MGASA-2014-0262

Dashboard / Vulnerabilities / MGASA-2014-0262

MGASA-2014-0262

Summary: Updated musl package fixes CVE-2014-3484

Details: Updated musl package fixes security vulnerability: A remote stack-based buffer overflow has been found in musl libc's dns response parsing code. The overflow can be triggered in programs linked against musl libc and making dns queries via one of the standard interfaces (getaddrinfo, getnameinfo, gethostbyname, gethostbyaddr, etc.) if one of the configured nameservers in resolv.conf is controlled by an attacker, or if an attacker can inject forged udp packets with control over their contents. Denial of service is also possible via a related failure in loop detection (CVE-2014-3484).

References: https://advisories.mageia.org/MGASA-2014-0262.html, http://seclists.org/oss-sec/2014/q2/495, https://bugs.mageia.org/show_bug.cgi?id=13499