[arch-security] [ASA-201711-29] varnish: information disclosure
foxboron at archlinux.org
Sun Nov 26 23:40:52 UTC 2017
Arch Linux Security Advisory ASA-201711-29
Date : 2017-11-26
CVE-ID : CVE-2017-8807
Package : varnish
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-502
The package varnish before version 5.2.1-1 is vulnerable to information
Upgrade to 5.2.1-1.
# pacman -Syu "varnish>=5.2.1-1"
The problem has been fixed upstream in version 5.2.1.
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache
4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to
obtain sensitive information from process memory because a
VFP_GetStorage buffer is larger than intended in certain circumstances
involving -sfile Stevedore transient objects.
A remote attacker is able to retrieve sensitive information from the
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security