Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog
Консоль
Π›ΠΎΠ³ΠΎΡ‚ΠΈΠΏ exploitDog

exploitDog

suse-cvrf Π»ΠΎΠ³ΠΎΡ‚ΠΈΠΏ

SUSE-SU-2018:1601-1

ΠžΠΏΡƒΠ±Π»ΠΈΠΊΠΎΠ²Π°Π½ΠΎ: 08 июн. 2018
Π˜ΡΡ‚ΠΎΡ‡Π½ΠΈΠΊ: suse-cvrf

ОписаниС

Security update for memcached

This update fixes the following issues:

  • CVE-2016-8705: Server update remote code execution (bsc#1007870).
  • CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).

Бписок ΠΏΠ°ΠΊΠ΅Ρ‚ΠΎΠ²

SUSE Linux Enterprise Software Development Kit 11 SP4
memcached-1.2.6-5.17.4.1
SUSE Studio Onsite 1.3
memcached-1.2.6-5.17.4.1
SUSE Studio Onsite Runner 1.3
memcached-1.2.6-5.17.4.1

Бсылки

ОписаниС

Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Π—Π°Ρ‚Ρ€ΠΎΠ½ΡƒΡ‚Ρ‹Π΅ ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Ρ‹
SUSE Linux Enterprise Software Development Kit 11 SP4:memcached-1.2.6-5.17.4.1
SUSE Studio Onsite 1.3:memcached-1.2.6-5.17.4.1
SUSE Studio Onsite Runner 1.3:memcached-1.2.6-5.17.4.1
Бсылки

ОписаниС

The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.

Π—Π°Ρ‚Ρ€ΠΎΠ½ΡƒΡ‚Ρ‹Π΅ ΠΏΡ€ΠΎΠ΄ΡƒΠΊΡ‚Ρ‹
SUSE Linux Enterprise Software Development Kit 11 SP4:memcached-1.2.6-5.17.4.1
SUSE Studio Onsite 1.3:memcached-1.2.6-5.17.4.1
SUSE Studio Onsite Runner 1.3:memcached-1.2.6-5.17.4.1
Бсылки
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡ‚ΡŒ SUSE-SU-2018:1601-1