Out-of-bounds Write

Affecting procps package, versions <2:3.3.9-9+deb8u1

Overview

procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users.

References

• CONFIRM
• CONFIRM
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• Exploit DB
• Gentoo Security Advisory
• MISC
• Oss-Sec Mailing List
• RHSA Security Advisory
• RHSA Security Advisory
• RHSA Security Advisory
• RHSA Security Advisory
• RHSA Security Advisory
• RHSA Security Advisory
• RHSA Security Advisory
• RedHat Bugzilla Bug
• SUSE
• SUSE
• Security Focus
• Security Tracker
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory