PT-2014-5000 · Directfb+1 · Directfb+1

Frédéric Basse · Published 2014-06-11 · Updated 2024-06-15 · CVE-2014-2978

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DirectFB version 1.4.4

Description The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write in the Dispatch Write function in proxy/dispatcher/idirectfbsurface dispatcher.c.

Recommendations For DirectFB version 1.4.4, consider disabling the Voodoo interface as a temporary workaround until a patch is available. Restrict access to the Dispatch Write function in proxy/dispatcher/idirectfbsurface dispatcher.c to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-2978

MGASA-2015-0176

OPENSUSE-SU-2015_0807-1

OPENSUSE-SU-2024:10535-1

SUSE-SU-2015:0839-1

Affected Products

Directfb

Suse

References · 23

• https://security.gentoo.org/glsa/201701-55 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10535-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0176.html · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:0839-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0176 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2978 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00019.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/05/15/10 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/FX7QVZZFK77X4W3HOB7ZMBQJH23RDN2Q · Note
• http://secunia.com/advisories/58448 · Note
• http://mail.directfb.org/pipermail/directfb-dev/2014-March/006805.html · Note
• https://bugzilla.suse.com/878345 · Note
• https://bugs.mageia.org/show_bug.cgi?id=13391 · Note