Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop. NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension     in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain     sensitive information by sniffing the network during a session in which there was an incorrect decision to     accept a compromised and revoked certificate. (CVE-2014-8642)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required     character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout     CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP     response. (CVE-2013-6167)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required     character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout     CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP     response. (CVE-2013-6167)

  - Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension     in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain     sensitive information by sniffing the network during a session in which there was an incorrect decision to     accept a compromised and revoked certificate. (CVE-2014-8642)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the libevent package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple integer overflows in the evbuffer API in     Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and     2.1.x before 2.1.5-beta allow context-dependent     attackers to cause a denial of service or possibly have     other unspecified impact via 'insanely large inputs' to     the (1) evbuffer_add, (2) evbuffer_expand, or (3)     bufferevent_write function, which triggers a heap-based     buffer overflow or an infinite loop. NOTE: this     identifier has been SPLIT per ADT3 due to different     affected versions. See CVE-2015-6525 for the functions     that are only affected in 2.0 and later.(CVE-2014-6272)

  - Multiple integer overflows in the evbuffer API in     Libevent 2.0.x before 2.0.22 and 2.1.x before     2.1.5-beta allow context-dependent attackers to cause a     denial of service or possibly have other unspecified     impact via 'insanely large inputs' to the (1)     evbuffer_add, (2) evbuffer_prepend, (3)     evbuffer_expand, (4) exbuffer_reserve_space, or (5)     evbuffer_read function, which triggers a heap-based     buffer overflow or an infinite loop. NOTE: this     identifier was SPLIT from CVE-2014-6272 per ADT3 due to     different affected versions.(CVE-2015-6525)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via 'insanely large inputs' to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop. NOTE:
this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2015-6525 for the functions that are only affected in 2.0 and later. (CVE-2014-6272)

Multiple integer overflow flaws were found in the libevent's evbuffer API. An attacker able to make an application pass an excessively long input to libevent using the API could use these flaws to make the application enter an infinite loop, crash, and, possibly, execute arbitrary code. (CVE-2015-6525)

Andrew Bartlett of Catalyst reported a defect affecting certain applications using the Libevent evbuffer API. This defect leaves applications which pass insanely large inputs to evbuffers open to a possible heap overflow or infinite loop. In order to exploit this flaw, an attacker needs to be able to find a way to provoke the program into trying to make a buffer chunk larger than what will fit into a single size_t or off_t.

ID	Name	Product	Family	Severity
200050	RHEL 7 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
200049	RHEL 6 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
200040	RHEL 5 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
131668	EulerOS 2.0 SP2 : libevent (EulerOS-SA-2019-2515)	Nessus	Huawei Local Security Checks	high
131027	Amazon Linux 2 : libevent (ALAS-2019-1359)	Nessus	Amazon Linux Local Security Checks	high
80393	Debian DSA-3119-1 : libevent - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-6525

critical

Tenable Plugins

critical

critical

critical

high

high

high