Heap-Based Buffer Overflow Vulnerability in bsdiff Package
Summary
DEBIAN-CVE-2014-9862: Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overf... Affects bsdiff versions < 4.3-17. Fixed in 4.3-17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bsdiff is a tool used for creating and applying binary patches. It is widely utilized in various software applications to efficiently update files by only transmitting the differences between the original and modified versions. However, bsdiff has been found to have a critical vulnerability that affects its integrity and security, particularly in versions prior to 4.3-17 across multiple Debian releases.
Vulnerability Detail
The vulnerability, identified as CVE-2014-9862, stems from an integer signedness error in the bspatch.c file of the bsdiff tool. This flaw allows remote attackers to exploit the software by crafting malicious patch files, which can lead to arbitrary code execution or a denial of service due to a heap-based buffer overflow. The vulnerability is particularly concerning as it can be triggered by untrusted input, making systems using vulnerable versions of bsdiff susceptible to attacks.
How To Fix
Minimum fixed version
4.3-17
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bsdiffTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the bsdiff tool or validating patch files before applying them to mitigate potential risks. Additionally, using alternative patching tools that do not have this vulnerability may be a temporary solution.
Conclusion
The bsdiff package has a critical vulnerability (CVE-2014-9862) that can lead to severe security risks if not addressed. Users are strongly advised to update to version 4.3-17 or later to protect their systems from potential exploitation. For those unable to update immediately, implementing workarounds can help mitigate risks until a proper fix is applied.
See every vulnerability recorded for bsdiff →
FAQ
CVE-2014-9862 is a vulnerability in the bsdiff package that allows remote attackers to execute arbitrary code or cause a denial of service through crafted patch files.
All versions of bsdiff prior to 4.3-17 are affected by this vulnerability across multiple Debian releases.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, consider restricting access to the bsdiff tool and validating patch files before applying them as a temporary measure.
The consequences include the possibility of arbitrary code execution by attackers and denial of service, which can compromise system integrity and availability.
References
Related vulnerabilities
Recent vulnerabilities recorded for bsdiff.
