SB2017080921 - Multiple vulnerabilities in capnproto

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017080921

SB2017080921 - Multiple vulnerabilities in capnproto

Published: August 9, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017080921
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Integer underflow (CVE-ID: CVE-2015-2311)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message.


2) Resource exhaustion (CVE-ID: CVE-2015-2312)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements.


Remediation

Install update from vendor's website.

References