[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 20 Aug 2010 13:33:16 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: jengelh@...ozas.de, coley <coley@...re.org>
Subject: Re: CVE Request: heap-based buffer overflow in libHX
Please use CVE-2010-2947
Thanks.
--
JB
----- "Thomas Biege" <thomas@...e.de> wrote:
> http://libhx.git.sourceforge.net/git/gitweb.cgi?p=libhx/libhx;a=commitdiff;h=904a46f90dd3f046bfac0b64a5e813d7cd4fca59
>
> string: fixed buffer overflow in HX_split when too few fields are
> present
>
> Jan Engelhardt [Mon, 16 Aug 2010 17:08:51 +0000 (19:08 +0200)]
>
>
>
> When HX_split is called with a maximum number of desired fields (4th
>
> argument != 0), passing in a string that has less fields than that
> led
>
> to a buffer overrun (write beyond end of malloc'd area).
>
>
>
> CVSS Base Score: 10
>
> - Impact Subscore: 10
>
> - Exploitability Subscore: 10
>
> CVSS Temporal Score: 7.4
>
> CVSS Environmental Score: Undefined
>
> Overall CVSS Score: 7.4
>
>
>
> CVSS Base vector:: AV:N/AC:L/Au:N/C:C/I:C/A:C
>
> - AV: libHX may be used by network services
>
> - Au: some services may not require authentication
>
> - A: can cause crash when result is freed
>
>
>
> CVSS Temporal vectors:: RL:O/RC:C
>
>
>
> Affects all versions prior to, and including, 3.5.
>
> --
> Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support &
> Auditing
> SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
