Lucene search

K
mageiaGentoo FoundationMGASA-2014-0030
HistoryJan 31, 2014 - 8:42 p.m.

Updated libmicrohttpd package fixes security vulnerabilities

2014-01-3120:42:00
Gentoo Foundation
advisories.mageia.org
13

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

EPSS

0.039

Percentile

92.0%

The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read (CVE-2013-7038). Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header (CVE-2013-7039).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchlibmicrohttpd< 0.9.33-1libmicrohttpd-0.9.33-1.mga3

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

EPSS

0.039

Percentile

92.0%