Lucene search

K
mageiaGentoo FoundationMGASA-2014-0465
HistoryNov 21, 2014 - 3:44 p.m.

Updated srtp package fixes security vulnerability

2014-11-2115:44:16
Gentoo Foundation
advisories.mageia.org
14

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:N/I:N/A:P

EPSS

0.016

Percentile

87.3%

Fernando Russ from Groundworks Technologies reported a buffer overflow flaw in srtp, Cisco’s reference implementation of the Secure Real-time Transport Protocol (SRTP), in how the crypto_policy_set_from_profile_for_rtp() function applies cryptographic profiles to an srtp_policy. A remote attacker could exploit this vulnerability to crash an application linked against libsrtp, resulting in a denial of service (CVE-2013-2139).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchsrtp< 1.4.4-3.1srtp-1.4.4-3.1.mga3

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:N/I:N/A:P

EPSS

0.016

Percentile

87.3%