[ASA-202106-44] connman: arbitrary code execution
diabonas at archlinux.org
Fri Jun 18 15:49:26 UTC 2021
Arch Linux Security Advisory ASA-202106-44
Date : 2021-06-16
CVE-ID : CVE-2021-33833
Package : connman
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-2055
The package connman before version 1.40-1 is vulnerable to arbitrary
Upgrade to 1.40-1.
# pacman -Syu "connman>=1.40-1"
The problem has been fixed upstream in version 1.40.
A security issue has been found in the dnsproxy component of connman in
releases 1.32 to 1.39. Unpacking of NAME and RDATA/RDLENGTH fields with
TYPE A/AAAA in the uncompress function uses a memcpy with insufficient
bounds checking, which can overflow a stack buffer.
A remote attacker might be able to execute arbitrary code on the
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: not available
More information about the arch-security