[SECURITY] [DLA 126-1] ettercap security update

2014-12-2921:30:26

lists.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.007 Low

EPSS

Percentile

80.9%

JSON

Package : ettercap
Version : 1:0.7.3-2.1+squeeze2
CVE ID : CVE-2014-9380 CVE-2014-9381
Debian Bug : 773416

Patches a bunch of security vulnerabilities:

CVE-2014-9380 (Buffer over-read)
CVE-2014-9381 (Signedness error)
See: https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/
Patches taken from upstream
- 6b196e011fa456499ed4650a360961a2f1323818 pull/608
- 31b937298c8067e6b0c3217c95edceb983dfc4a2 pull/609
  Thanks to Nick Sampanis <[email protected]> who is responsible for
  both finding and repairing these issues.

OSVersionArchitecturePackageVersionFilename
Debian6allettercap-common< 1:0.7.3-2.1+squeeze2ettercap-common_1:0.7.3-2.1+squeeze2_all.deb
Debian6allettercap-gtk< 1:0.7.3-2.1+squeeze2ettercap-gtk_1:0.7.3-2.1+squeeze2_all.deb
Debian6allettercap< 1:0.7.3-2.1+squeeze2ettercap_1:0.7.3-2.1+squeeze2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	all	ettercap-common	< 1:0.7.3-2.1+squeeze2	ettercap-common_1:0.7.3-2.1+squeeze2_all.deb
Debian	6	all	ettercap-gtk	< 1:0.7.3-2.1+squeeze2	ettercap-gtk_1:0.7.3-2.1+squeeze2_all.deb
Debian	6	all	ettercap	< 1:0.7.3-2.1+squeeze2	ettercap_1:0.7.3-2.1+squeeze2_all.deb