PT-2016-4019 · Matroska+1 · Libebml+1

Publicado 2016-01-29 · Atualizado 2017-01-20 · CVE-2015-8789

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libEBML versions prior to 1.3.3

Description A use-after-free issue exists in the EbmlMaster::Read function, allowing context-dependent attackers to have an unspecified impact. This can be achieved by providing a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document.

Recommendations For versions prior to 1.3.3, update to version 1.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the processing of deeply nested EBML elements to minimize the risk of exploitation.

Correção

Identificadores relacionados

ALT-PU-2016-1931

CVE-2015-8789

DSA-3538-1

Produtos afetados

Alt Linux

Libebml

Referências · 23

• https://github.com/Matroska-Org/libebml/blob/release-1.3.3/ChangeLog · Aviso do Fabricante
• https://github.com/Matroska-Org/libebml/commit/88409e2a94dd3b40ff81d08bf6d92f486d036b24 · Nota
• https://packages.debian.org/src:libebml · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8789 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8791 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8790 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DSA-3538-1 · Aviso do Fabricante
• http://lists.matroska.org/pipermail/matroska-users/2015-October/006985.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3538-1 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2016-01/msg00035.html · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2016-1931 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/libebml · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8789 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-8789 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8789 · Aviso do Fabricante