Upstream information

CVE-2014-4909 at MITRE

Description

Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 6.8
Vector AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
SUSE Bugzilla entry: 887079 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE 13.1
  • transmission >= 2.82-2.4.1
  • transmission-common >= 2.82-2.4.1
  • transmission-daemon >= 2.82-2.4.1
  • transmission-daemon-debuginfo >= 2.82-2.4.1
  • transmission-debuginfo >= 2.82-2.4.1
  • transmission-debugsource >= 2.82-2.4.1
  • transmission-gtk >= 2.82-2.4.1
  • transmission-gtk-debuginfo >= 2.82-2.4.1
  • transmission-gtk-lang >= 2.82-2.4.1
  • transmission-qt >= 2.82-2.4.1
  • transmission-qt-debuginfo >= 2.82-2.4.1
  • transmission-qt-lang >= 2.82-2.4.1
Patchnames:
openSUSE-2014-484
openSUSE Leap 15.0
  • transmission-common >= 2.94-lp150.1.1
  • transmission-gtk >= 2.94-lp150.1.1
  • transmission-gtk-lang >= 2.94-lp150.1.1
Patchnames:
openSUSE Leap 15.0 GA transmission-common
openSUSE Leap 42.1
  • transmission-common >= 2.84-5.3
  • transmission-gtk >= 2.84-5.3
  • transmission-gtk-lang >= 2.84-5.3
Patchnames:
openSUSE Leap 42.1 GA transmission-common
openSUSE Leap 42.2
  • transmission-common >= 2.84-6.7
  • transmission-gtk >= 2.84-6.7
  • transmission-gtk-lang >= 2.84-6.7
Patchnames:
openSUSE Leap 42.2 GA transmission-common
openSUSE Leap 42.3
  • transmission-common >= 2.84-8.3
  • transmission-gtk >= 2.84-8.3
  • transmission-gtk-lang >= 2.84-8.3
Patchnames:
openSUSE Leap 42.3 GA transmission-common
openSUSE Tumbleweed
  • transmission >= 2.92-3.1
  • transmission-common >= 2.92-3.1
  • transmission-daemon >= 2.92-3.1
  • transmission-gtk >= 2.92-3.1
  • transmission-gtk-lang >= 2.92-3.1
  • transmission-qt >= 2.92-3.1
  • transmission-qt-lang >= 2.92-3.1
Patchnames:
openSUSE Tumbleweed GA transmission