Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 217609 - media-plugins/gst-plugins-speex <0.10.7-r1 speex implementations insufficient boundary checks
Summary: media-plugins/gst-plugins-speex <0.10.7-r1 speex implementations insufficient...
Status: RESOLVED WONTFIX
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal
Assignee: Gentoo Security
URL:
Whiteboard: B2 []
Keywords:
Depends on: 217715
Blocks:
  Show dependency tree
 
Reported: 2008-04-14 09:42 UTC by Matthias Geerdsen (RETIRED)
Modified: 2008-04-17 12:17 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Geerdsen (RETIRED) gentoo-dev 2008-04-14 09:42:00 UTC 
This bug is not public yet, please do not disclose any information.

gst-plugins-good appears to include vulnerable speex code

see http://www.ocert.org/advisories/ocert-2008-2.html
as well as bug 216499 and bug 217373 for similar issues
Comment 1 Matthias Geerdsen (RETIRED) gentoo-dev 2008-04-14 09:48:12 UTC 
patch is available:
http://webcvs.freedesktop.org/gstreamer/gst-plugins-good/ext/speex/gstspeexdec.c?r1=1.40&r2=1.41
Comment 2 Robert Buchholz (RETIRED) gentoo-dev 2008-04-14 16:03:25 UTC 
I wonder how this affects media-plugins/gst-plugins-speex
Comment 3 Samuli Suominen (RETIRED) gentoo-dev 2008-04-14 17:08:34 UTC 
+*gst-plugins-speex-0.10.7-r1 (14 Apr 2008)
+
+  14 Apr 2008; Samuli Suominen <drac@gentoo.org>
+  +files/gst-plugins-speex-0.10.7-sec.patch,
+  +gst-plugins-speex-0.10.7-r1.ebuild:
+  Fix for security #217609.
Comment 4 Samuli Suominen (RETIRED) gentoo-dev 2008-04-14 17:09:44 UTC 
gst-plugins-speex is a "gentoo split" from -good, so that's where it should be patched

and for arches, http://samples.mplayerhq.hu/A-codecs/speex/talk109-q5.spx, a sample file
Comment 5 Robert Buchholz (RETIRED) gentoo-dev 2008-04-14 17:26:54 UTC 
Arch Security Liaisons, please test and mark stable:
=media-plugins/gst-plugins-speex-0.10.7-r1
Target keywords : "ppc ppc64 release sparc"

CC'ing current Liaisons:
     ppc : dertobi123
   ppc64 : corsair
 release : pva
   sparc : fmccor
Comment 6 Markus Rothe (RETIRED) gentoo-dev 2008-04-14 18:36:07 UTC 
ppc64 stable
Comment 7 Samuli Suominen (RETIRED) gentoo-dev 2008-04-14 19:16:46 UTC 
corsair, fmccor, and others. because this needs gstreamer 0.10.17, make sure you stable also newer version of gst-plugins-ugly, 0.10.6-r1 or newer is OK. this is to avoid blockers, repoman won't reveal this.
Comment 8 Ferris McCormick (RETIRED) gentoo-dev 2008-04-14 19:46:07 UTC 
Sparc stable for gst-plugins-speex <0.10.7-r1.
This requires also sparc stable for:
 gstreamer-0.10.7
 gst-plugins-base-0.10.7
 gst-plugins-ugly-10.6-r1
All done.
Comment 9 Matthias Geerdsen (RETIRED) gentoo-dev 2008-04-17 09:42:12 UTC 
now public via http://www.ocert.org/advisories/ocert-2008-004.html
Comment 10 Matthias Geerdsen (RETIRED) gentoo-dev 2008-04-17 10:19:11 UTC 
This will be fixed with the speex update in bug 217715, keeping open until the
GLSA has been released.
Comment 11 Robert Buchholz (RETIRED) gentoo-dev 2008-04-17 12:17:29 UTC 
speex has been sent as GLSA 200804-17, this also fixes this bug.