hivex: User-assisted execution of arbitrary code

hivex: User-assisted execution of arbitrary code An out-of-bounds error in hivex may result in execution of arbitrary code or Denial of Service. hivex 2015-03-14 2015-03-14 490990 local, remote 1.3.11 1.3.11

hivex is a library for reading and writing Windows Registry ‘hive’ binary files.

Manipulating a short or truncated hive file may trigger an out-of-bounds read or write in hivex.

A context-dependent attacker could cause an application linked against hivex to pass a short or truncated hive file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

There is no known workaround at this time.

All hivex users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=app-misc/hivex-1.3.11"

CVE-2014-9273 BlueKnight ackle