Buffer overflow in Debian Hivex

CVE-2014-9273

lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.

Vulnerability class: Buffer Overflow

EPSS: 0.006 (46.4th percentile) — read the EPSS interpretation.

Affected products

Debian Hivex
Opensuse — versions 13.1, 13.2
Redhat Enterprise_linux_desktop — versions 6.0, 7.0
Redhat Enterprise_linux_hpc_node — versions 6.0
Redhat Enterprise_linux_server — versions 6.0, 7.0
Redhat Enterprise_linux_workstation — versions 6.0, 7.0
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

secalert@redhat.com (vendor-advisory, x_refsource_GENTOO)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch, Issue Tracking)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch, Issue Tracking)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
secalert@redhat.com (Vendor Advisory, mailing-list, x_refsource_MLIST)