Bug 352317 – <dev-perl/Convert-UUlib-1.34: DoS

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Paweł Hajdan, Jr. (RETIRED) 2011-01-21 07:26:12 UTC]

A weakness has been reported in the Convert::UUlib module for Perl, which can potentially be exploited by malicious people to potentially cause a DoS (Denial of Service) .

The weakness is caused due to an off-by-one error in the "UURepairData()" function (uulib/uunconc.c) when handling a incomplete uuencoded string. This can be exploited to write a single NULL byte outside the bounds of a heap-based buffer in an application using the vulnerable library.

The weakness is reported in versions prior to 1.34.

[Comment 1 Paweł Hajdan, Jr. (RETIRED) 2011-01-21 07:27:33 UTC]

It seems like we should stabilize dev-perl/Convert-UUlib-1.340. Is that correct? If yes, please CC arches and add STABLEREQ keyword.

[Comment 2 Torsten Veller (RETIRED) 2011-01-21 07:33:02 UTC]

Correct.

[Comment 3 Paweł Hajdan, Jr. (RETIRED) 2011-01-21 07:54:07 UTC]

Please stabilize =dev-perl/Convert-UUlib-1.340

[Comment 4 Kacper Kowalik (Xarthisius) (RETIRED) 2011-01-21 08:35:03 UTC]

ppc/ppc64 stable

[Comment 5 Markos Chandras (RETIRED) 2011-01-21 09:53:43 UTC]

amd64 done

[Comment 6 Christian Faulhammer (RETIRED) 2011-01-21 13:47:13 UTC]

x86 stable

[Comment 7 Raúl Porcel (RETIRED) 2011-01-22 11:22:01 UTC]

alpha/arm/ia64/m68k/s390/sh/sparc stable

[Comment 8 Jeroen Roovers (RETIRED) 2011-01-24 03:25:07 UTC]

Stable for HPPA.

[Comment 9 Tim Sammut (RETIRED) 2011-01-24 14:51:23 UTC]

Thanks, folks. GLSA Vote: no.

[Comment 10 Stefan Behte (RETIRED) 2011-02-23 22:36:20 UTC]

GLSA Vote: no, closing noglsa.