CVE-2016-10195

The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.

The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.

The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.

• CVE-2016-10195: fix an out-of-bounds stack read in the name_parse function
• CVE-2016-10196: fix a stack-based buffer overflow in the evutil_parse_sockaddr_port function
• CVE-2016-10197: fix DoS via an empty hostname in the search_make_new function

• CVE-2016-10195: fix an out-of-bounds stack read in the name_parse function
• CVE-2016-10196: fix a stack-based buffer overflow in the evutil_parse_sockaddr_port function
• CVE-2016-10197: fix DoS via an empty hostname in the search_make_new function

• The DNS code of Libevent contains an OOB read which can trigger a crash (CVE-2016-10197)
• The libevent evutil_parse_sockaddr_port() contains a buffer overflow which can cause a segmentation fault (CVE-2016-10196)
• The name_parse() function in libevent's DNS code is vulnerable to a buffer overread (CVE-2016-10195)

This update for libevent fixes the following security issues:

• CVE-2016-10195: DNS remote stack overread vulnerability (bsc#1022917)
• CVE-2016-10196: stack/buffer overflow in evutil_parse_sockaddr_port() (bsc#1022918)
• CVE-2016-10197: out-of-bounds read in search_make_new() (bsc#1022919)

This update for libevent fixes the following issues:

• CVE-2016-10195: DNS remote stack overread vulnerability (bsc#1022917)
• CVE-2016-10196: stack/buffer overflow in evutil_parse_sockaddr_port() (bsc#1022918) (backport for 2.0.21)
• CVE-2016-10197: out-of-bounds read in search_make_new() (bsc#1022919)

Guido Vranken discovered that libevent incorrectly handled memory when processing certain data. A remote attacker could possibly use this issue with an application that uses libevent to cause a denial of service, or possibly execute arbitrary code.

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to read uninitialized memory, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5429, CVE-2017-5430, CVE-2017-5436, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5461, CVE-2017-5467)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to spoof the addressbar contents, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5449, CVE-2017-5451, CVE-2017-5454, CVE-2017-5459, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5469, CVE-2016-10195, CVE-2016-10196, CVE-2016-10197)

A flaw was discovered in the DRBG number generation in NSS. If an attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be exploited to view sensitive information. (CVE-2017-5462)