CVE-2015-5177: Double Free
First published: Thu Aug 06 2015(Updated: )
A double free flaw was found in openslp's SLPDProcessMessage() function. A crafted package could cause openslp to crash. This flaw only affects version 1.2.1 of openslp, which is only shipped in EPEL 5. Version 2.0.0 is not affected. OpenSLP is not actively maintained upstream so patches are not available. Acknowledgements: Red Hat would like to thank Qinghao Tang of QIHU 360 for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/openslp-dfsg | ||
| debian/1.2.1-10 | ||
| debian/openslp-dfsg | <=1.2.1-7 | 1.2.1-7.8+deb6u1 1.2.1-9+deb7u1 1.2.1-10+deb8u1 1.2.1-11 |
| OpenSLP | =1.2.1 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1069647&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1069647&action=edit
- http://sourceforge.net/p/openslp/mercurial/ci/2bc15d0494f886d9c4fe342d23bc160605aea51d/
- https://bugzilla.redhat.com/show_bug.cgi?id=1251064
- http://www.securityfocus.com/bid/76635
- http://www.securitytracker.com/id/1033719
- https://www.debian.org/security/2015/dsa-3353
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5177
- https://security-tracker.debian.org/tracker/CVE-2015-5177
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=795429
- collector/security-tracker-debian
- collector/debian-bugs
- alias/CVE-2015-5177
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- agent/weakness
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/openslp
- canonical/openslp
- version/openslp/1.2.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/7.0
- version/debian debian linux/8.0