CVE-2017-1000376

Priority
Medium
Description
libffi requests an executable stack allowing attackers to more easily
trigger arbitrary code execution by overwriting the stack. Please note that
libffi is used by a number of other libraries. It was previously stated
that this affects libffi version 3.2.1 but this appears to be incorrect.
libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and
upstream is believed to have fixed this issue in version 3.1.
References
Assigned-to
mdeslaur
Package
Upstream:released (3.2.1-4)
Ubuntu 17.10 (Artful Aardvark):not-affected (3.2.1-6)
Ubuntu 12.04 ESM (Precise Pangolin):needed
Ubuntu 14.04 LTS (Trusty Tahr):released (3.1~rc1+r3.0.13-12ubuntu0.2)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected
Ubuntu 17.04 (Zesty Zapus):not-affected
Patches:
Upstream:https://github.com/libffi/libffi/commit/978c9540154d320525488db1b7049277122f736d
More Information

Updated: 2017-10-17 19:14:29 UTC (commit 13537)