Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Gentoo: 201406-06 High: Mumble Code Execution and DoS Risks

gentoo
Calendar Grey June 6, 2014
Scroller Gentoo
Various security flaws in Mumble might allow for unauthorized code execution or service disruptions. It's advisable to update.
Multiple vulnerabilities have been found in Mumble, the worst of which could lead to arbitrary code execution.

Summary

Multiple vulnerabilities have been discovered in Mumble: * A crafted length prefix value can trigger a heap-based buffer overflow or NULL pointer dereference in the opus_packet_get_samples_per_frame function (CVE-2014-0044) * A crafted packet can trigger an error in the opus_decode_float function, leading to a heap-based buffer overflow (CVE-2014-0045) * A crafted SVG referencing local files can lead to resource exhaustion or hangs (CVE-2014-3755) * Mumble does not properly escape HTML in some external strings before displaying them (CVE-2014-3756)

Topics%20covered

Topics Covered

security advisory denial of service high severity gentoo remote code execution mumble

Resolution

All Mumble users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=media-sound/mumble-1.2.6"

References

[ 1 ] CVE-2014-0044 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0044 [ 2 ] CVE-2014-0045 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0045 [ 3 ] CVE-2014-3755 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3755 [ 4 ] CVE-2014-3756 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3756

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201406-06
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Title: Mumble: Multiple vulnerabilities
Date: June 06, 2014
Bugs: #500486, #510380
ID: 201406-06

Topics%20covered

Topics Covered

security advisory denial of service high severity gentoo remote code execution mumble

Synopsis

Background

Mumble is low-latency voice chat software intended for use with gaming.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-sound/mumble < 1.2.6 >= 1.2.6

Impact

===== A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.