Summary
It was discovered that bsdiff mishandled certain input. If a user were tricked
into opening a malicious file, an attacker could cause bsdiff to crash or
potentially execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | bsdiff | 4.3-15+deb8u1build0.16.04.1 |
Vulnerabilities 1
-
Unscored —
Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, al…
References
-
report
https://ubuntu.com/security/CVE-2014-9862