Debian Security Advisory
DSA-3119-1 libevent -- security update
- Date Reported:
- 06 Jan 2015
- Affected Packages:
- libevent
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 774645.
In Mitre's CVE dictionary: CVE-2014-6272, CVE-2015-6525. - More information:
-
Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.
For the stable distribution (wheezy), this problem has been fixed in version 2.0.19-stable-3+deb7u1.
For the upcoming stable distribution (jessie) and the unstable distribution (sid), this problem will be fixed soon.
We recommend that you upgrade your libevent packages.