CVE-2015-8080

Name
CVE-2015-8080
Description
Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Third Party Advisory http://www.debian.org/security/2015/dsa-3412
Mailing List http://www.openwall.com/lists/oss-security/2015/11/06/2
Third Party Advisory https://raw.githubusercontent.com/antirez/redis/2.8/00-RELEASENOTES
Third Party Advisory https://raw.githubusercontent.com/antirez/redis/3.0/00-RELEASENOTES
Exploit https://github.com/antirez/redis/issues/2855
Mailing List http://www.openwall.com/lists/oss-security/2015/11/06/4
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-0097.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-0095.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-0096.html
Third Party Advisory http://www.securityfocus.com/bid/77507
Third Party Advisory http://lists.opensuse.org/opensuse-updates/2016-05/msg00126.html
Third Party Advisory https://security.gentoo.org/glsa/201702-16

Match rules

CPE URI Source package Min version Max version
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* debian_linux == None == 9.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* debian_linux == None == 8.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status