Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug
Bug#: 195700
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Tobias Heinlein <keytoaster@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 195700 depends on: 190900 191277 191278 191283 191286 191292 Show dependency tree
Bug 195700 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2007-10-13 13:42 0000 
Some vulnerabilities have been reported in FLAC, which can be exploited by
malicious people to compromise a user's system.

The vulnerabilities are caused due to integer overflow errors in various
components when processing FLAC media files and can be exploited to cause
heap-based buffer overflows via specially-crafted FLAC media files.

Successful exploitation allows execution of arbitrary code.

The vulnerabilities are reported in version 1.2.0. Prior versions and other
applications using the vulnerable library may also be affected.

Solution:
Update to version 1.2.1.

------- Comment #1 From Tobias Heinlein 2007-10-13 13:53:35 0000 ------- 
Sound, please check whether our latest stable version is also affected.

------- Comment #2 From Robert Buchholz 2007-10-17 01:29:26 0000 ------- 
sound, assuming our current stable is also vulnerable, how do we proceed?
Is 1.2.1* ok to go stable or should we try to fix to 1.1.X ?

------- Comment #3 From Samuli Suominen 2007-10-21 06:08:14 0000 ------- 
We are stabilizing 1.2.1 but because it has a TEXT RELOCATION patch from PaX
Team to go with I _strongly_ advice _every_ arch team to test both encoding and
decoding properly. This version is API/ABI compatible with 1.1.4 which was
going stable anyway so you _need_ to do bugs depending on this bug first, and
yes, that means also _entire_ gstreamer with plugins.

------- Comment #4 From Samuli Suominen 2007-10-21 06:09:06 0000 ------- 
*** Bug 191280 has been marked as a duplicate of this bug. ***

------- Comment #5 From Samuli Suominen 2007-10-21 06:16:04 0000 ------- 
Should have mention, it's media-libs/flac-1.2.1-r1

------- Comment #6 From Markus Meier 2007-10-21 16:10:52 0000 ------- 
x86 stable

------- Comment #7 From Steve Dibb 2007-10-21 19:43:00 0000 ------- 
amd64 stable

------- Comment #8 From Jeroen Roovers 2007-10-22 05:39:21 0000 ------- 
Why was RESTRICT=test added?

------- Comment #9 From Jeroen Roovers 2007-10-22 13:59:07 0000 ------- 
Stable for HPPA and SPARC.

------- Comment #10 From Steve Dibb 2007-10-22 14:23:45 0000 ------- 
(In reply to comment #8)
> Why was RESTRICT=test added?
> 

Temporary measure, drac is gonna find the problems and report upstream.

------- Comment #11 From Samuli Suominen 2007-10-22 17:44:10 0000 ------- 
Sparc is not stable because reverse dependencies (which this bug depends on)
aren't resolved yet.

20:27 <+CIA-29> jer * gentoo-x86/media-libs/flac/ (ChangeLog
flac-1.2.1-r1.ebuild): 
20:27 <+CIA-29> Reverting sparc stabilisation due to reverse dependencies I
cannot test.

------- Comment #12 From Raúl Porcel 2007-10-22 20:25:10 0000 ------- 
alpha/ia64 stable, thanks Tobias

------- Comment #13 From Markus Rothe 2007-10-23 16:11:36 0000 ------- 
ppc64 stable

------- Comment #14 From Tobias Scherbaum 2007-10-24 17:36:41 0000 ------- 
ppc stable

------- Comment #15 From Raúl Porcel 2007-11-01 19:07:04 0000 ------- 
sparc stable, this is ready for glsa

------- Comment #16 From Robert Buchholz 2007-11-01 19:12:29 0000 ------- 
request filed.

------- Comment #17 From Pierre-Yves Rofes 2007-11-12 21:48:13 0000 ------- 
GLSA 200711-15
Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug