This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsaid="201611-17">
<title>RPCBind: Denial of Service</title>
<synopsis>A buffer overflow in RPCBind might allow remote attackers to cause
a Denial of Service.
</synopsis>
<producttype="ebuild">rpcbind</product>
<announced>2016-11-22</announced>
<revisedcount="2">2016-11-22</revised>
<bug>560990</bug>
<access>remote</access>
<affected>
<packagename="net-nds/rpcbind"auto="yes"arch="*">
<unaffectedrange="ge">0.2.3-r1</unaffected>
<vulnerablerange="lt">0.2.3-r1</vulnerable>
</package>
</affected>
<background>
<p>The RPCBind utility is a server that converts RPC program numbers into
universal addresses.
</p>
</background>
<description>
<p>A use-after-free vulnerability was discovered in RPCBind’s
svc_dodestroy function when trying to free a corrupted xprt->xp_netid
pointer.
</p>
</description>
<impacttype="normal">
<p>A remote attacker could possibly cause a Denial of Service condition.</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All RPCBind users should upgrade to the latest version:</p>