Lucene search

K
mageiaGentoo FoundationMGASA-2015-0230
HistoryMay 18, 2015 - 10:08 p.m.

Updated xbmc packages fix CVE-2015-3885

2015-05-1822:08:05
Gentoo Foundation
advisories.mageia.org
17

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

0.048

Percentile

92.7%

Updated xbmc package fixes security vulnerability: The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the ‘len’ variable, parsed without validation from opened images, used in the ljpeg_start() function. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition (CVE-2015-3885). The xbmc package contains a bundled copy of the affected code and has been patched to fix this issue.

OSVersionArchitecturePackageVersionFilename
Mageia4noarchxbmc< 12.3-1.3xbmc-12.3-1.3.mga4

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

0.048

Percentile

92.7%