bugtraq - [SECURITY] [DSA 3366-1] rpcbind security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1Zeqkn-0006PU-Pb@master.debian.org>
Date: Wed, 23 Sep 2015 20:35:01 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3366-1] rpcbind security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3366-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
September 23, 2015                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : rpcbind
CVE ID         : CVE-2015-7236
Debian Bug     : 799307

A remotely triggerable use-after-free vulnerability was found in
rpcbind, a server that converts RPC program numbers into universal
addresses. A remote attacker can take advantage of this flaw to mount a
denial of service (rpcbind crash).

For the oldstable distribution (wheezy), this problem has been fixed
in version 0.2.0-8+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 0.2.1-6+deb8u1.

We recommend that you upgrade your rpcbind packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWAwzQAAoJEAVMuPMTQ89E9VEP/2IDBmO1aXqMkPafv7Oty7pa
hRBzyaDuHLx4cAyxf42uPVtEcqp1aZWF2JCLKgPtn1AkY6n2h1R4ZOgB7KxF3sjy
Ll930/0ezZ1mkTcQcsAyQd7V1wEa1tAKal9ltlXRwyoHrA81fPsAQ3AwijHzkXjC
F2JSNsStRtNazA3mnL1XA+xVLc4HcI7hOVTkEGLGAQ5V8yQUOikd7kSUUlnhefs+
fxlVbdEY1hlh+bp63xcQzc3pofTuSLwGuBlCv+Dw4GViahjLokuDtNC4Hiic052R
6/WvU1KnfO6rTgXl9zpQ32S1NhnZd7BlWRWl/4BMFPGDxd/Rbdct2hJPcGtiO731
+6wMT+VEio2Os2oX2/EJ2K0BmGovWJzOKfkbCYDxENZHURpuEtLF68Z3Gz/y5+Pd
0NXCpqctEmzf4BPD+dl+W7HGguKSxB8zlDkvDv3KP9Lc7BmPtmRECbJyG/lm6bTs
G9XRHJtk0N/PuyXPxqkc7AsUa30aBIl09or8MWow/qagmDFqU2bbB2YZ/02RShLA
va42dlHYYkiKv93sdi6WOWmMBAE51urXq7kNsnPqx8Yd2lbTH2MO+L+O4IKKpeQw
wyzkAlC1v+dLxwT+8lVPbvyHQIkHw294/PHJ7RGl2YO5V8RFg8SDpaIajKfTninC
KqAwj5LtmRojqIlrqXDM
=72mN
-----END PGP SIGNATURE-----