Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
172
security advisorydenial of servicecriticalUbuntu 12.04 ESM: USN-3283-2 Critical: rtmpdump Denial of Service
rtmpdump could be made to crash or run programs as your login if it processed a specially crafted stream.. =========================================================================Ubuntu Security Notice USN-3283-2 May 23, 2017 rtmpdump vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: rtmpdump could be made to crash or run programs as your login if it processed a specially crafted stream. Software Description: - rtmpdump: small dumper for media content streamed over the RTMP protocol Details: Dave McDaniel discovered that rtmpdump incorrectly handled certain malformed streams. If a user were tricked into processing a specially crafted stream, a remote attacker could cause rtmpdump to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 ESM: librtmp0 2.4~20110711.gitc28f1bab-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3283-2 https://ubuntu.com/security/notices/USN-3283-1 CVE-2015-8270, CVE-2015-8271, CVE-2015-8272 . Ensure your Ubuntu installation is up to date to resolve security issues associated with rtmpdump. This will help avert system crashes and the risk of remote code exploitation.. Ubuntu Security, rtmpdump Risk, System Update, Remote Code Execution. . Severity: Critical. LinuxSecurity.com Team
May 23, 2017
•Critical
Ubuntu
87
security advisorydenial of servicecriticalDebian DSA-3850-1 Critical: rtmpdump Denial Of Service Threat
Dave McDaniel discovered multiple vulnerabilities in rtmpdump, a small dumper/library for RTMP media streams, which may result in denial of service or the execution of arbitrary code if a malformed stream is dumped. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3850-1
May 12, 2017
•Critical
Debian
172
security advisorydenial of serviceremote executionUbuntu 16.04 LTS USN-3283-1 Critical: rtmpdump Denial of Service
rtmpdump could be made to crash or run programs as your login if it processed a specially crafted stream.. =========================================================================Ubuntu Security Notice USN-3283-1 May 09, 2017 rtmpdump vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: rtmpdump could be made to crash or run programs as your login if it processed a specially crafted stream. Software Description: - rtmpdump: small dumper for media content streamed over the RTMP protocol Details: Dave McDaniel discovered that rtmpdump incorrectly handled certain malformed streams. If a user were tricked into processing a specially crafted stream, a remote attacker could cause rtmpdump to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: librtmp1 2.4+20151223.gitfa8646d-1ubuntu0.1 Ubuntu 14.04 LTS: librtmp0 2.4+20121230.gitdf6c518-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3283-1 CVE-2015-8270, CVE-2015-8271, CVE-2015-8272 Package Information: https://launchpad.net/ubuntu/+source/rtmpdump/2.4+20151223.gitfa8646d-1ubuntu0.1 https://launchpad.net/ubuntu/+source/rtmpdump/2.4+20121230.gitdf6c518-1ubuntu0.1 . Debian Security Advisory DSA-4543-1 discusses vulnerabilities in libxml2 posing potential issues of remote code execution and information leakage.. rtmpdump vulnerabilities, ubuntu security, denial of service, remote code execution. . Severity: Critical. LinuxSecurity.com Team
May 09, 2017
•Critical
Ubuntu
197
security advisorydenial of servicecode executionDebian 7 Wheezy DLA-917-1 Moderate: RTMPDump Multiple Threats
Several vulnerabilities were found in rtmpdump and the librtmp library. CVE-2015-8270 . Hash: SHA256 Package : rtmpdump Version : 2.4+20111222.git4e06e21-1+deb7u1 CVE ID : CVE-2015-8270 CVE-2015-8271 CVE-2015-8272 Several vulnerabilities were found in rtmpdump and the librtmp library. CVE-2015-8270 A bug in AMF3ReadString in librtmp can cause a denial of service via application crash to librtmp users that talk to a malicious server. CVE-2015-8271 The AMF3_Decode function in librtmp doesn't properly validate its input, which can lead to arbitrary code execution when talking to a malicious attacker. CVE-2015-8272 A bug in rtmpsrv can lead to a crash when talking to a malicious client. For Debian 7 "Wheezy", these problems have been fixed in version 2.4+20111222.git4e06e21-1+deb7u1. We recommend that you upgrade your rtmpdump packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Update rtmpdump to address various security flaws that may result in denial-of-service attacks or permit execution of arbitrary code.. Debian Security Update, RTMPDump Exploits, Library Threats, DoS Risks. . Severity: Important. LinuxSecurity.com Team
Apr 26, 2017
•Important
Debian LTS
91
security advisorygentooarbitrary code executionGentoo: GLSA-202303-01 Moderate: Security Flaws Found in RTMPDump
Multiple vulnerabilities have been found in RTMPDump, the worst of which could lead to arbitrary code execution.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201702-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: RTMPDump: Multiple vulnerabilities Date: February 06, 2017 Bugs: #570242 ID: 201702-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in RTMPDump, the worst of which could lead to arbitrary code execution. Background ========= RTMPDump is an RTMP client intended to stream audio or video flash content Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-video/rtmpdump < 2.4_p20161210 > = 2.4_p20161210 Description ========== Multiple vulnerabilities have been discovered in RTMPDump. The following is a list of vulnerabilities fixed: * Additional decode input size checks * Ignore zero-length packets * Potential integer overflow in RTMPPacket_Alloc(). * Obsolete RTMPPacket_Free() call left over from original C++ to C rewrite * AMFProp_GetObject must make sure the prop is actually an object Impact ===== A remote attacker could entice a user to open a specially crafted media flash file using RTMPDump. This could possibly result in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All RTMPDump users should upgrade to the latest version: # emerge --sync # emerge--ask --oneshot -v "> =media-video/rtmpdump-2.4_p20161210" References ========= [ 1 ] OSS ML CVE Request https://www.openwall.com/lists/oss-security/2015/12/30/1 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201702-02 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Feb 06, 2017
Gentoo
198
security advisoryhigh severitycode executionArch Linux ASA-201601-1 High Severity: Rtmpdump Remote Execution Risk
The package rtmpdump before version 1:2.4.r96.fa8646d-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-201601-1 ======================================== Severity: High Date : 2016-01-02 CVE-ID : Pending Package : rtmpdump Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/title/CVE Summary ====== The package rtmpdump before version 1:2.4.r96.fa8646d-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 1:2.4.r96.fa8646d-1. # pacman -Syu "rtmpdump> =1:2.4.r96.fa8646d-1" The problem has been fixed upstream but no updated version has been released. Workaround ========= None. Description ========== Several issues have been found in the part of rtmpdump handling RTMP streams by LMX of Qihoo 360 Codesafe Team. These issues include memory leak, integer overflow, type confusion when dealing with AMF strings and objects, and several other parsing issues. Impact ===== A remote attacker is able to craft a special rtmp stream that, when processed, can cause arbitrary code execution. References ========= https://bugs.archlinux.org/task/47564 . Debian security notice DSA-2021-001 for libxml2 highlights critical memory corruption vulnerability. Immediate patch is advised.. Arch Linux, rtmpdump, High Severity Advisory, remote Code Execution. . LinuxSecurity.com Team
Jan 02, 2016
ArchLinux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!