CVE-2017-1000376

Priority
Description
libffi requests an executable stack allowing attackers to more easily
trigger arbitrary code execution by overwriting the stack. Please note that
libffi is used by a number of other libraries. It was previously stated
that this affects libffi version 3.2.1 but this appears to be incorrect.
libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and
upstream is believed to have fixed this issue in version 3.1.
Assigned-to
mdeslaur
Notes
Package
Upstream:released (3.2.1-4)
Ubuntu 12.04 ESM (Precise Pangolin):released (3.0.11~rc1-5ubuntu0.1)
Ubuntu 14.04 ESM (Trusty Tahr):released (3.1~rc1+r3.0.13-12ubuntu0.2)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected
Ubuntu 18.04 LTS (Bionic Beaver):not-affected (3.2.1-6)
Patches:
Upstream:https://github.com/libffi/libffi/commit/978c9540154d320525488db1b7049277122f736d
More Information

Updated: 2020-09-10 05:35:03 UTC (commit 81a23a978c4436cd99e1d040e9e73e9146876281)