Description
Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.ubuntu.com/usn/USN-2377-1 ↗
- http://rhn.redhat.com/errata/RHSA-2014-1318.html ↗
- http://www.securityfocus.com/bid/69779 ↗
- https://code.google.com/p/google-security-research/issues/detail?id=100 ↗
- https://github.com/torvalds/linux/commit/c54def7bd64d7c0b6993336abcffb8444795bf38 ↗
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c54def7bd64d7c0b6993336abcffb8444795bf38 ↗
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html ↗
- http://www.openwall.com/lists/oss-security/2014/09/11/21 ↗
- http://www.ubuntu.com/usn/USN-2378-1 ↗
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1141173 ↗
- http://www.ubuntu.com/usn/USN-2379-1 ↗
- http://www.ubuntu.com/usn/USN-2376-1 ↗