Debian alert DLA-3501-1 (renderdoc)
| From: | Tobias Frost <tobi@debian.org> | |
| To: | debian-lts-announce@lists.debian.org | |
| Subject: | [SECURITY] [DLA 3501-1] renderdoc security update | |
| Date: | Tue, 25 Jul 2023 06:55:40 +0200 | |
| Message-ID: | <ZL9VzA0s+P0N2HBR@isildor.loewenhoehle.ip> |
------------------------------------------------------------------------- Debian LTS Advisory DLA-3501-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Tobias Frost July 25, 2023 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : renderdoc Version : 1.2+dfsg-2+deb10u1 CVE ID : CVE-2023-33863 CVE-2023-33864 CVE-2023-33865 Debian Bug : 1037208 Multiple security issues were discovered in renderdoc a stand-alone graphics debugging tool, which potentially allows a remote attacker to execute arbitrary code. CVE-2023-33863 an integer overflow that results in a heap-based buffer overflow that might be exploitable by a remote attacker to execute arbitrary code on the machine that runs RenderDoc CVE-2023-33864 an integer underflow that results in a heap-based buffer overflow that might be exploitable by a remote attacker to execute arbitrary code on the machine that runs RenderDoc. CVE-2023-33865 a symlink vulnerability that might be exploitable by a unprivileged local attacker to obtain the privileges of the user who runs RenderDoc. For Debian 10 buster, these problems have been fixed in version 1.2+dfsg-2+deb10u1. We recommend that you upgrade your renderdoc packages. For the detailed security status of renderdoc please refer to its security tracker page at: https://security-tracker.debian.org/tracker/renderdoc Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS