Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta     allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact     via insanely large inputs to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4)     exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an     infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected     versions. (CVE-2015-6525)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the libevent package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple integer overflows in the evbuffer API in     Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and     2.1.x before 2.1.5-beta allow context-dependent     attackers to cause a denial of service or possibly have     other unspecified impact via 'insanely large inputs' to     the (1) evbuffer_add, (2) evbuffer_expand, or (3)     bufferevent_write function, which triggers a heap-based     buffer overflow or an infinite loop. NOTE: this     identifier has been SPLIT per ADT3 due to different     affected versions. See CVE-2015-6525 for the functions     that are only affected in 2.0 and later.(CVE-2014-6272)

  - Multiple integer overflows in the evbuffer API in     Libevent 2.0.x before 2.0.22 and 2.1.x before     2.1.5-beta allow context-dependent attackers to cause a     denial of service or possibly have other unspecified     impact via 'insanely large inputs' to the (1)     evbuffer_add, (2) evbuffer_prepend, (3)     evbuffer_expand, (4) exbuffer_reserve_space, or (5)     evbuffer_read function, which triggers a heap-based     buffer overflow or an infinite loop. NOTE: this     identifier was SPLIT from CVE-2014-6272 per ADT3 due to     different affected versions.(CVE-2015-6525)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via 'insanely large inputs' to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop. NOTE:
this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2015-6525 for the functions that are only affected in 2.0 and later. (CVE-2014-6272)

Multiple integer overflow flaws were found in the libevent's evbuffer API. An attacker able to make an application pass an excessively long input to libevent using the API could use these flaws to make the application enter an infinite loop, crash, and, possibly, execute arbitrary code. (CVE-2015-6525)

Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.

ID	Name	Product	Family	Severity
219083	Linux Distros Unpatched Vulnerability : CVE-2015-6525	Nessus	Misc.	critical
131668	EulerOS 2.0 SP2 : libevent (EulerOS-SA-2019-2515)	Nessus	Huawei Local Security Checks	high
131027	Amazon Linux 2 : libevent (ALAS-2019-1359)	Nessus	Amazon Linux Local Security Checks	high
80393	Debian DSA-3119-1 : libevent - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-6525

critical

Tenable Plugins

critical

high

high

high