Mageia alert MGASA-2015-0009 (libevent)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2015-0009: Updated libevent packages fix CVE-2014-6272 
Date:
    	     
 
Wed, 7 Jan 2015 16:15:24 +0100
Message-ID:
    	     
 
<20150107151524.3635C41420@valstar.mageia.org>
MGASA-2015-0009 - Updated libevent packages fix CVE-2014-6272

Publication date: 07 Jan 2015
URL: http://advisories.mageia.org/MGASA-2015-0009.html
Type: security
Affected Mageia releases: 4
CVE: CVE-2014-6272

Description:
Updated libevent packages fix security vulnerability:

Andrew Bartlett of Catalyst reported a defect affecting certain applications
using the Libevent evbuffer API. This defect leaves applications which pass
insanely large inputs to evbuffers open to a possible heap overflow or
infinite loop. In order to exploit this flaw, an attacker needs to be able to
find a way to provoke the program into trying to make a buffer chunk larger
than what will fit into a single size_t or off_t (CVE-2014-6272).

References:
- https://bugs.mageia.org/show_bug.cgi?id=14970
- https://www.debian.org/security/2015/dsa-3119
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6272

SRPMS:
- 4/core/libevent-2.0.21-5.1.mga4