Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2020-6072 →
DEBIAN-CVE-2020-6072
An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels i...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:13
libmicrodns
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-1"}]}]
Debian:14
libmicrodns
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-1"}]}]
Debian:12
vlc
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-4"}]}]
Debian:13
vlc
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-4"}]}]
Debian:14
vlc
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-4"}]}]
Références
- advisory security-tracker.debian.org