[SECURITY] [DLA 1033-1] memcached security update

2017-07-2009:08:07

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.009 Low

EPSS

Percentile

83.0%

JSON

Package : memcached
Version : 1.4.13-0.2+deb7u3
CVE ID : CVE-2017-9951
Debian Bug : #868701

It was discovered that there was a remote denial-of-service (DoS) vulnerability
in memcached, a high-performance memory object caching system.

The try_read_command function allowed remote attackers to cause a DoS via a
request to add/set a key that makes a comparison between a signed and unsigned
integer which triggered a heap-based buffer over-read.

This vulnerability existed due to an incomplete upstream fix for CVE-2016-8705.

For Debian 7 "Wheezy", this issue has been fixed in memcached version
1.4.13-0.2+deb7u3.

We recommend that you upgrade your memcached packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian7i386memcached< 1.4.13-0.2+deb7u3memcached_1.4.13-0.2+deb7u3_i386.deb
Debian9mipselmemcached< 1.4.33-1+deb9u1memcached_1.4.33-1+deb9u1_mipsel.deb
Debian8armhfmemcached< 1.4.21-1.1+deb8u2memcached_1.4.21-1.1+deb8u2_armhf.deb
Debian8i386memcached< 1.4.21-1.1+deb8u2memcached_1.4.21-1.1+deb8u2_i386.deb
Debian7amd64memcached< 1.4.13-0.2+deb7u3memcached_1.4.13-0.2+deb7u3_amd64.deb
Debian9i386memcached-dbgsym< 1.4.33-1+deb9u1memcached-dbgsym_1.4.33-1+deb9u1_i386.deb
Debian7allmemcached< 1.4.13-0.2+deb7u3memcached_1.4.13-0.2+deb7u3_all.deb
Debian9ppc64elmemcached< 1.4.33-1+deb9u1memcached_1.4.33-1+deb9u1_ppc64el.deb
Debian8s390xmemcached< 1.4.21-1.1+deb8u2memcached_1.4.21-1.1+deb8u2_s390x.deb
Debian9armhfmemcached< 1.4.33-1+deb9u1memcached_1.4.33-1+deb9u1_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	i386	memcached	< 1.4.13-0.2+deb7u3	memcached_1.4.13-0.2+deb7u3_i386.deb
Debian	9	mipsel	memcached	< 1.4.33-1+deb9u1	memcached_1.4.33-1+deb9u1_mipsel.deb
Debian	8	armhf	memcached	< 1.4.21-1.1+deb8u2	memcached_1.4.21-1.1+deb8u2_armhf.deb
Debian	8	i386	memcached	< 1.4.21-1.1+deb8u2	memcached_1.4.21-1.1+deb8u2_i386.deb
Debian	7	amd64	memcached	< 1.4.13-0.2+deb7u3	memcached_1.4.13-0.2+deb7u3_amd64.deb
Debian	9	i386	memcached-dbgsym	< 1.4.33-1+deb9u1	memcached-dbgsym_1.4.33-1+deb9u1_i386.deb
Debian	7	all	memcached	< 1.4.13-0.2+deb7u3	memcached_1.4.13-0.2+deb7u3_all.deb
Debian	9	ppc64el	memcached	< 1.4.33-1+deb9u1	memcached_1.4.33-1+deb9u1_ppc64el.deb
Debian	8	s390x	memcached	< 1.4.21-1.1+deb8u2	memcached_1.4.21-1.1+deb8u2_s390x.deb
Debian	9	armhf	memcached	< 1.4.33-1+deb9u1	memcached_1.4.33-1+deb9u1_armhf.deb