ASA-201705-6 log generated external raw

[ASA-201705-6] lib32-libtirpc: denial of service
Arch Linux Security Advisory ASA-201705-6 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : lib32-libtirpc Type : denial of service Remote : Yes Link : Summary ======= The package lib32-libtirpc before version 1.0.1-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.1-2. # pacman -Syu "lib32-libtirpc>=1.0.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ==========