Описание
A flaw was found in svxlink's svxreflector component. A dangling Json::Value reference is written to after the underlying storage is replaced upon receiving repeated MsgNodeInfo messages. This use-after-free write can lead to a crash or potentially arbitrary code execution.
Отчет
svxlink is not shipped in any Red Hat Enterprise product. It is available in Fedora as a community-maintained package.
Меры по смягчению последствий
Update svxlink to version 26.05.1 or later.
Дополнительная информация
Статус:
Important
Дефект:
CWE-416
https://bugzilla.redhat.com/show_bug.cgi?id=2513803svxlink: svxlink: Use-after-free write via dangling JSON reference in svxreflector
Связанные уязвимости
ubuntu
16 дней назад
[GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference]
debian
[GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference]