| Package | Affected versions | Patched versions |
|---|---|---|
| memcached | = 1.4.10= 1.4.11= 1.4.12= 1.4.13= 1.4.14= 1.4.15= 1.4.16= 1.4.4= 1.4.5= 1.4.6= 1.4.7= 1.4.8= 1.4.9 |
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free