com/lists/oss-security/2014/10/26/1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8483

SRPMS

3/core

• konversation-1.5-0.rc1.2.mga3

4/core

• konversation-1.5-0.rc1.3.mga4