Exploit the possiblities

Mandriva Linux Security Advisory 2015-223

Mandriva Linux Security Advisory 2015-223
Posted May 4, 2015
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2015-223 - Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allow remote attackers to cause a denial of service and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow. The Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allows remote attackers to cause a denial of service and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write.

tags | advisory, remote, denial of service, overflow, arbitrary
systems | linux, mandriva
advisories | CVE-2014-2977, CVE-2014-2978
MD5 | a37522315ce750b13173ef9d73766c1d

Mandriva Linux Security Advisory 2015-223

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:223
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : directfb
Date : May 4, 2015
Affected: Business Server 1.0, Business Server 2.0
_______________________________________________________________________

Problem Description:

Updated directfb packages fix security vulnerabilities:

Multiple integer signedness errors in the Dispatch_Write function
in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allow
remote attackers to cause a denial of service (crash) and possibly
execute arbitrary code via the Voodoo interface, which triggers a
stack-based buffer overflow (CVE-2014-2977).

The Dispatch_Write function in
proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allows
remote attackers to cause a denial of service (crash) and possibly
execute arbitrary code via the Voodoo interface, which triggers an
out-of-bounds write (CVE-2014-2978).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2977
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2978
http://advisories.mageia.org/MGASA-2015-0176.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
70c334338e4a0d84c6ff26c3be6ebea4 mbs1/x86_64/directfb-doc-1.5.3-5.1.mbs1.x86_64.rpm
d59dd695baa38c90c008176b8983ff31 mbs1/x86_64/lib64directfb1.5_0-1.5.3-5.1.mbs1.x86_64.rpm
f77efe14dd081e7742665c969f47c2f1 mbs1/x86_64/lib64directfb-devel-1.5.3-5.1.mbs1.x86_64.rpm
bcdcdd485566adf64c4e15fb5dbaeb1a mbs1/SRPMS/directfb-1.5.3-5.1.mbs1.src.rpm

Mandriva Business Server 2/X86_64:
6d65c123db855e44d27fec23464175dd mbs2/x86_64/directfb-doc-1.7.0-3.1.mbs2.noarch.rpm
38092695d865312a4fe97cc7074375fe mbs2/x86_64/lib64directfb1.7_0-1.7.0-3.1.mbs2.x86_64.rpm
9d0eb66feef71fc8506cb6380048a305 mbs2/x86_64/lib64directfb-devel-1.7.0-3.1.mbs2.x86_64.rpm
95afda68b1de9af00a8cddfe38c263a2 mbs2/SRPMS/directfb-1.7.0-3.1.mbs2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVR5eYmqjQ0CJFipgRAiM8AJ9X9sBeaessnSgGy3Zwlh0UfJtxhACfdatk
hWj8+pyligsZaFjhyXQAt+Y=
=PYEi
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    22 Files
  • 2
    Nov 2nd
    28 Files
  • 3
    Nov 3rd
    10 Files
  • 4
    Nov 4th
    1 Files
  • 5
    Nov 5th
    5 Files
  • 6
    Nov 6th
    15 Files
  • 7
    Nov 7th
    15 Files
  • 8
    Nov 8th
    13 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    9 Files
  • 11
    Nov 11th
    3 Files
  • 12
    Nov 12th
    2 Files
  • 13
    Nov 13th
    15 Files
  • 14
    Nov 14th
    17 Files
  • 15
    Nov 15th
    19 Files
  • 16
    Nov 16th
    15 Files
  • 17
    Nov 17th
    19 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close