PT-2015-3093 · Libevent+3 · Libevent+3

Published 2014-10-10 · Updated 2024-06-15 · CVE-2014-6272

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Libevent versions 1.4.x through 1.4.14 Libevent versions 2.0.x through 2.0.21 Libevent versions 2.1.x through 2.1.4-beta

Description The issue is caused by multiple integer overflows in the evbuffer API, allowing context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the evbuffer add, evbuffer expand, or bufferevent write function. This can trigger a heap-based buffer overflow or an infinite loop. The vulnerability can be exploited by a remote attacker to cause a denial of service using large input data in the affected functions.

Recommendations For Libevent versions 1.4.x through 1.4.14, update to version 1.4.15 or later. For Libevent versions 2.0.x through 2.0.21, update to version 2.0.22 or later. For Libevent versions 2.1.x through 2.1.4-beta, update to version 2.1.5-beta or later. As a temporary workaround, consider restricting the input size to the evbuffer add, evbuffer expand, and bufferevent write functions to prevent large input data from being processed.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2016-2035

BDU:2016-00298

CVE-2014-6272

DLA-137-1

DSA-3119-1

MGASA-2015-0009

OPENSUSE-SU-2024:10236-1

OPENSUSE-SU-2024:10720-1

SUSE-SU-2014_1283-1

USN-2477-1

Affected Products

Alt Linux

Libevent

Suse

Ubuntu

References · 37

• https://osv.dev/vulnerability/USN-2477-1 · Vendor Advisory
• http://archives.seul.org/libevent/users/Jan-2015/msg00010.html · Vendor Advisory
• http://debian.org/security/2015/dsa-3119 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11273 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-6272 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6272 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-6272 · Security Note
• https://ubuntu.com/security/CVE-2014-6272 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-6272 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-6272 · Security Note
• https://osv.dev/vulnerability/DSA-3119-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2477-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-6272 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10720-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6525 · Security Note