Security update for c-toxcore SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:1640-1 Final 1 1 2021-12-30T15:02:04Z current 2021-12-30T15:02:04Z 2021-12-30T15:02:04Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for c-toxcore c-toxcore was updated fo fix a securiy issue: - CVE-2021-44847: Fixed a buffer overflow in handle_request in DHT.c which could lead to remote DoS and potential code execution (boo#1193667) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-1640 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MUGBIA3IOPBRCHCVWXL5KMYQ6TB5Z5XI/ E-Mail link for openSUSE-SU-2021:1640-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1193667 SUSE Bug 1193667 https://www.suse.com/security/cve/CVE-2021-44847/ SUSE CVE CVE-2021-44847 page SUSE Package Hub 15 SP1 SUSE Package Hub 15 SP2 SUSE Package Hub 15 SP3 openSUSE Leap 15.2 openSUSE Leap 15.3 c-toxcore-0.2.13-bp153.2.3.1 c-toxcore-daemon-0.2.13-bp153.2.3.1 c-toxcore-devel-0.2.13-bp153.2.3.1 libtoxcore2-0.2.13-bp153.2.3.1 c-toxcore-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP1 c-toxcore-daemon-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP1 c-toxcore-devel-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP1 libtoxcore2-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP1 c-toxcore-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP2 c-toxcore-daemon-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP2 c-toxcore-devel-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP2 libtoxcore2-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP2 c-toxcore-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 c-toxcore-daemon-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 c-toxcore-devel-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 libtoxcore2-0.2.13-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 c-toxcore-0.2.13-bp153.2.3.1 as a component of openSUSE Leap 15.2 c-toxcore-daemon-0.2.13-bp153.2.3.1 as a component of openSUSE Leap 15.2 c-toxcore-devel-0.2.13-bp153.2.3.1 as a component of openSUSE Leap 15.2 libtoxcore2-0.2.13-bp153.2.3.1 as a component of openSUSE Leap 15.2 c-toxcore-0.2.13-bp153.2.3.1 as a component of openSUSE Leap 15.3 c-toxcore-daemon-0.2.13-bp153.2.3.1 as a component of openSUSE Leap 15.3 c-toxcore-devel-0.2.13-bp153.2.3.1 as a component of openSUSE Leap 15.3 libtoxcore2-0.2.13-bp153.2.3.1 as a component of openSUSE Leap 15.3 A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the handling of received network packets) allows remote attackers to crash the process or potentially execute arbitrary code via a network packet. CVE-2021-44847 SUSE Package Hub 15 SP1:c-toxcore-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP1:c-toxcore-daemon-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP1:c-toxcore-devel-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP1:libtoxcore2-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP2:c-toxcore-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP2:c-toxcore-daemon-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP2:c-toxcore-devel-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP2:libtoxcore2-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP3:c-toxcore-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP3:c-toxcore-daemon-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP3:c-toxcore-devel-0.2.13-bp153.2.3.1 SUSE Package Hub 15 SP3:libtoxcore2-0.2.13-bp153.2.3.1 openSUSE Leap 15.2:c-toxcore-0.2.13-bp153.2.3.1 openSUSE Leap 15.2:c-toxcore-daemon-0.2.13-bp153.2.3.1 openSUSE Leap 15.2:c-toxcore-devel-0.2.13-bp153.2.3.1 openSUSE Leap 15.2:libtoxcore2-0.2.13-bp153.2.3.1 openSUSE Leap 15.3:c-toxcore-0.2.13-bp153.2.3.1 openSUSE Leap 15.3:c-toxcore-daemon-0.2.13-bp153.2.3.1 openSUSE Leap 15.3:c-toxcore-devel-0.2.13-bp153.2.3.1 openSUSE Leap 15.3:libtoxcore2-0.2.13-bp153.2.3.1 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MUGBIA3IOPBRCHCVWXL5KMYQ6TB5Z5XI/ https://www.suse.com/security/cve/CVE-2021-44847.html CVE-2021-44847 https://bugzilla.suse.com/1193667 SUSE Bug 1193667