Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug
Bug#: 83253
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Don Seiler (RETIRED) <rizzo@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 83253 depends on: Show dependency tree
Bug 83253 blocks:

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2005-02-24 19:32 0000 
CAN-2005-0208

HTML parsing bug can cause remote crash of gaim < 1.1.4.

Asking ARCHes to mark net-im/gaim-1.1.4 stable.

------- Comment #1 From Thierry Carrez (RETIRED) 2005-02-25 00:36:12 0000 ------- 
was fixed in 1.1.3:

Remote DoS on receiving malformed HTML (CAN-2005-0473)
Remote crash. Receiving malformed HTML can result in an invalid memory access causing Gaim to crash.

AIM/ICQ remote denial of service (CAN-2005-0472)
Certain malformed SNAC packets sent by other AIM or ICQ users can trigger an infinite loop in Gaim when parsing the SNAC. The remote user would need a custom client, able to generate malformed SNAC

------- Comment #2 From Gustavo Zacarias (RETIRED) 2005-02-25 05:57:12 0000 ------- 
sparc-a-go-go.

------- Comment #3 From Thomas B. 2005-02-25 07:08:13 0000 ------- 
1.1.3 fixed CAN-2005-0473, but opened yet another, almost identical security
issue, CAN-2005-0208.
So 1.1.4 does contain security fixes (see
http://gaim.sourceforge.net/security/index.php ).

------- Comment #4 From Don Seiler (RETIRED) 2005-02-25 07:21:07 0000 ------- 
Yes.  So 1.1.4 contains all three fixes, as 1.1.3 had not yet made stable on
all ARCHes.

I've marked stable on x86, as that is my playground.

------- Comment #5 From Don Seiler (RETIRED) 2005-02-25 07:21:27 0000 ------- 
Removing cc on x86 team.

------- Comment #6 From Thierry Carrez (RETIRED) 2005-02-25 07:57:15 0000 ------- 
was fixed in 1.1.4:

Client crashes when receiving specific malformed HTML (CAN-2005-0208)
Remote crash. Receiving malformed HTML can result in an invalid memory access causing Gaim to crash.

------- Comment #7 From Simon Stelling (RETIRED) 2005-02-25 08:57:16 0000 ------- 
stable on amd64

------- Comment #8 From Markus Rothe 2005-02-26 00:16:44 0000 ------- 
stable on ppc64

------- Comment #9 From Stephen Becker (RETIRED) 2005-02-26 19:33:54 0000 ------- 
stable on mipshttp://bugs.gentoo.org/show_bug.cgi?id=83253

------- Comment #10 From Bryan Østergaard (RETIRED) 2005-02-27 04:25:06 0000 ------- 
Stable on alpha.

------- Comment #11 From Matthias Geerdsen 2005-02-27 07:11:10 0000 ------- 
removing ia64

been marked stable without notice
no entry in Changelog but cvs log gives:
revision 1.4
date: 2005/02/25 16:19:09;  author: agriffis;  state: Exp;  lines: +2 -2
stable on ia64 #83253
(Portage version: 2.0.51-r15)

------- Comment #12 From Michael Hanselmann (hansmi) (RETIRED) 2005-02-28 14:24:01 0000 ------- 
Marked stable on ppc by blubb.

------- Comment #13 From Don Seiler (RETIRED) 2005-03-01 07:20:52 0000 ------- 
Vapier gave the OK to mark stable on HPPA and ARM.  I have done this.  That is
the last of the arches.

------- Comment #14 From Sune Kloppenborg Jeppesen 2005-03-01 12:21:20 0000 ------- 
GLSA 200503-02
Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug