CVE-2017-1000376
Fixed in a distro release EPSS <1%
libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.
Products: redhat enterprise_virtualization_server, redhat openshift, redhat enterprise_linux, debian_linux, libffi_project libffi, oracle peopletools
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | libffi | 3.2.1-1 |
| Debian 12 | libffi | 3.2.1-4 |
| Debian 13 | libffi | 3.2.1-4 |
| Debian 14 | libffi | 3.2.1-4 |
| Debian 7 | libffi | 3.0.10-3+deb7u1 |
| Debian 8 | libffi | 3.1-2+deb8u1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | gcc43 | 4.3.4_20091019-37.3.1 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | gcc43 | 4.3.4_20091019-37.3.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | gcc43 | 4.3.4_20091019-37.3.1 |
| SUSE Linux Enterprise Server 11 SP4 | gcc43 | 4.3.4_20091019-37.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | gcc43 | 4.3.4_20091019-37.3.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | gcc43 | 4.3.4_20091019-37.3.1 |
| Ubuntu 14.04 LTS | libffi | 3.1~rc1+r3.0.13-12ubuntu0.2 |