[SECURITY] [DSA 2995-1] lzo2 security update

2014-08-0307:37:56

lists.debian.org

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

JSON

Debian Security Advisory DSA-2995-1 [email protected]
http://www.debian.org/security/ Salvatore Bonaccorso
August 03, 2014 http://www.debian.org/security/faq

Package : lzo2
CVE ID : CVE-2014-4607
Debian Bug : 752861

Don A. Bailey from Lab Mouse Security discovered an integer overflow
flaw in the way the lzo library decompressed certain archives compressed
with the LZO algorithm. An attacker could create a specially crafted
LZO-compressed input that, when decompressed by an application using the
lzo library, would cause that application to crash or, potentially,
execute arbitrary code.

For the stable distribution (wheezy), this problem has been fixed in
version 2.06-1+deb7u1.

For the testing distribution (jessie), this problem has been fixed in
version 2.08-1.

For the unstable distribution (sid), this problem has been fixed in
version 2.08-1.

We recommend that you upgrade your lzo2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8powerpcudhcpd< 1.22.0-9+deb8u1udhcpd_1.22.0-9+deb8u1_powerpc.deb
Debian8s390xbusybox-udeb< 1.22.0-9+deb8u1busybox-udeb_1.22.0-9+deb8u1_s390x.deb
Debian8s390xbusybox-static< 1.22.0-9+deb8u1busybox-static_1.22.0-9+deb8u1_s390x.deb
Debian7amd64liblzo2-dev< 2.06-1+deb7u1liblzo2-dev_2.06-1+deb7u1_amd64.deb
Debian8allbusybox-syslogd< 1.22.0-9+deb8u1busybox-syslogd_1.22.0-9+deb8u1_all.deb
Debian8armelbusybox< 1.22.0-9+deb8u1busybox_1.22.0-9+deb8u1_armel.deb
Debian8armelbusybox-udeb< 1.22.0-9+deb8u1busybox-udeb_1.22.0-9+deb8u1_armel.deb
Debian6amd64liblzo2-dev< 2.03-2+deb6u1liblzo2-dev_2.03-2+deb6u1_amd64.deb
Debian8ppc64elbusybox-static< 1.22.0-9+deb8u1busybox-static_1.22.0-9+deb8u1_ppc64el.deb
Debian7mipselliblzo2-dev< 2.06-1+deb7u1liblzo2-dev_2.06-1+deb7u1_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	powerpc	udhcpd	< 1.22.0-9+deb8u1	udhcpd_1.22.0-9+deb8u1_powerpc.deb
Debian	8	s390x	busybox-udeb	< 1.22.0-9+deb8u1	busybox-udeb_1.22.0-9+deb8u1_s390x.deb
Debian	8	s390x	busybox-static	< 1.22.0-9+deb8u1	busybox-static_1.22.0-9+deb8u1_s390x.deb
Debian	7	amd64	liblzo2-dev	< 2.06-1+deb7u1	liblzo2-dev_2.06-1+deb7u1_amd64.deb
Debian	8	all	busybox-syslogd	< 1.22.0-9+deb8u1	busybox-syslogd_1.22.0-9+deb8u1_all.deb
Debian	8	armel	busybox	< 1.22.0-9+deb8u1	busybox_1.22.0-9+deb8u1_armel.deb
Debian	8	armel	busybox-udeb	< 1.22.0-9+deb8u1	busybox-udeb_1.22.0-9+deb8u1_armel.deb
Debian	6	amd64	liblzo2-dev	< 2.03-2+deb6u1	liblzo2-dev_2.03-2+deb6u1_amd64.deb
Debian	8	ppc64el	busybox-static	< 1.22.0-9+deb8u1	busybox-static_1.22.0-9+deb8u1_ppc64el.deb
Debian	7	mipsel	liblzo2-dev	< 2.06-1+deb7u1	liblzo2-dev_2.06-1+deb7u1_mipsel.deb