CVE-2014-2978

Name of the Vulnerable Software and Affected Versions DirectFB version 1.4.4

Description The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the Voodoo interface, which triggers an out-of-bounds write in the Dispatch Write function in proxy/dispatcher/idirectfbsurface dispatcher.c.

Recommendations For DirectFB version 1.4.4, consider disabling the Voodoo interface as a temporary workaround until a patch is available. Restrict access to the Dispatch Write function in proxy/dispatcher/idirectfbsurface dispatcher.c to minimize the risk of exploitation.