PT-2014-4999 · Directfb+1 · Directfb+1

Frédéric Basse · Published 2014-06-11 · Updated 2024-06-15 · CVE-2014-2977

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DirectFB version 1.4.13

Description The issue is related to multiple integer signedness errors in the Dispatch Write function, which can be triggered via the Voodoo interface. This can lead to a denial of service (crash) and potentially allow the execution of arbitrary code due to a stack-based buffer overflow.

Recommendations For DirectFB version 1.4.13, consider applying a patch or fix that addresses the integer signedness errors in the Dispatch Write function to prevent potential exploitation. As a temporary workaround, restrict access to the Voodoo interface to minimize the risk of a denial of service or arbitrary code execution.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2014-2977

MGASA-2015-0176

OPENSUSE-SU-2015_0807-1

OPENSUSE-SU-2024:10535-1

SUSE-SU-2015:0839-1

SUSE-SU-2015_0839-1

Affected Products

Directfb

Suse

References · 25

• https://security.gentoo.org/glsa/201701-55 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10535-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2977 · Security Note
• https://advisories.mageia.org/MGASA-2015-0176.html · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:0839-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0176 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:223 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html · Vendor Advisory
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/FX7QVZZFK77X4W3HOB7ZMBQJH23RDN2Q · Note
• http://secunia.com/advisories/58448 · Note
• http://openwall.com/lists/oss-security/2014/05/15/9 · Note
• http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html · Note
• https://bugzilla.suse.com/878345 · Note