CVE-2014-8154: Buffer Overflow
First published: Tue Jan 13 2015(Updated: )
Sergey "Shnatsel" Davidoff reported a heap-based buffer overflow in Vala Gstreamer bindings in the Gst.MapInfo() function. Further details are available in the following Red Hat bug: <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED EOL - All Vala programs that use Gst.MapInfo() are vulnerable to heap buffer overflow due to a bug in Vala bindings for GStreamer" href="show_bug.cgi?id=1177840">https://bugzilla.redhat.com/show_bug.cgi?id=1177840</a> This issue was also reported via: <a href="https://bugzilla.gnome.org/show_bug.cgi?id=678663">https://bugzilla.gnome.org/show_bug.cgi?id=678663</a> and fixed in the following commit: <a href="https://git.gnome.org/browse/vala/commit/?id=3092537db65887e24a3d3e87a27caf9c5295e4f7">https://git.gnome.org/browse/vala/commit/?id=3092537db65887e24a3d3e87a27caf9c5295e4f7</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNOME Vala | =0.26.0 | |
| GNOME Vala | =0.26.1 | |
| openSUSE libeconf | =13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00069.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1177840
- https://bugzilla.redhat.com/show_bug.cgi?id=1181404
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1177840
- https://bugzilla.gnome.org/show_bug.cgi?id=678663
- https://git.gnome.org/browse/vala/commit/?id=3092537db65887e24a3d3e87a27caf9c5295e4f7
Frequently Asked Questions
What is the severity of CVE-2014-8154?
CVE-2014-8154 has a high severity due to the potential for remote code execution from a heap-based buffer overflow.
How do I fix CVE-2014-8154?
To mitigate CVE-2014-8154, update to a patched version of Vala or GStreamer that addresses this vulnerability.
What systems are affected by CVE-2014-8154?
CVE-2014-8154 affects Vala version 0.26.0, 0.26.1, and openSUSE version 13.2.
Is CVE-2014-8154 being actively exploited?
At the time of reporting, there was no indication of active exploitation of CVE-2014-8154 in the wild.
Who reported CVE-2014-8154?
CVE-2014-8154 was reported by Sergey 'Shnatsel' Davidoff.
- agent/type
- agent/first-publish-date
- agent/references
- agent/remedy
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-8154
- agent/weakness
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- vendor/gnome
- canonical/gnome vala
- version/gnome vala/0.26.0
- version/gnome vala/0.26.1
- vendor/opensuse
- canonical/opensuse libeconf
- version/opensuse libeconf/13.2