Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Slackware 14.1 Libevent Advisory SSA:2016-085-01 Critical: Buffer Overflow

slackware
Calendar Grey March 25, 2016
Scroller Slackware
Updated libevent versions for Slackware 14.1 tackle security vulnerabilities with essential enhancements to avert potential buffer overflow issues.
New libevent packages are available for Slackware 14.1 and -current to fix security issues

Summary

Here are the details from the Slackware 14.1 ChangeLog: patches/packages/libevent-2.0.22-i486-1_slack14.1.txz: Upgraded. Multiple integer overflows in the evbuffer API allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop. For more information, see: https://www.cve.org/CVERecord?id=CVE-2014-6272 (* Security fix *)

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow software update slackware high risk libevent

Where Find New Packages

Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/libevent-2.0.22-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/libevent-2.0.22-x86_64-1_slack14.1.txz
Updated package for Slackware -current:
Updated package for Slackware x86_64 -current:

MD5 Signatures

Slackware 14.1 package: ab84c0702044de88f1b051ed3d3d1c40 libevent-2.0.22-i486-1_slack14.1.txz
Slackware x86_64 14.1 package: bc5d1dff8d2f3758b0feddf00d2c6229 libevent-2.0.22-x86_64-1_slack14.1.txz
Slackware -current package: b195a6e34b8ce7043da6cd57670db4a7 l/libevent-2.0.22-i586-1.txz
Slackware x86_64 -current package: 7a755ece3e378f244a3c327369e7f2ac l/libevent-2.0.22-x86_64-1.txz

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow software update slackware high risk libevent

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg libevent-2.0.22-i486-1_slack14.1.txz