Security
Security
A buffer overread vulnerability has been found in libuv.
| Package | dev-libs/libuv on all architectures |
|---|---|
| Affected versions | < 1.41.1 |
| Unaffected versions | >= 1.41.1 |
libuv is a multi-platform support library with a focus on asynchronous I/O.
libuv fails to ensure that a pointer lies within the bounds of a defined buffer in the uv__idna_toascii() function before reading and manipulating the memory at that address.
The overread can result in information disclosure or application crash.
There is no known workaround at this time.
All libuv users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libuv-1.41.1"
Release date
January 16, 2024
Latest revision
January 16, 2024: 1
Severity
low
Exploitable
remote
Bugzilla entries