File _patchinfo of Package patchinfo.3723

<patchinfo incident="3723">
  <packager>pgajdos</packager>
  <issue tracker="bnc" id="878345">VUL-0: CVE-2014-2977: DirectFB: Possible RCE through integer signedness vulnerability</issue>
  <issue tracker="bnc" id="878349">VUL-0: CVE-2014-2978: DirectFB: remote out-of-bounds write vulnerability</issue>
  <issue tracker="cve" id="CVE-2014-2978"></issue>
  <issue tracker="cve" id="CVE-2014-2977"></issue>
  <category>security</category>
  <rating>important</rating>
  <summary>Security update for DirectFB</summary>
  <description>DirectFB was updated to fix two security issues.

The following vulnerabilities were fixed:

* CVE-2014-2977: Multiple integer signedness errors could allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers a stack-based buffer overflow.
* CVE-2014-2978: Remote attackers could cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write.
</description>
</patchinfo>