CVE-2014-9862

Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
applemac_os_x
𝑥
≤ 10.11.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
bsdiff
bookworm
4.3-23
fixed
bullseye
4.3-22
fixed
sid
4.3-23
fixed
trixie
4.3-23
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
bsdiff
artful
ignored
bionic
not-affected
cosmic
not-affected
disco
not-affected
eoan
not-affected
focal
not-affected
precise
ignored
trusty
dne
wily
ignored
xenial
Fixed 4.3-15+deb8u1build0.16.04.1
released
yakkety
ignored
zesty
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libostree
suse enterprise desktop 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise desktop 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise desktop 15 SP5
2022.7-150500.1.3
fixed
suse enterprise desktop 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise desktop 15 SP7
2024.10-150500.3.9.4
fixed
suse enterprise sap 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise sap 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise sap 15 SP5
2022.7-150500.1.3
fixed
suse enterprise sap 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise sap 15 SP7
2024.10-150500.3.9.4
fixed
suse enterprise server 15
2018.1-150000.4.3.1
fixed
suse enterprise server 15 SP1
2018.9-150100.7.4.1
fixed
suse enterprise server 15 SP2
2020.8-150200.3.6.1
fixed
suse enterprise server 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise server 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise server 15 SP5
2022.7-150500.1.3
fixed
suse enterprise server 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise server 15 SP7
2024.10-150500.3.9.4
fixed
libostree-1-1
suse enterprise server 15
2018.1-150000.4.3.1
fixed
suse enterprise server 15 SP1
2018.9-150100.7.4.1
fixed
suse enterprise server 15 SP2
2020.8-150200.3.6.1
fixed
suse enterprise server 15 SP4
2021.6-150400.3.3.1
fixed
libostree-devel
suse enterprise desktop 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise desktop 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise desktop 15 SP5
2022.7-150500.1.3
fixed
suse enterprise desktop 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise desktop 15 SP7
2024.10-150500.3.9.4
fixed
suse enterprise sap 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise sap 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise sap 15 SP5
2022.7-150500.1.3
fixed
suse enterprise sap 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise sap 15 SP7
2024.10-150500.3.9.4
fixed
suse enterprise server 15
2018.1-150000.4.3.1
fixed
suse enterprise server 15 SP1
2018.9-150100.7.4.1
fixed
suse enterprise server 15 SP2
2020.8-150200.3.6.1
fixed
suse enterprise server 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise server 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise server 15 SP5
2022.7-150500.1.3
fixed
suse enterprise server 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise server 15 SP7
2024.10-150500.3.9.4
fixed
typelib-1_0-OSTree-1_0
suse enterprise desktop 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise desktop 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise desktop 15 SP5
2022.7-150500.1.3
fixed
suse enterprise desktop 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise desktop 15 SP7
2024.10-150500.3.9.4
fixed
suse enterprise sap 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise sap 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise sap 15 SP5
2022.7-150500.1.3
fixed
suse enterprise sap 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise sap 15 SP7
2024.10-150500.3.9.4
fixed
suse enterprise server 15
2018.1-150000.4.3.1
fixed
suse enterprise server 15 SP1
2018.9-150100.7.4.1
fixed
suse enterprise server 15 SP2
2020.8-150200.3.6.1
fixed
suse enterprise server 15 SP3
2020.8-150200.3.6.1
fixed
suse enterprise server 15 SP4
2021.6-150400.3.3.1
fixed
suse enterprise server 15 SP5
2022.7-150500.1.3
fixed
suse enterprise server 15 SP6
2023.7-150500.3.6.1
fixed
suse enterprise server 15 SP7
2024.10-150500.3.9.4
fixed
Common Weakness Enumeration
References
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00026.html
http://seclists.org/fulldisclosure/2020/Jul/8
http://www.openwall.com/lists/oss-security/2020/07/09/2
http://www.securityfocus.com/bid/91824
http://www.securitytracker.com/id/1036438
https://android.googlesource.com/platform/external/bsdiff/+/4d054795b673855e3a7556c6f2f7ab99ca509998
https://bugs.chromium.org/p/chromium/issues/detail?id=372525
https://chromium.googlesource.com/chromiumos/third_party/bsdiff/+/d0307d1711bd74e51b783a49f9160775aa22e659
https://lists.debian.org/debian-lts-announce/2019/11/msg00028.html
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:25.bspatch.asc
https://security.gentoo.org/glsa/202003-44
https://support.apple.com/HT206903
https://usn.ubuntu.com/4500-1/
http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html
http://lists.opensuse.org/opensuse-updates/2016-08/msg00026.html
http://seclists.org/fulldisclosure/2020/Jul/8
http://www.openwall.com/lists/oss-security/2020/07/09/2
http://www.securityfocus.com/bid/91824
http://www.securitytracker.com/id/1036438
https://android.googlesource.com/platform/external/bsdiff/+/4d054795b673855e3a7556c6f2f7ab99ca509998
https://bugs.chromium.org/p/chromium/issues/detail?id=372525
https://chromium.googlesource.com/chromiumos/third_party/bsdiff/+/d0307d1711bd74e51b783a49f9160775aa22e659
https://lists.debian.org/debian-lts-announce/2019/11/msg00028.html
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:25.bspatch.asc
https://security.gentoo.org/glsa/202003-44
https://support.apple.com/HT206903
https://usn.ubuntu.com/4500-1/