Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug
Bug#: 217602
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Matthias Geerdsen <vorlon@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 217602 depends on: 217715 Show dependency tree
Bug 217602 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2008-04-14 09:09 0000 
This issues appears to be only semi-public at the moment, so let's keep this
restricted, as has been asked for, until it is fully public

sdl-sound appears to include vulnerable speex code

see http://www.ocert.org/advisories/ocert-2008-2.html
as well as bug 216499 and bug 217373 for similar issues

patch can be found at
http://svn.icculus.org/SDL_sound/trunk/decoders/speex.c?r1=536&r2=537&pathrev=537

------- Comment #1 From Matthias Geerdsen 2008-04-14 10:05:00 0000 ------- 
vapier, as member of games, could you prepare an ebuild?

this should be handled as a semi-public bug until the issue is fully public by
means of a new release or an announcement

------- Comment #2 From Robert Buchholz 2008-04-14 16:56:08 0000 ------- 
adding vapier as cc

------- Comment #3 From Robert Buchholz 2008-04-14 22:25:18 0000 ------- 
This does not need to be fixed if we enable the workaround in libspeex, which
is bug 217715.

------- Comment #4 From SpanKY 2008-04-15 01:15:50 0000 ------- 
just going with the speex fix sounds fine to me

------- Comment #5 From Matthias Geerdsen 2008-04-17 09:42:28 0000 ------- 
now public via http://www.ocert.org/advisories/ocert-2008-004.html

------- Comment #6 From Matthias Geerdsen 2008-04-17 10:15:26 0000 ------- 
This will be fixed with the speex update in bug 217715, keeping open until the
GLSA has been released.

------- Comment #7 From Robert Buchholz 2008-04-17 12:16:55 0000 ------- 
speex has been sent as GLSA 200804-17, this also fixes this bug.
Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug