Description
Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gnustep-base | 1.24.6-1 | — |
| Debian 13 | gnustep-base | 1.24.6-1 | — |
| Debian 12 | gnustep-base | 1.24.6-1 | — |
References
- gnustep-cve20142980-dos(92688) vdb-entry
- https://savannah.gnu.org/bugs/?41751
- http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/Tools/gdomap.c?r1=37756&r2=37755&pathrev=37756
- 66992 vdb-entry
- http://svn.gna.org/viewcvs/gnustep/libs/base/trunk/ChangeLog?r1=37756&r2=37755&pathrev=37756
- [oss-security] 20140421 Re: CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) mailing-list
- [oss-security] 20140419 CVE request / advisory: gdomap (GNUstep core package <= 1.24.6) mailing-list
- 58104 third-party-advisory