Description
Stack-based buffer overflow in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name. NOTE: it is not clear whether this is a vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mcrypt | 2.6.8-1.3 | — |
| Debian 13 | mcrypt | 2.6.8-1.3 | — |
| Debian 12 | mcrypt | 2.6.8-1.3 | — |
References
- FEDORA-2012-17290 vendor-advisory
- openSUSE-SU-2012:1440 vendor-advisory
- FEDORA-2012-17318 vendor-advisory
- FEDORA-2012-17339 vendor-advisory
- 56114 vdb-entry
- [oss-security] 20121018 Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names mailing-list
- [oss-security] 20121119 Re: CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names mailing-list
- [oss-security] 20121018 CVE Request -- mcrypt: stack-based buffer overflow by encryption / decryption of overly long file names mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=867790