CVE-2014-9273 lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
MediumCVSS 4.6
EPSS 0.63%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/hivex(Debian:12) | < 1.3.11-1 | 1.3.11-1 |
| debian/hivex(Debian:13) | < 1.3.11-1 | 1.3.11-1 |
| debian/hivex(Debian:14) | < 1.3.11-1 | 1.3.11-1 |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| debian/hivex | <= 1.3.10-2 | No fix listed |
References
- Debian Security Tracker CVE-2014-9273 vendor-advisory
- openSUSE-SU-2015:0189 third-party-advisory vendor-advisory
- RHSA-2015:0301 third-party-advisory vendor-advisory
- RHSA-2015:1378 third-party-advisory vendor-advisory
- 62792 third-party-advisory
- [oss-security] 20141125 CVE request: missing checks for small-sized files in hivex mailing-list third-party-advisory
- [oss-security] 20141204 Re: CVE request: missing checks for small-sized files in hivex mailing-list third-party-advisory
- 71279 vdb-entry
- bugzilla.redhat.com issue-tracking
- github.com exploit issue-tracking patch
- github.com exploit issue-tracking patch
- GLSA-201503-07 vendor-advisory
- [Libguestfs] 20141029 [libhivex] Undefined behavior when accessing invalid (too small) registry hives mailing-list vendor-advisory