214576 2008-03-24 19:06 0000 dev-php5/pecl-apc <=3.0.16 Usage of strcpy in apc.c can cause stack corruption with long filenames (CVE-2008-1488) 2008-04-09 09:50:28 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://pecl.php.net/bugs/bug.php?id=13415 C1 [glsa] P2 normal --- 1 hanno@gentoo.org security@gentoo.org gentoobugs@ncode.nl php-bugs@gentoo.org hanno@gentoo.org 2008-03-24 19:06:15 0000 See upstream bug report. No upstream fix yet. rbu@gentoo.org 2008-03-24 19:32:08 0000 cve requested via http://thread.gmane.org/gmane.comp.security.oss.general/150 jakub@gentoo.org 2008-03-25 23:00:25 0000 3.0.17 InCVS... hanno@gentoo.org 2008-03-26 00:22:01 0000 archs, please stabilize hanno@gentoo.org 2008-03-26 02:11:52 0000 3.0.17 causes unreliably error 500 messages on my server, so probably needs further investigation. rbu@gentoo.org 2008-03-26 23:14:31 0000 back to [ebuild] then. jan.rieger@medialize.de 2008-03-28 13:18:36 0000 3.0.17 causes segmentation faults, see http://pecl.php.net/bugs/bug.php?id=13511 There is a 3.0.16 ebuild available at http://christian-seiler.de/temp/pecl-apc-3.0.16-CVE-overlay.tar.gz including a patch for CVE-2008-1488 that doesn't cause segmentation faults for me on amd64. rbu@gentoo.org 2008-03-28 14:07:54 0000 (In reply to comment #6) > 3.0.17 causes segmentation faults, see > http://pecl.php.net/bugs/bug.php?id=13511 > > There is a 3.0.16 ebuild available at > http://christian-seiler.de/temp/pecl-apc-3.0.16-CVE-overlay.tar.gz including a > patch for CVE-2008-1488 that doesn't cause segmentation faults for me on amd64. Jan, can you please simply attach the patch (and any non-trivial changes to the ebuild) on this bug? Thanks. jan.rieger@medialize.de 2008-03-28 14:20:14 0000 Created an attachment (id=147546) pecl-apc-3.0.16-CVE-2008-1488.patch (In reply to comment #7) > Jan, can you please simply attach the patch (and any non-trivial changes to the > ebuild) on this bug? Thanks. Added pecl-apc-3.0.16-CVE-2008-1488.patch The only addidtion to the ebuild is: epatch "${FILESDIR}"/${P}-CVE-2008-1488.patch jakub@gentoo.org 2008-03-28 19:23:55 0000 (In reply to comment #8) > Created an attachment (id=147546) [edit] > pecl-apc-3.0.16-CVE-2008-1488.patch 3.0.16-r1 committed with this patch; lets give it another try... maekke@gentoo.org 2008-03-28 21:43:26 0000 amd64/x86 stable hanno@gentoo.org 2008-03-29 13:53:35 0000 Upstream has released 3.0.18 which should fix the .17-problems. armin76@gentoo.org 2008-03-30 10:47:41 0000 sparc stable dertobi123@gentoo.org 2008-03-31 18:50:54 0000 ppc stable rbu@gentoo.org 2008-04-03 14:46:27 0000 request filed. rbu@gentoo.org 2008-04-09 09:50:28 0000 GLSA 200804-07, thanks. 147546 2008-03-28 14:20 0000 pecl-apc-3.0.16-CVE-2008-1488.patch pecl-apc-3.0.16-CVE-2008-1488.patch text/plain LS0tIGFwYy5jLm9sZAkyMDA4LTAzLTI2IDE5OjIyOjAyLjAwMDAwMDAwMCArMDEwMAorKysgYXBj LmMJMjAwOC0wMy0yNiAxOToyMjoyMy4wMDAwMDAwMDAgKzAxMDAKQEAgLTMzMSw3ICszMzEsNyBA QAogICAgICAgICAgICAgLyogbm90OiBbbm8gYWN0aXZlIGZpbGVdIG9yIG5vIHBhdGggKi8KICAg ICAgICAgICAgIG1lbWNweShmaWxlaW5mby0+ZnVsbHBhdGgsIGV4ZWNfZm5hbWUsIGV4ZWNfZm5h bWVfbGVuZ3RoKTsKICAgICAgICAgICAgIGZpbGVpbmZvLT5mdWxscGF0aFtleGVjX2ZuYW1lX2xl bmd0aF0gPSBERUZBVUxUX1NMQVNIOwotICAgICAgICAgICAgc3RyY3B5KGZpbGVpbmZvLT5mdWxs cGF0aCArZXhlY19mbmFtZV9sZW5ndGggKzEsIGZpbGVuYW1lKTsKKyAgICAgICAgICAgIHN0cmxj cHkoZmlsZWluZm8tPmZ1bGxwYXRoICtleGVjX2ZuYW1lX2xlbmd0aCArMSwgZmlsZW5hbWUsc2l6 ZW9mKGZpbGVpbmZvLT5mdWxscGF0aCktZXhlY19mbmFtZV9sZW5ndGgtMSk7CiAgICAgICAgICAg ICAvKiBhcGNfd3ByaW50KCJmaWxlbmFtZTogJXMsIGV4ZWNfZm5hbWU6ICVzLCBmaWxlaW5mby0+ ZnVsbHBhdGg6ICVzIiwgZmlsZW5hbWUsIGV4ZWNfZm5hbWUsIGZpbGVpbmZvLT5mdWxscGF0aCk7 ICovCiAgICAgICAgICAgICBpZiAoYXBjX3N0YXQoZmlsZWluZm8tPmZ1bGxwYXRoLCAmZmlsZWlu Zm8tPnN0X2J1ZikgPT0gMCkgewogICAgICAgICAgICAgICAgIGZvdW5kID0gMTsK