CVE-2015-7236
Fixed in a distro release EPSS 6%
Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.
Products: rpcbind_project rpcbind, canonical ubuntu_linux, debian_linux, oracle solaris
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rpcbind | 0.2.1-6.1 |
| Debian 13 | rpcbind | 0.2.1-6.1 |
| Debian 14 | rpcbind | 0.2.1-6.1 |
| Debian 6.0 | rpcbind | 0.2.0-4.1+deb6u1 |
| Debian 7 | rpcbind | 0.2.0-8+deb7u1 |
| Debian 8 | rpcbind | 0.2.1-6+deb8u1 |
| Red Hat Enterprise Linux 6 | rpcbind | 0:0.2.0-11.el6_7 |
| Red Hat Enterprise Linux 6 | rpcbind-debuginfo | 0:0.2.0-11.el6_7 |
| Red Hat Enterprise Linux 7 | rpcbind | 0:0.2.0-33.el7_2 |
| Red Hat Enterprise Linux 7 | rpcbind-debuginfo | 0:0.2.0-33.el7_2 |
| SUSE Linux Enterprise Desktop 11 SP3 | rpcbind | 0.1.6+git20080930-6.24.1 |
| SUSE Linux Enterprise Desktop 11 SP4 | rpcbind | 0.1.6+git20080930-6.24.1 |
| SUSE Linux Enterprise Desktop 12 | rpcbind | 0.2.1_rc4-13.3.1 |
| SUSE Linux Enterprise Server 11 SP3 | rpcbind | 0.1.6+git20080930-6.24.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | rpcbind | 0.1.6+git20080930-6.24.1 |
| SUSE Linux Enterprise Server 11 SP4 | rpcbind | 0.1.6+git20080930-6.24.1 |
| SUSE Linux Enterprise Server 12 | rpcbind | 0.2.1_rc4-13.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP3 | rpcbind | 0.1.6+git20080930-6.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | rpcbind | 0.1.6+git20080930-6.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | rpcbind | 0.2.1_rc4-13.3.1 |
| Ubuntu 14.04 LTS | rpcbind | 0.2.1-2ubuntu2.2 |
| openSUSE Tumbleweed | rpcbind | 0.2.3-7.1 |