All errata/sisyphus/ALT-PU-2016-2235-1
ALT-PU-2016-2235-1

Package update memcached in branch sisyphus

Version1.4.33-alt1
Task#171800
Published2016-11-02
Max severityCRITICAL
Severity:

Closed issues (8)

BDU:2015-09681
CRITICAL10.0

Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Published: 2015-04-28Modified: 2026-04-30
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
CVE-2013-0179
LOW1.8

The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.

Published: 2014-01-13Modified: 2026-04-29
CVSS 2.0LOW 1.8
CVSS:2.0/AV:A/AC:H/Au:N/C:N/I:N/A:P
References
CVE-2013-7239
MEDIUM4.8

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Published: 2014-01-13Modified: 2026-04-29
CVSS 2.0MEDIUM 4.8
CVSS:2.0/AV:A/AC:L/Au:N/C:P/I:P/A:N
References
CVE-2013-7290
LOW1.8

The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.

Published: 2014-01-13Modified: 2026-04-29
CVSS 2.0LOW 1.8
CVSS:2.0/AV:A/AC:H/Au:N/C:N/I:N/A:P
References
CVE-2013-7291
LOW1.8

memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an "unbounded key print" during logging, related to an issue that was "quickly grepped out of the source tree," a different vulnerability than CVE-2013-0179 and CVE-2013-7290.

Published: 2014-01-13Modified: 2026-04-29
CVSS 2.0LOW 1.8
CVSS:2.0/AV:A/AC:H/Au:N/C:N/I:N/A:P
References
CVE-2016-8704
CRITICAL9.8

An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Published: 2017-01-06Modified: 2025-04-20
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2016-8705
CRITICAL9.8

Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Published: 2017-01-06Modified: 2025-04-20
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
CVE-2016-8706
HIGH8.1

An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Published: 2017-01-06Modified: 2025-04-20
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS 3.xHIGH 8.1
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References