Stack-based buffer overflow in libevent - CVE-2017-5437,CVE-2016-10196
Published: April 19, 2017
Vulnerability identifier: #VU6349
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5437,CVE-2016-10196
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error in evutil_parse_sockaddr_port() function in evutil.c within libevent library before 2.1.6-beta. A remote attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
libevent
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for x86_64
SUSE Linux
Ubuntu
libevent (Alpine package)
Gentoo dev-libs/libevent
Firefox ESR
Mozilla Firefox
Mozilla Thunderbird
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for x86_64
SUSE Linux
Ubuntu
libevent (Alpine package)
Gentoo dev-libs/libevent
Firefox ESR
Mozilla Firefox
Mozilla Thunderbird
How to mitigate CVE-2017-5437,CVE-2016-10196
Update to version 2.1.6-beta or later.
libevent (Alpine package) - addressed in versions 2.0.22-r1, 2.0.22-r2
External References
Related Security Bulletins
- Multiple vulnerabilities in Mozilla Firefox
- Multiple vulnerabilities in libevent
- Multiple vulnerabilities in Mozilla Thunderbird
- Gentoo update for libevent
- Red Hat update for Mozilla Thunderbird
- SUSE Linux update for MozillaFirefox
- Arch Linux update for firefox
- Ubuntu update for libevent
- Gentoo update for Mozilla Firefox
- SUSE Linux update for MozillaFirefox
- Stack-based buffer overflow in libevent (Alpine package)