Published: 19/04/2016 Updated: 30/10/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 prior to 3.0.9 allows remote malicious users to execute arbitrary code via a crafted input file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
debian debian linux 8.0
debian debian linux 7.0
xdelta xdelta3
opensuse opensuse 13.2
opensuse opensuse 13.1

Debian Bug report logs - #814067 xdelta3: CVE-2014-9765: buffer overflow in main_get_appheader Package: xdelta3; Maintainer for xdelta3 is A Mennucc1 <mennucc1@debianorg>; Source for xdelta3 is src:xdelta3 (PTS, buildd, popcon) Reported by: Stepan Golosunov <stepan@golosunovppru> Date: Mon, 8 Feb 2016 07:03:01 UT ...

xdelta3 could be made to crash or run programs if it opened a specially crafted file ...

Stepan Golosunov discovered that xdelta3, a diff utility which works with binary files, is affected by a buffer overflow vulnerability within the main_get_appheader function, which may lead to the execution of arbitrary code For the oldstable distribution (wheezy), this problem has been fixed in version 300dfsg-1+deb7u1 For the stable distribu ...

Buffer overflow in the main_get_appheader function in xdelta3-mainh in xdelta3 before 309 allows remote attackers to execute arbitrary code via a crafted input file ...

CWE-119 http://www.openwall.com/lists/oss-security/2016/02/08/1 http://www.openwall.com/lists/oss-security/2016/02/08/2 http://www.ubuntu.com/usn/USN-2901-1 http://lists.opensuse.org/opensuse-updates/2016-02/msg00125.html http://www.debian.org/security/2016/dsa-3484 http://lists.opensuse.org/opensuse-updates/2016-02/msg00131.html https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2 http://www.securityfocus.com/bid/83109 https://security.gentoo.org/glsa/201701-40 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=814067 https://usn.ubuntu.com/2901-1/https://nvd.nist.gov

CVE-2014-9765

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect