PT-2014-4999 · Directfb+1 · Directfb+1

Frédéric Basse · Publicado 2014-06-11 · Atualizado 2024-06-15 · CVE-2014-2977

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DirectFB version 1.4.13

Description The issue is related to multiple integer signedness errors in the Dispatch Write function, which can be triggered via the Voodoo interface. This can lead to a denial of service (crash) and potentially allow the execution of arbitrary code due to a stack-based buffer overflow.

Recommendations For DirectFB version 1.4.13, consider applying a patch or fix that addresses the integer signedness errors in the Dispatch Write function to prevent potential exploitation. As a temporary workaround, restrict access to the Voodoo interface to minimize the risk of a denial of service or arbitrary code execution.

Correção

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2014-2977

MGASA-2015-0176

OPENSUSE-SU-2015_0807-1

OPENSUSE-SU-2024:10535-1

SUSE-SU-2015:0839-1

SUSE-SU-2015_0839-1

Produtos afetados

Directfb

Suse

Referências · 25

• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/FX7QVZZFK77X4W3HOB7ZMBQJH23RDN2Q · Nota
• https://security.gentoo.org/glsa/201701-55 · Aviso do Fabricante
• http://secunia.com/advisories/58448 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10535-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/05/15/9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2977 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2015-0176.html · Nota de Segurança
• http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html · Nota
• https://bugzilla.suse.com/878345 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=13391 · Nota
• http://advisories.mageia.org/MGASA-2015-0176.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2015:0839-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0176 · Aviso do Fabricante