[ GLSA 201502-05 ] tcpdump

[GLSA]

Gentoo Linux Security Advisory

Title: tcpdump: Multiple vulnerabilities (GLSA 201502-05)
Severity: normal
Exploitable: remote
Date: February 07, 2015
Bug(s): #534660
ID: 201502-05

Synopsis

Multiple vulnerabilities in tcpdump could result in execution of
arbitrary code or Denial of Service.


Background

tcpdump is a tool for capturing and inspecting network traffic.

Affected Packages

Package: net-analyzer/tcpdump
Vulnerable: < 4.6.2-r1
Unaffected: >= 4.6.2-r1
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in tcpdump:

• The olsr_print function function contains an integer underflow error
  (CVE-2014-8767)
  
• The geonet_print function function contains multiple integer
  underflow errors (CVE-2014-8768)
  
• The decoder for the Ad hoc On-Demand Distance Vector protocol
  contains an out-of-bounds memory access error (CVE-2014-8769)
  
• The ppp_hdlc function contains a buffer overflow error
  (CVE-2014-9140)
  

Impact

A remote attacker may be able to send a specially crafted packet,
possibly resulting in execution of arbitrary code or a Denial of Service
condition.


Workaround

There is no known workaround at this time.

Resolution

All tcpdump users should upgrade to the latest version: