Advisories » MGASA-2016-0395

Updated tre packages fix security vulnerability

Publication date: 21 Nov 2016
Modification date: 21 Nov 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2015-3796 , CVE-2016-8859

Description

The TRE library allows context-dependent attackers to execute arbitrary
code or cause a denial of service (memory corruption and application
crash) via a crafted regular expression (CVE-2015-3796).

A vulnerability has been found in the tre package that could allow an
attacker to perform controlled heap corruption (CVE-2016-8859).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=19793
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6RF7IRNEREOGUAKOAE2LLRIJ37TCLAL4/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3796
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8859

SRPMS

5/core

• tre-0.8.0-12.1.mga5