Lucene search

K
mageiaGentoo FoundationMGASA-2014-0503
HistoryDec 01, 2014 - 8:57 p.m.

Updated tcpdump package fixes security vulnerabilities

2014-12-0120:57:09
Gentoo Foundation
advisories.mageia.org
12

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.073 Low

EPSS

Percentile

94.0%

The Tcpdump program could crash when processing a malformed OLSR payload when the verbose output flag was set (CVE-2014-8767). The application decoder for the Ad hoc On-Demand Distance Vector (AODV) protocol in Tcpdump fails to perform input validation and performs unsafe out-of-bound accesses. The application will usually not crash, but perform out-of-bounds accesses and output/leak larger amounts of invalid data, which might lead to dropped packets. It is unknown if a payload exists that might trigger segfaults (CVE-2014-8769).

OSVersionArchitecturePackageVersionFilename
Mageia4noarchtcpdump< 4.4.0-2.1tcpdump-4.4.0-2.1.mga4

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.073 Low

EPSS

Percentile

94.0%