PT-2015-1927 · Libevent+1 · Libevent+1

Andrew Bartlett · Published 2015-01-06 · Updated 2016-09-27 · CVE-2015-6525

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Libevent versions 2.0.x through 2.0.21 Libevent versions 2.1.x through 2.1.4-beta

Description The issue is caused by multiple integer overflows in the evbuffer API, which can lead to a heap-based buffer overflow or an infinite loop when "insanely large inputs" are provided to certain functions, including evbuffer add, evbuffer prepend, evbuffer expand, exbuffer reserve space, or evbuffer read. This can allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact.

Recommendations For Libevent versions 2.0.x through 2.0.21, update to version 2.0.22 or later. For Libevent versions 2.1.x through 2.1.4-beta, update to version 2.1.5-beta or later. As a temporary workaround, consider restricting the input size to the evbuffer add, evbuffer prepend, evbuffer expand, exbuffer reserve space, and evbuffer read functions to prevent "insanely large inputs" from being processed.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2016-2035

BDU:2015-11273

CVE-2015-6525

DSA-3119-1

USN-2477-1

Affected Products

Alt Linux

Libevent

References · 22

• https://ubuntu.com/security/notices/USN-2477-1 · Vendor Advisory
• http://archives.seul.org/libevent/users/Jan-2015/msg00010.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2477-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6525 · Security Note
• https://osv.dev/vulnerability/CVE-2015-6525 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-6525 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3119-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/libevent · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-6525 · Security Note
• http://debian.org/security/2015/dsa-3119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6525 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-6525 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-6525 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00298 · Security Note
• https://bdu.fstec.ru/vul/2015-11273 · Security Note