A defect in the Libevent evbuffer API could possibly leave some programs that use the evbuffer API open to potential heap overflows. A program using the evbuffer_add(), evbuffer_expand(), or bufferevent_write() functions in Libevent 1.4 may be vulnerable if an attacker is able to coax the linked program into trying to make a buffer larger than that which would fit into a single size_t. Similarly, for Libevent 2.0 and later, a program may be vulnerable if it uses the evbuffer_add(), evbuffer_prepend(), evbuffer_expand(), exbuffer_reserve_space(), or evbuffer_read() functions if an attacker is able to coax the linked program into trying to make a buffer chunk larger than that which will fit into a single size_t. Upstream has attempted to identify any programs using Libevent in a vulnerable way and has not as of yet found any that do. As a precaution, upstream recommends patching/upgrading Libevent to protect against this sort of scenario. Upstream will be releasing Libevent 1.4.15-stable and 2.0.22-stable, as well as 2.1.5-alpha, to correct this issue. Acknowledgements: Red Hat would like to thank Nick Mathewson of Libevent upstream for reporting this issue. Upstream acknowledges Andrew Bartlett of Catalyst as the original reporter.
Created attachment 957618 [details] Upstream patch for 1.4
Created attachment 957619 [details] Upstream patch for 2.0
Created attachment 975152 [details] Updated upstream patch for 2.0
Created attachment 975153 [details] Updated upstream patch for 2.1
Fixed now upstream in versions 1.4.15, 2.0.22 and 2.1.5. Upstream advisory: http://archives.seul.org/libevent/users/Jan-2015/msg00010.html Announcements of new releases and git commits: 1.4: http://archives.seul.org/libevent/users/Jan-2015/msg00013.html https://github.com/libevent/libevent/commit/7b21c4eabf1f3946d3f63cce1319c490caab8ecf 2.0: http://archives.seul.org/libevent/users/Jan-2015/msg00012.html https://github.com/libevent/libevent/commit/20d6d4458bee5d88bda1511c225c25b2d3198d6c 2.1: http://archives.seul.org/libevent/users/Jan-2015/msg00011.html https://github.com/libevent/libevent/commit/841ecbd96105c84ac2e7c9594aeadbcc6fb38bc4
Created libevent tracking bugs for this issue: Affects: fedora-all [bug 1178963]
Statement: This issue affects the versions of libevent as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This issue is not planned to be addressed in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle:https://access.redhat.com/support/policy/updates/errata/.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2014-6272