Description
Buffer overflow in the "read-u8vector!" procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | chicken | 4.9.0-1 | — |
| Debian 13 | chicken | 4.9.0-1 | — |
| Debian 12 | chicken | 4.9.0-1 | — |
References
- 67468 vdb-entry
- [Chicken-hackers] 20140517 [PATCH] Bound read-u8vector! to dest vector's size when no length is given mailing-list
- https://bugs.call-cc.org/ticket/1124
- [oss-security] 20140519 Re: CVE request for buffer overrun in CHICKEN Scheme mailing-list
- http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git%3Ba=commit%3Bh=1d06ce7e21c7e903ca5dca11fda6fcf2cc52de5e
- GLSA-201612-54 vendor-advisory
- [oss-security] 20140518 CVE request for buffer overrun in CHICKEN Scheme mailing-list
- [chicken-announce] 20140518 [SECURITY] Buffer-overrun in some uses of read-u8vect mailing-list