[ GLSA 200903-13 ] MPFR: Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: MPFR: Denial of Service (GLSA 200903-13)
Severity: normal
Exploitable: remote
Date: March 09, 2009
Bug(s): #260968
ID: 200903-13

Synopsis


Multiple buffer overflows in MPFR might lead to a Denial of Service.


Background


MPFR is a library for multiple-precision floating-point computations
with exact rounding.


Affected Packages

Package: dev-libs/mpfr
Vulnerable: < 2.4.1
Unaffected: >= 2.4.1
Architectures: All supported architectures


Description


Multiple buffer overflows have been reported in the mpfr_snprintf() and
mpfr_vsnprintf() functions.


Impact


A remote user could exploit the vulnerability to cause a Denial of
Service in an application using MPFR via unknown vectors.


Workaround


There is no known workaround at this time.


Resolution


All MPRF users should upgrade to the latest version: