Heap-Based Buffer Overflow in bsdiff Package: CVE-2014-9862
Summary
CVE-2014-9862: Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overf... Affects bsdiff versions < 4.3-17. Fixed in 4.3-17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bsdiff package is a tool used for creating and applying binary patches. It is widely utilized in various software applications to efficiently update files without needing to replace the entire file. The package is known for its ability to handle large files and create small patch files. However, prior to version 4.3-17, bsdiff was vulnerable to an integer signedness error, which could lead to severe security risks.
Vulnerability Detail
CVE-2014-9862 is an integer signedness error found in the bspatch.c file of the bsdiff tool. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service through a crafted patch file. The flaw arises from improper handling of signed integers, leading to a heap-based buffer overflow. This can result in unauthorized access to system resources and potential exploitation of the affected system.
How To Fix
Minimum fixed version
4.3-17
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bsdiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid applying untrusted patch files until the package is updated. Additionally, implementing strict access controls on systems using bsdiff can help mitigate the risk of exploitation.
Conclusion
CVE-2014-9862 is a significant vulnerability in the bsdiff package that poses serious security risks. Users are strongly advised to update to the latest version to mitigate potential threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for bsdiff →
FAQ
CVE-2014-9862 is a vulnerability in the bsdiff package that allows remote attackers to execute arbitrary code or cause a denial of service through a crafted patch file.
If your system uses an affected version of bsdiff, it may be susceptible to remote code execution or denial of service attacks, compromising system integrity and availability.
All versions of bsdiff prior to 4.3-17 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file, like package-lock.json, to check for vulnerabilities.
The CVSS score of CVE-2014-9862 is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for bsdiff.
