CVE-2014-2977
Fixed in a distro release EPSS 7%
Multiple integer signedness errors in the Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB 1.4.13 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.
Products: opensuse, suse linux_enterprise_desktop, suse linux_enterprise_software_development_kit, suse linux_enterprise_workstation_extension, suse_linux_enterprise_server, directfb
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Desktop 12 | DirectFB | 1.7.1-4.1 |
| SUSE Linux Enterprise Server 12 | DirectFB | 1.7.1-4.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | DirectFB | 1.7.1-4.1 |
| SUSE Linux Enterprise Software Development Kit 12 | DirectFB | 1.7.1-4.1 |
| SUSE Linux Enterprise Workstation Extension 12 | DirectFB | 1.7.1-4.1 |
| openSUSE Tumbleweed | DirectFB | 1.7.7-5.9 |