Lucene search

K
debianDebianDEBIAN:DLA-393-1:AA978
HistoryJan 18, 2016 - 6:26 p.m.

[SECURITY] [DLA 393-1] srtp security update

2016-01-1818:26:25
lists.debian.org
10

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.026

Percentile

90.3%

Package : srtp
Version : 1.4.4~dfsg-6+deb6u2
CVE ID : CVE-2015-6360

Prevent potential DoS attack due to lack of bounds checking on RTP header
CSRC count and extension header length. Credit goes to Randell Jesup and
the Firefox team for reporting this issue.

(As there is no aead mode available in the Squeeze version,
only srtp_unprotect() needed to be patched)

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.026

Percentile

90.3%