Multiple vulnerabilities have been reported in Performance Co-Pilot, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

1) Some integer overflow errors within the libpcp protocol decoding functions can be exploited to cause buffer overflows.

2) Some errors within the libpcp protocol decoding functions can be exploited to cause heap-based buffer overflows.

3) Two memory leak errors within libpcp can be exploited to cause a crash.

4) An error within the "pduread()" function (libpcp/src/pdu.c) when handling certain events can be exploited to cause a crash.

The vulnerabilities are reported in versions prior to 3.6.5.

Solution
Update to version 3.6.5.

Provided and/or discovered by
Florian Weimer, Red Hat

Original Advisory
http://oss.sgi.com/projects/pcp/news.html
https://bugzilla.redhat.com/show_bug.cgi?id=841698
https://bugzilla.redhat.com/show_bug.cgi?id=841702
https://bugzilla.redhat.com/show_bug.cgi?id=841704
https://bugzilla.redhat.com/show_bug.cgi?id=841706

Deep Links
Links available to Secunia VIM customers