Description
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qpid-cpp | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | cumin-messaging | 0.1.1-2.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | mrg-release | 2.3.0-1.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | python-qpid | 0.18-4.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | qpid-cpp | 0.18-14.el6 | RHSA-2013:0562 |
| Red Hat MRG 2 | qpid-cpp-mrg +12 | 0.18-14.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | qpid-java +3 | 0.18-7.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | qpid-jca +2 | 0.18-8.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | qpid-qmf +3 | 0.18-15.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | rhm-docs +1 | 0.18-2.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | rubygem-rake | 0.8.7-2.1.el6 | RHSA-2013:0562 |
| Red Hat MRG 2 | rubygems | 1.8.16-1.el6 | RHSA-2013:0562 |
| Red Hat MRG 2 | saslwrapper +3 | 0.18-1.el5 | RHSA-2013:0562, RHSA-2013:0561 |
| Red Hat MRG 2 | xerces-c +2 | 3.0.1-20.el6 | RHSA-2013:0562 |
| Red Hat MRG 2 | xqilla +2 | 2.2.3-8.el6 | RHSA-2013:0562 |
Advisories 2
- RHSA-2013:0561 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.3 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:0562 Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.3 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=861241
- https://issues.apache.org/jira/issues/?jql=fixVersion%20%3D%20%220.21%22%20AND%20project%20%3D%20QPID
- RHSA-2013:0561 vendor-advisory
- https://issues.apache.org/jira/browse/QPID-4629
- RHSA-2013:0562 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1453031
- 52516 third-party-advisory