libevent up to 2.0.21/2.1.4 evbuffer API evbuffer_read buffer overflow : 8/25/2015 5:08:17 AM
 | Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >> From our sponsors  |
| Vulnerability Advisories |
| Vulnerabilities of scip VulDB |
libevent up to 2.0.21/2.1.4 evbuffer API evbuffer_read buffer overflow
8/23/2015 7:00:00 PM
General
scipID: 77430
Affected: libevent up to 2.0.21/2.1.4
Published: 08/24/2015
Risk: problematic
Created: 08/25/2015
Entry: 66.3% complete
Summary
A vulnerability, which was classified as problematic, was found in libevent up to 2.0.21/2.1.4. Affected is the function evbuffer_read of the component evbuffer API. The manipulation with an unknown input leads to a buffer overflow vulnerability (integer). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via “insanely large inputs” to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.
The weakness was published 08/24/2015. This vulnerability is traded as CVE-2015-6525. Technical details are known, but there is no available exploit.
Upgrading to version 2.0.22 or 2.1.5-beta eliminates this vulnerability.CVSS
Base Score: 4.1 (CVSS2#AV:A/AC:M/Au:S/C:P/I:P/A:P) [?]
Temp Score: 3.6 (CVSS2#E:ND/RL:OF/RC:ND) [?]
CPE
Exploiting
Class: Buffer overflow
Local: Yes
Remote: No
Availability: No
Countermeasures
Recommended: Upgrade
Status: Official fix
0-Day Time: 0 days since found
Upgrade: libevent 2.0.22/2.1.5-beta
Timeline
08/24/2015 | Advisory disclosed
08/25/2015 | VulDB entry created
08/25/2015 | VulDB entry updated
Sources
CVE: CVE-2015-6525 (mitre.org) (nvd.nist.org) (cvedetails.com)
You are receiving this email because you subscribed to this feed at feedmyinbox.com
If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions
