Advisories » MGASA-2017-0201

Updated libffi packages fix security vulnerability

Publication date: 07 Jul 2017
Modification date: 07 Jul 2017
Type: security
Affected Mageia releases : 5
CVE: CVE-2017-1000376

Description

libffi, a library used to call code written in one language from code
written  in a different language, was enforcing an executable stack on the
i386 architecture. While this might not be considered a vulnerability by
itself, this could be leveraged when exploiting other vulnerabilities,
such as the "stack clash" class of vulnerabilities discovered by Qualys
Research Labs.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=21122
• https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
• https://github.com/libffi/libffi/commit/978c9540154d320525488db1b7049277122f736d
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000376

SRPMS

5/core

• libffi-3.1-4.1.mga5