CVE-2015-2313 Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption)....
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/capnproto(Debian:12) | < 0.4.1-3 | 0.4.1-3 |
| debian/capnproto(Debian:13) | < 0.4.1-3 | 0.4.1-3 |
| debian/capnproto(Debian:14) | < 0.4.1-3 | 0.4.1-3 |
| capnproto | <= 0.4.1.0 | No fix listed |
| capnproto | = 0.5.0.0 | No fix listed |
| capnproto | = 0.5.1.0 | No fix listed |
| capnproto | = 0.5.1.1 | No fix listed |
References
- Debian Security Tracker CVE-2015-2313 vendor-advisory
- [oss-security] 20150317 Re: CVE Request: Cap'n Proto: Several issues mailing-list third-party-advisory
- bugs.debian.org mailing-list third-party-advisory
- github.com third-party-advisory
- github.com third-party-advisory
- bugs.debian.org issue-tracking