Integer overflow in NetBSD - CVE-2015-2305

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16110

Integer overflow in NetBSD - CVE-2015-2305

Published: November 27, 2018


Vulnerability identifier: #VU16110
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2015-2305
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
NetBSD
Software vendor:
NetBSD Foundation, Inc

Description

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to \integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products. A local attacker can trigger heap-based buffer overflow via a large regular expression and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

External links