Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 528252 - <net-irc/konversation-1.5.1: DoS or information leak due to an out-of-bounds read (CVE-2014-8483)
Summary: <net-irc/konversation-1.5.1: DoS or information leak due to an out-of-bounds ...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-11-04 19:11 UTC by Manuel Rüger (RETIRED)
Modified: 2014-12-28 22:34 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Manuel Rüger (RETIRED) gentoo-dev 2014-11-04 19:11:42 UTC 
From the changelog of 1.5.1:
Added a size sanity check for incoming Blowfish ECB blocks. The blind assumption of incoming blocks being the expected 12 bytes could lead to a crash or up to 11 byte information leak due to an out-of-bounds read. This fixes CVE-2014-8483.
Comment 1 Chiitoo gentoo-dev 2014-11-08 02:44:53 UTC 
Renaming the ebuild for 1.5.1 is almost enough, but the sources no longer have the directory 'doc-translations', so something like this is necessary:


--- a/konversation-1.5.1.ebuild
+++ b/konversation-1.5.1.ebuild
@@ -7,7 +7,7 @@
 KDE_LINGUAS="bg bs ca ca@valencia cs da de el en_GB es et fi fr gl he hu it kk
 km lt nb nds nl pl pt pt_BR ru si sk sl sr sr@ijekavian sr@ijekavianlatin
 sr@latin sv tr uk zh_CN zh_TW"
-KDE_DOC_DIRS="doc doc-translations/%lingua_${PN}"
+KDE_DOC_DIRS="doc"
 KDE_HANDBOOK="optional"
 inherit kde4-base


This works for me at least, though I can't say anything about the translations as I don't make use of them normally.

Should there be a separate bug for the version bump, or will this one take care of it?
Comment 2 Michael Palimaka (kensington) gentoo-dev 2014-11-13 08:41:57 UTC 
Thanks, bumped in CVS.

+  13 Nov 2014; Michael Palimaka <kensington@gentoo.org>
+  +konversation-1.5.1.ebuild:
+  Version bump wrt bug #528252. Fixes CVE-2014-8483.

Arch teams, please test and stabilise net-irc/konversation-1.5.1.

Target KEYWORDS="amd64 x86".

Thanks!
Comment 3 Agostino Sarubbo gentoo-dev 2014-11-13 10:03:17 UTC 
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2014-11-13 10:04:09 UTC 
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 5 Michael Palimaka (kensington) gentoo-dev 2014-11-13 10:06:11 UTC 
Removed old.
Comment 6 Sean Amoss (RETIRED) gentoo-dev Security 2014-12-25 15:47:03 UTC 
GLSA vote: no
Comment 7 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2014-12-28 22:34:09 UTC 
GLSA vote: no.

Closing as [noglsa]