[ GLSA 202004-15 ] libu2f-host

[GLSA]

Gentoo Linux Security Advisory

Title: libu2f-host: Multiple vulnerabilities (GLSA 202004-15)
Severity: high
Exploitable: local, remote
Date: 2020-04-30
Bug(s): #678580, #679724
ID: 202004-15

Synopsis

Multiple vulnerabilities have been found in libu2f-host, the worst
of which could result in the execution of code.


Background

Yubico Universal 2nd Factor (U2F) Host C Library.

Affected Packages

Package: app-crypt/libu2f-host
Vulnerable: < 1.1.10
Unaffected: >= 1.1.10
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in libu2f-host. Please
review the CVE identifiers referenced below for details.


Impact

A remote attacker could entice a user to plug-in a malicious USB device,
possibly resulting in execution of arbitrary code with the privileges of
the process or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All libu2f-host users should upgrade to the latest version: