CVE-2014-9765 Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.
HighCVSS 8.8
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xdelta3(Debian:12) | < 3.0.8-dfsg-1.1 | 3.0.8-dfsg-1.1 |
| debian/xdelta3(Debian:13) | < 3.0.8-dfsg-1.1 | 3.0.8-dfsg-1.1 |
| debian/xdelta3(Debian:14) | < 3.0.8-dfsg-1.1 | 3.0.8-dfsg-1.1 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| xdelta3 | <= 3.0.8 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- Debian Security Tracker CVE-2014-9765 vendor-advisory
- openSUSE-SU-2016:0524 vendor-advisory
- openSUSE-SU-2016:0530 vendor-advisory
- DSA-3484 vendor-advisory
- [oss-security] 20160208 CVE request - buffer overflow in xdelta3 before 3.0.9 mailing-list
- [oss-security] 20160208 Re: CVE request - buffer overflow in xdelta3 before 3.0.9 mailing-list
- 83109 vdb-entry
- USN-2901-1 vendor-advisory
- github.com
- GLSA-201701-40 vendor-advisory
- bugs.debian.org issue-tracking