PT-2014-5000 · Directfb+1 · Directfb+1

Frédéric Basse · Publicado 2014-06-11 · Atualizado 2024-06-15 · CVE-2014-2978

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DirectFB version 1.4.4

Description The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write in the Dispatch Write function in proxy/dispatcher/idirectfbsurface dispatcher.c.

Recommendations For DirectFB version 1.4.4, consider disabling the Voodoo interface as a temporary workaround until a patch is available. Restrict access to the Dispatch Write function in proxy/dispatcher/idirectfbsurface dispatcher.c to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2014-2978

MGASA-2015-0176

OPENSUSE-SU-2015_0807-1

OPENSUSE-SU-2024:10535-1

SUSE-SU-2015:0839-1

Produtos afetados

Directfb

Suse

Referências · 23

• http://openwall.com/lists/oss-security/2014/05/15/10 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/FX7QVZZFK77X4W3HOB7ZMBQJH23RDN2Q · Nota
• https://security.gentoo.org/glsa/201701-55 · Aviso do Fabricante
• http://secunia.com/advisories/58448 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10535-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2015-0176.html · Nota de Segurança
• http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html · Nota
• https://bugzilla.suse.com/878345 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=13391 · Nota
• http://advisories.mageia.org/MGASA-2015-0176.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2015:0839-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0176 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-2978 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2015:223 · Aviso do Fabricante