[manjaro-security] [ASA-202011-29] musl: arbitrary code execution
foxboron at archlinux.org
Sat Dec 5 15:28:16 CET 2020
Arch Linux Security Advisory ASA-202011-29
Date : 2020-11-26
CVE-ID : CVE-2020-28928
Package : musl
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-1287
The package musl before version 1.2.1-2 is vulnerable to arbitrary code
Upgrade to 1.2.1-2.
# pacman -Syu "musl>=1.2.1-2"
The problem has been fixed upstream but no release is available yet.
The wcsnrtombs function in all musl libc versions up to 1.2.1 has been
found to have multiple bugs in the handling of the destination buffer
size when limiting the input character count, which can lead to an
infinite loop with no progress (no overflow) or to writing past the end
of the destination buffer.
An attacker might be able to execute arbitrary code via crafted input
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the manjaro-security