{"id":"CVE-2014-9862","aliases":["DEBIAN-CVE-2014-9862","DLA-2010-1","DLA-697-1","EUVD-2014-9667","GHSA-gv4w-9q78-3649","MGASA-2016-0288","MGASA-2022-0334","SUSE-SU-2022:3094-1","SUSE-SU-2022:3455-1","SUSE-SU-2022:3456-1","SUSE-SU-2022:3671-1","UBUNTU-CVE-2014-9862","USN-4500-1","openSUSE-SU-2024:10045-1","openSUSE-SU-2024:12242-1"],"status":"published","title":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6...","description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06762,"percentile":0.94018,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2016-07-22T01:00:00Z","modified":"2026-10-23T16:02:23Z","fixes":[{"ecosystem":"Debian:12","package":"bsdiff","fixed_in":["4.3-17"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bsdiff","fixed_in":["4.3-17"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bsdiff","fixed_in":["4.3-17"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"bsdiff","fixed_in":["4.3-15+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"bsdiff","fixed_in":["4.3-14+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"bsdiff","fixed_in":["4.3-9.1.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"ostree","fixed_in":["2020.8-2.1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libostree","fixed_in":["2021.6-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"libostree","fixed_in":["2021.6-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libostree","fixed_in":["2021.6-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libostree","fixed_in":["2018.9-150100.7.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libostree","fixed_in":["2018.9-150100.7.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"libostree","fixed_in":["2018.9-150100.7.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"libostree","fixed_in":["2018.9-150100.7.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"libostree","fixed_in":["2018.9-150100.7.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"libostree","fixed_in":["2018.9-150100.7.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libostree","fixed_in":["2020.8-150200.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libostree","fixed_in":["2018.1-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libostree","fixed_in":["2018.1-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libostree","fixed_in":["2018.1-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libostree","fixed_in":["2018.1-150000.4.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"bsdiff","fixed_in":["4.3-15+deb8u1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bsdiff","fixed_in":["4.3-5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-17"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-17"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-17"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-15+deb8u1"}]}],"versions":["4.3-15"]},{"source":"osv","ecosystem":"Debian:7","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14+deb7u1"}]}],"versions":["4.3-14"]},{"source":"osv","ecosystem":"Mageia:5","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-9.1.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"ostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-2.1.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.6-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.6-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.6-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.9-150100.7.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.9-150100.7.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.9-150100.7.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.9-150100.7.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.9-150100.7.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.9-150100.7.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.8-150200.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.1-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.1-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.1-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2018.1-150000.4.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-15+deb8u1build0.16.04.1"}]}],"versions":["4.3-15"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-15+deb8u1build0.16.04.1"}]}],"versions":["4.3-15"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bsdiff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-5.3"}]}]}],"products":[{"vendor":"apple","product":"mac_os_x"}],"references":[{"url":"http://www.securityfocus.com/bid/91824","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-16:25.bspatch.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","advisory"]},{"url":"https://android.googlesource.com/platform/external/bsdiff/+/4d054795b673855e3a7556c6f2f7ab99ca509998","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://chromium.googlesource.com/chromiumos/third_party/bsdiff/+/d0307d1711bd74e51b783a49f9160775aa22e659","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory","advisory","article","report"]},{"url":"http://www.securitytracker.com/id/1036438","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://bugs.chromium.org/p/chromium/issues/detail?id=372525","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://support.apple.com/HT206903","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/11/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202003-44","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2020/07/09/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2020/Jul/8","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4500-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9862"},{"url":"https://usn.ubuntu.com/4500-1"},{"url":"https://github.com/advisories/GHSA-gv4w-9q78-3649"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9862","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0288.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19160","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2016-08/msg00026.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0334.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30819","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-September/012105.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6PYJHVWMVWO63ECJ37DXSJEJXCZBKW5W/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223094-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9862","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223455-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223456-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223671-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-9862","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4500-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9862","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-9862","description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","status":"published","published":"2016-07-22T01:00:00Z","modified":"2024-08-06T13:55:04.641Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9667","description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","status":"published","published":"2016-07-22T01:00:00Z","modified":"2024-08-06T13:55:04Z","updated_at":"2026-11-03T01:56:47.514809Z"}],"ghsa":[{"id":"GHSA-gv4w-9q78-3649","title":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6...","description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","status":"published","published":"2022-05-13T01:16:13Z","modified":"2025-04-12T13:02:43Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:01:28.663035Z"}],"nvd":[{"id":"CVE-2014-9862","description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","status":"published","published":"2016-07-22T02:59:00.127Z","modified":"2026-06-17T00:19:07.07Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"CVE-2014-9862","description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","status":"published","published":"2016-07-22T02:59:00Z","modified":"2026-04-16T06:19:58.608753806Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9862","description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","status":"published","published":"2016-07-22T02:59:00.127Z","modified":"2026-10-23T16:02:23.075251001Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9862","description":"Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file.","status":"published","published":"2016-07-22T02:59:00Z","modified":"2026-02-04T04:10:34.219903Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"DLA-2010-1","title":"bsdiff - security update","status":"published","published":"2019-11-26T00:00:00Z","modified":"2026-03-09T01:21:12.962056Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-697-1","title":"bsdiff - security update","status":"published","published":"2016-11-03T00:00:00Z","modified":"2026-03-09T02:10:37.320275Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0288","title":"Updated bsdiff packages fix security vulnerability","description":"Integer signedness error in bspatch.c in bspatch in bsdiff allows remote\nattackers to execute arbitrary code or cause a denial of service\n(heap-based buffer overflow) via a crafted patch file (CVE-2014-9862).\n","status":"published","published":"2016-08-31T15:32:33Z","modified":"2026-04-16T06:23:58.483692533Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2022-0334","title":"Updated ostree packages fix security vulnerability","description":"A memory corruption issue that could be triggered when diffing binary\nfiles. (CVE-2014-9862)\n","status":"published","published":"2022-09-16T19:39:55Z","modified":"2026-04-16T04:40:49.324590579Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:10045-1","title":"bsdiff-4.3-5.3 on GA media","description":"These are all security issues fixed in the bsdiff-4.3-5.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:05.095032Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:12242-1","title":"libostree-1-1-2022.5-1.1 on GA media","description":"These are all security issues fixed in the libostree-1-1-2022.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:05.155782Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3094-1","title":"Security update for libostree","description":"This update for libostree fixes the following issues:\n\n- CVE-2014-9862: Fixed a memory corruption issue that could be\n  triggered when diffing binary files (bsc#1201770).\n","status":"published","published":"2022-09-06T05:53:09Z","modified":"2026-02-04T02:17:15.889906Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3455-1","title":"Security update for libostree","description":"This update for libostree fixes the following issues:\n\n- CVE-2014-9862: Fixed arbitrary write on heap vulnerability (bsc#1201770).\n","status":"published","published":"2022-09-28T14:57:25Z","modified":"2026-02-04T03:21:40.041112Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3456-1","title":"Security update for libostree","description":"This update for libostree fixes the following issues:\n\n- CVE-2014-9862: Fixed arbitrary write on heap vulnerability (bsc#1201770).\n","status":"published","published":"2022-09-28T14:58:25Z","modified":"2026-02-04T03:59:29.4274Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3671-1","title":"Security update for libostree","description":"This update for libostree fixes the following issues:\n\n- CVE-2014-9862: Fixed arbitrary write on heap vulnerability (bsc#1201770).\n\n","status":"published","published":"2022-10-20T08:52:30Z","modified":"2026-02-04T03:09:01.530507Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-4500-1","title":"bsdiff vulnerabilities","description":"It was discovered that bsdiff mishandled certain input. If a user were tricked\ninto opening a malicious file, an attacker could cause bsdiff to crash or \npotentially execute arbitrary code.\n","status":"published","published":"2020-09-15T20:33:49Z","modified":"2026-02-10T04:41:55Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}