Mageia alert MGASA-2017-0201 (libffi)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2017-0201: Updated libffi packages fix security vulnerability 
Date:
    	     
 
Fri, 7 Jul 2017 11:18:00 +0200
Message-ID:
    	     
 
<20170707091800.13D0E9F88C@duvel.mageia.org>
MGASA-2017-0201 - Updated libffi packages fix security vulnerability

Publication date: 07 Jul 2017
URL: http://advisories.mageia.org/MGASA-2017-0201.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2017-1000376

Description:
libffi, a library used to call code written in one language from code
written  in a different language, was enforcing an executable stack on the
i386 architecture. While this might not be considered a vulnerability by
itself, this could be leveraged when exploiting other vulnerabilities,
such as the "stack clash" class of vulnerabilities discovered by Qualys
Research Labs.

References:
- https://bugs.mageia.org/show_bug.cgi?id=21122
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash...
- https://github.com/libffi/libffi/commit/978c9540154d32052...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10...

SRPMS:
- 5/core/libffi-3.1-4.1.mga5