lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 11 Feb 2019 13:34:28 +0000 From: Sebastien Delafond <seb@...ian.org> To: bugtraq@...urityfocus.com Subject: [SECURITY] [DSA 4389-1] libu2f-host security update -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4389-1 security@...ian.org https://www.debian.org/security/ Sebastien Delafond February 11, 2019 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libu2f-host CVE ID : CVE-2018-20340 Debian Bug : 921725 Christian Reitter discovered that libu2f-host, a library implementing the host-side of the U2F protocol, failed to properly check for a buffer overflow. This would allow an attacker with a custom made malicious USB device masquerading as a security key, and physical access to a computer where PAM U2F or an application with libu2f-host integrated, to potentially execute arbitrary code on that computer. For the stable distribution (stretch), this problem has been fixed in version 1.1.2-2+deb9u1. We recommend that you upgrade your libu2f-host packages. For the detailed security status of libu2f-host please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libu2f-host Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@...ts.debian.org -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAlxhdxAACgkQEL6Jg/PV nWSRdQf+Pt+y/MxE9ugOhakI80frcv8zTVYjE1PDu8ZvP6TjJDUT354O1njS05iX bYgw+PCHORKSvDIiwisMUFFqN6JdtWdweGyk+CyKO2pa4PLaQKXoTHSqfkxgSk5+ 7bykv5KgxfYLHFs3WewW2ZjC0TMcLMNr8u6uW0i9gWC8r4cnvZP7ftpUFdTfCcvj lFVLBGDBB6cS4dX+ZkMxtzJuyXE4JzIlLCECKJTYPeEGDxJLwd6v2MEgqKYswF1J +50VqdWi398+4koamrpAt1YnRK/QPYknU6Sfir++MuONPKbmHwPQX3/wDupsG//n AvswjQEqfv03MvTPNpEr50EBpeRbeA== =jLYL -----END PGP SIGNATURE-----
Powered by blists - more mailing lists