Description
Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application because Cap'n Proto relies on pointer arithmetic calculations that overflow. An example compiler with optimization that elides a bounds check in such calculations is Apple LLVM version 8.1.0 (clang-802.0.41). The attack vector is a crafted far pointer within a message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | capnproto | 0.6.1-1 | — |
| Debian 13 | capnproto | 0.6.1-1 | — |
| Debian 12 | capnproto | 0.6.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | capnproto | 0.6.1-1 | — |
| Ubuntu 16.04 LTS | capnproto | 0.5.3-2ubuntu1.1 | — |
| Ubuntu 14.04 LTS | capnproto | 0.4.0-1ubuntu2.1 | — |