[SECURITY] [DLA 997-1] libffi security update

2017-06-2114:52:37

lists.debian.org

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Package : libffi
Version : 3.0.10-3+deb7u1
CVE ID : CVE-2017-1000376

libffi requests an executable stack allowing attackers to more easily trigger
arbitrary code execution by overwriting the stack. Please note that libffi is
used by a number of other libraries.

For Debian 7 "Wheezy", these problems have been fixed in version
3.0.10-3+deb7u1.

We recommend that you upgrade your libffi packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8mipslibffi6< 3.1-2+deb8u1libffi6_3.1-2+deb8u1_mips.deb
Debian7amd64libffi5-dbg< 3.0.10-3+deb7u1libffi5-dbg_3.0.10-3+deb7u1_amd64.deb
Debian7amd64libffi5-udeb< 3.0.10-3+deb7u1libffi5-udeb_3.0.10-3+deb7u1_amd64.deb
Debian7armhflibffi5< 3.0.10-3+deb7u1libffi5_3.0.10-3+deb7u1_armhf.deb
Debian8armellibffi-dev< 3.1-2+deb8u1libffi-dev_3.1-2+deb8u1_armel.deb
Debian8mipslibffi6-dbg< 3.1-2+deb8u1libffi6-dbg_3.1-2+deb8u1_mips.deb
Debian8kfreebsd-amd64libffi6-udeb< 3.1-2+deb8u1libffi6-udeb_3.1-2+deb8u1_kfreebsd-amd64.deb
Debian7alllibffi< 3.0.10-3+deb7u1libffi_3.0.10-3+deb7u1_all.deb
Debian8kfreebsd-i386libffi6-dbg< 3.1-2+deb8u1libffi6-dbg_3.1-2+deb8u1_kfreebsd-i386.deb
Debian8amd64libffi-dev< 3.1-2+deb8u1libffi-dev_3.1-2+deb8u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	mips	libffi6	< 3.1-2+deb8u1	libffi6_3.1-2+deb8u1_mips.deb
Debian	7	amd64	libffi5-dbg	< 3.0.10-3+deb7u1	libffi5-dbg_3.0.10-3+deb7u1_amd64.deb
Debian	7	amd64	libffi5-udeb	< 3.0.10-3+deb7u1	libffi5-udeb_3.0.10-3+deb7u1_amd64.deb
Debian	7	armhf	libffi5	< 3.0.10-3+deb7u1	libffi5_3.0.10-3+deb7u1_armhf.deb
Debian	8	armel	libffi-dev	< 3.1-2+deb8u1	libffi-dev_3.1-2+deb8u1_armel.deb
Debian	8	mips	libffi6-dbg	< 3.1-2+deb8u1	libffi6-dbg_3.1-2+deb8u1_mips.deb
Debian	8	kfreebsd-amd64	libffi6-udeb	< 3.1-2+deb8u1	libffi6-udeb_3.1-2+deb8u1_kfreebsd-amd64.deb
Debian	7	all	libffi	< 3.0.10-3+deb7u1	libffi_3.0.10-3+deb7u1_all.deb
Debian	8	kfreebsd-i386	libffi6-dbg	< 3.1-2+deb8u1	libffi6-dbg_3.1-2+deb8u1_kfreebsd-i386.deb
Debian	8	amd64	libffi-dev	< 3.1-2+deb8u1	libffi-dev_3.1-2+deb8u1_amd64.deb