A defect in the Libevent evbuffer API could possibly leave some programs that use the evbuffer API open to potential heap overflows.  A program using the evbuffer_add(), evbuffer_expand(), or bufferevent_write() functions in Libevent 1.4 may be vulnerable if an attacker is able to coax the linked program into trying to make a buffer larger than that which would fit into a single size_t.  Similarly, for Libevent 2.0 and later, a program may be vulnerable if it uses the evbuffer_add(), evbuffer_prepend(), evbuffer_expand(), exbuffer_reserve_space(), or evbuffer_read() functions if an attacker is able to coax the linked program into trying to make a buffer chunk larger than that which will fit into a single size_t.

Upstream has attempted to identify any programs using Libevent in a vulnerable way and has not as of yet found any that do.  As a precaution, upstream recommends patching/upgrading Libevent to protect against this sort of scenario.  Upstream will be releasing Libevent 1.4.15-stable and 2.0.22-stable, as well as 2.1.5-alpha, to correct this issue.


Acknowledgements:

Red Hat would like to thank Nick Mathewson of Libevent upstream for reporting this issue. Upstream acknowledges Andrew Bartlett of Catalyst as the original reporter.