Executive Summary
| Summary | |
|---|---|
| Title | libffi security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-3889 | First vendor Publication | 2017-06-19 |
| Vendor | Debian | Last vendor Modification | 2017-06-19 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 6.9 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 3.4 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| libffi, a library used to call code written in one language from code written in a different language, was enforcing an executable stack on the i386 architecture. While this might not be considered a vulnerability by itself, this could be leveraged when exploiting other vulnerabilities, like for example the "stack clash" class of vulnerabilities discovered by Qualys Research Labs. For the full details, please refer to their advisory published at: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt For the oldstable distribution (jessie), this problem has been fixed in version 3.1-2+deb8u1. For the stable distribution (stretch), this problem has been fixed in version 3.2.1-4. For the testing distribution (buster), this problem has been fixed in version 3.2.1-4. For the unstable distribution (sid), this problem has been fixed in version 3.2.1-4. We recommend that you upgrade your libffi packages. |
Original Source
| Url : http://www.debian.org/security/2017/dsa-3889 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Application | 2 | |
| Application | 1 | |
| Application | 1 | |
| Os | 2 | |
| Os | 2 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2017-10-13 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-3454-1.nasl - Type : ACT_GATHER_INFO |
| 2017-07-17 | Name : The remote Fedora host is missing a security update. File : fedora_2017-3fcc0d9152.nasl - Type : ACT_GATHER_INFO |
| 2017-06-22 | Name : The remote Debian host is missing a security update. File : debian_DLA-997.nasl - Type : ACT_GATHER_INFO |
| 2017-06-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3889.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2017-07-05 21:24:39 |
|
| 2017-06-21 13:23:53 |
|
| 2017-06-19 21:23:36 |
|
| 2017-06-19 21:21:28 |
|
