There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP before 1.0.1 that will lead to remote denial of service.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library     in GNU PSPP before 1.0.1 that will lead to remote denial of service. (CVE-2017-12958)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for pspp fixes the following issues :

  - CVE-2017-12958: Illegal address access in function     output_hex() could lead to denial of service or     unexpected state (boo#1054585) 

  - CVE-2017-12959: Assertion in function dict_add_mrset()     could lead to denial of service (boo#1054588)

  - CVE-2017-12960: Assertion in function dict_rename_var()     could lead to denial of service (boo#1054587)

  - CVE-2017-12961: Assertion in function parse_attributes()     could lead to denial of service (boo#1054586)

CVE Details reports :

- There is an Integer overflow in the hash_int function of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10791).

- There is a NULL pointer Dereference in the function ll_insert() of the libpspp library in GNU PSPP 0.10.5-pre2 (CVE-2017-10792).

- There is an illegal address access in the function output_hex() in data/data-out.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12958).

- There is a reachable assertion abort in the function dict_add_mrset() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to a remote denial of service attack (CVE-2017-12959).

- There is a reachable assertion abort in the function dict_rename_var() in data/dictionary.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12960).

- There is an assertion abort in the function parse_attributes() in data/sys-file-reader.c of the libpspp library in GNU PSPP 0.11.0 that will lead to remote denial of service (CVE-2017-12961).

ID	Name	Product	Family	Severity
254102	Linux Distros Unpatched Vulnerability : CVE-2017-12958	Nessus	Misc.	high
102949	openSUSE Security Update : pspp (openSUSE-2017-996)	Nessus	SuSE Local Security Checks	high
102690	FreeBSD : pspp -- multiple vulnerabilities (6876b163-8708-11e7-8568-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-12958

high

Tenable Plugins

high

high

high