Bug 449310 – <dev-libs/fribidi-0.19.5-r1: theoretically possible overflow

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Samuli Suominen (RETIRED) 2012-12-30 15:06:08 UTC]

Restricted Fedora security bug:

https://bugzilla.redhat.com/show_bug.cgi?id=884000

Fedora is calling the patch "signedwarning.patch"

Upstream commit:

http://cgit.freedesktop.org/fribidi/fribidi/patch/?id=78dc3af68ed0e1aafe54c176b28dadee66eb306c

Unfortunately, I don't have more details due to the bug being restricted

This is fixed in Portage as =dev-libs/fribidi-0.19.5-r1

[Comment 1 Agostino Sarubbo 2012-12-30 15:11:21 UTC]

As per the subject of the patch:

Subject: Fix theoretically possible overflow

I'd say B2

[Comment 2 Agostino Sarubbo 2012-12-31 09:22:45 UTC]

sparc stable

[Comment 3 Jeroen Roovers (RETIRED) 2012-12-31 17:05:47 UTC]

Stable for HPPA.

[Comment 4 Paweł Hajdan, Jr. (RETIRED) 2012-12-31 20:09:11 UTC]

x86 stable

[Comment 5 Agostino Sarubbo 2012-12-31 21:53:02 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2012-12-31 23:32:39 UTC]

ppc stable

[Comment 7 Agostino Sarubbo 2013-01-01 08:27:07 UTC]

arm stable

[Comment 8 Raúl Porcel (RETIRED) 2013-01-01 19:25:32 UTC]

alpha/ia64/sh stable

[Comment 9 Agostino Sarubbo 2013-01-04 13:11:28 UTC]

ppc64 stable

[Comment 10 Samuli Suominen (RETIRED) 2013-01-04 13:32:21 UTC]

All arches done. Vulnerable versions removed from Portage.

[Comment 11 Chris Reffett (RETIRED) 2013-12-11 02:05:50 UTC]

Not much we can do here until this is unrestricted upstream and gets a CVE.

[Comment 12 Ian Whyman (thev00d00) (RETIRED) 2014-05-03 10:16:18 UTC]

Any update on this?

Guess this can be closed as its been ~5months.

[Comment 13 Mikle Kolyada (RETIRED) 2014-05-03 10:32:45 UTC]

(In reply to Ian Whyman (thev00d00) from comment #12)
> Any update on this?
> 
> Guess this can be closed as its been ~5months.

Not yet, we should write and then release GLSA. But there is no CVE for this bug, it seems.

[Comment 14 Aaron Bauman (RETIRED) 2016-03-04 12:43:25 UTC]

Another 2 years and still no CVE and Redhat's bug is still restricted. Vulnerability mitigated with previous commits.

[Comment 15 Aaron Bauman (RETIRED) 2016-03-18 08:10:18 UTC]

Per previous comment still no CVE and many years since reported.