The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted length value in an EBML id, which triggers an invalid memory access.

Mortiz Bunkus reports :

Multiple invalid memory accesses vulnerabilities.

Several vulnerabilities were discovered in libebml, a library for manipulating Extensible Binary Meta Language files.

  - CVE-2015-8789     Context-dependent attackers could trigger a     use-after-free vulnerability by providing a maliciously     crafted EBML document.

  - CVE-2015-8790     Context-dependent attackers could obtain sensitive     information from the process' heap memory by using a     maliciously crafted UTF-8 string.

  - CVE-2015-8791     Context-dependent attackers could obtain sensitive     information from the process' heap memory by using a     maliciously crafted length value in an EBML id.

Two security-related issues were fixed in libebml, a library for accessing the EBML format :

CVE-2015-8790

The EbmlUnicodeString::UpdateFromUTF8 function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted UTF-8 string, which triggers an invalid memory access.

CVE-2015-8791

The EbmlElement::ReadCodedSizeValue function in libEBML before 1.3.3 allows context-dependent attackers to obtain sensitive information from process heap memory via a crafted length value in an EBML id, which triggers an invalid memory access.

For Debian 6 'squeeze', these issues have been fixed in libebml version 0.7.7-3.1+deb6u1. We recommend you to upgrade your libebml packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
96993	FreeBSD : libebml -- multiple vulnerabilities (a130bd8c-eafe-11e6-9ac1-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	critical
90281	Debian DSA-3538-1 : libebml - security update	Nessus	Debian Local Security Checks	critical
88999	Debian DLA-438-1 : libebml security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-8791

medium

Tenable Plugins

critical

critical

medium