musl: Integer overflow

musl: Integer overflow An integer overflow in musl might allow an attacker to execute arbitrary code. musl 2017-01-02 2017-01-02 597498 local, remote 1.1.15-r2 1.1.15-r2

musl is a “libc”, an implementation of the standard library functionality described in the ISO C and POSIX standards, plus common extensions, intended for use on Linux-based systems.

A vulnerability was discovered in musl’s tre_tnfa_run_parallel function buffer overflow logic, due to the incorrect use of integer types and missing overflow checks.

An attacker, who controls the regular expression and/or string being searched, could execute arbitrary code with the privileges of the process.

There is no known workaround at this time.

All musl users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=sys-libs/musl-1.1.15-r2"

CVE-2016-8859 b-man b-man