An out-of-bounds error in hivex may result in execution of arbitrary code or Denial of Service.
|Package||app-misc/hivex on all architectures|
|Affected versions||< 1.3.11|
|Unaffected versions||>= 1.3.11|
hivex is a library for reading and writing Windows Registry ‘hive’ binary files.
Manipulating a short or truncated hive file may trigger an out-of-bounds read or write in hivex.
A context-dependent attacker could cause an application linked against hivex to pass a short or truncated hive file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All hivex users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-misc/hivex-1.3.11"
March 14, 2015
March 14, 2015: 1