Updated libmtp and libgphoto packages fix security vulnerabilities

2017-07-2821:12:15

Gentoo Foundation

advisories.mageia.org

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.8 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.009 Low

EPSS

Percentile

83.0%

JSON

An integer overflow vulnerability in the ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of libmtp and libgphoto allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable (CVE-2017-9831). An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL function) of libmtp and libgphoto allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable (CVE-2017-9832).

OSVersionArchitecturePackageVersionFilename
Mageia5noarchlibmtp< 1.1.8-4.1libmtp-1.1.8-4.1.mga5
Mageia5noarchlibgphoto< 2.5.7-1.2libgphoto-2.5.7-1.2.mga5