MGASA-2021-0373

Dashboard / Vulnerabilities / MGASA-2021-0373

MGASA-2021-0373

Summary: Updated redis package fixes security vulnerabilities

Details: An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution (CVE-2021-29477). An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt the heap and potentially result with remote code execution (CVE-2021-29478). A vulnerability involving out-of-bounds read and integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15 and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code execution (CVE-2021-32761).

References: https://advisories.mageia.org/MGASA-2021-0373.html, https://bugs.mageia.org/show_bug.cgi?id=29036, https://lists.fedoraproject.org/archives/list/[email protected]/thread/BPWBIZXA67JFIB63W2CNVVILCGIC2ME5/, https://lists.fedoraproject.org/archives/list/[email protected]/thread/BHWOF7CBVUGDK3AN6H3BN3VNTH2TDUZZ/, https://lists.fedoraproject.org/archives/list/[email protected]/thread/SN7INTZFE34MIQJO7WDDTIY5LIBGN6GI/, https://www.debian.org/lts/security/2021/dla-2717, https://github.com/redis/redis/security/advisories/GHSA-8wxq-j7rp-g8wj