Debian Security Advisory

DSA-3119-1 libevent -- security update

Date Reported:
06 Jan 2015
Affected Packages:
libevent
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 774645.
In Mitre's CVE dictionary: CVE-2014-6272, CVE-2015-6525.
More information:

Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.

For the stable distribution (wheezy), this problem has been fixed in version 2.0.19-stable-3+deb7u1.

For the upcoming stable distribution (jessie) and the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your libevent packages.