Tidy 'tmbstr.c' Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	75037
Class:	Boundary Condition Error
CVE:	CVE-2015-5522 CVE-2015-5523
Remote:	Yes
Local:	No
Published:	Jun 04 2015 12:00AM
Updated:	Nov 03 2015 07:53PM
Credit:	Fernando Mu&ntilde and Geoff McLane
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Apple Mac Os X 10.7.4 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.1 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:

Tidy 'tmbstr.c' Heap Based Buffer Overflow Vulnerability

Tidy is prone to a heap-based buffer-overflow vulnerability.

Successful exploits may allow attackers to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Tidy 0.99 is vulnerable; other versions may also be affected.

Tidy 'tmbstr.c' Heap Based Buffer Overflow Vulnerability

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/75037.txt

Tidy 'tmbstr.c' Heap Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Tidy 'tmbstr.c' Heap Based Buffer Overflow Vulnerability

References: