Description
Buffer overflow in the mpfr_strtofr function in GNU MPFR before 3.1.2-p11 allows context-dependent attackers to have unspecified impact via vectors related to incorrect documentation for mpn_set_str.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mpfr4 | 3.1.2-2 | — |
| Debian 13 | mpfr4 | 3.1.2-2 | — |
| Debian 12 | mpfr4 | 3.1.2-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | mpfr4 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 ELS | mpfr +1 | 3.1.1-4.el7_9.2 | RHSA-2025:9332 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mpfr | 3.1.5-2.1 | openSUSE-SU-2024:10472-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | mpfr +1 | 3.1.1-4.0.1.el7 | ELSA-2025-9332 |
Advisories 4
- RHSA-2025:9332 Red Hat Security Advisory: mpfr security update Red Hat Security Advisories (RHSA) · May 13, 2026
- openSUSE-SU-2024:10472-1 libmpfr4-3.1.5-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1369 Red Hat Enterprise Linux (mpfr): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jul 9, 2025
- ELSA-2025-9332 Important: mpfr security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 8, 2025
References
- 71542 vdb-entry
- [oss-security] 20150103 Re: CVE request: mpfr: buffer overflow in mpfr_strtofr mailing-list
- FEDORA-2014-16964 vendor-advisory
- [gmp-bugs] 20131216 out-of-bound write mailing-list
- http://www.mpfr.org/mpfr-3.1.2/patch11
- https://gforge.inria.fr/scm/viewvc.php/mpfr?revision=9243&view=revision
- FEDORA-2014-16967 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1171701
- GLSA-201512-06 vendor-advisory