Bug 566032 – <dev-tex/latex2rtf-2.3.11: Format string vulnerability in CmdKeywords (CVE-2015-8106)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2015-11-17 09:14:24 UTC]

From ${URL} :

A format string vulnerability was found in CmdKeywords function when processing \keywords command 
in tex file. When the user runs latex2rtf with malicious crafted tex file, an attacker can execute 
arbitrary code. The variable `keywords' in the function CmdKeywords may hold a malicious input 
string, which can be used as a format argument of vsnprintf.

Vulnerable code:

1789        char *keywords = getBraceParam();
...
1798    fprintRTF(keywords);
...

858    void fprintRTF(char *format, ...){
      ...
873    vsnprintf(buffer, 1024, format, apf);
      ...

Public disclosure (includes reproducer and suggested fix):

http://seclists.org/oss-sec/2015/q4/283


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Pacho Ramos 2016-08-21 17:27:29 UTC]

[master 0ae8d7b] dev-tex/latex2rtf: Version bump (security bug #566032)
 2 files changed, 47 insertions(+)
 create mode 100644 dev-tex/latex2rtf/latex2rtf-2.3.11.ebuild

[Comment 2 Pacho Ramos 2016-08-21 17:27:57 UTC]

*** Bug 535390 has been marked as a duplicate of this bug. ***

[Comment 3 Jeroen Roovers (RETIRED) 2016-08-24 07:19:05 UTC]

Stable for HPPA PPC64.

[Comment 4 Tobias Klausmann (RETIRED) 2016-09-02 19:21:49 UTC]

Stable on alpha.

[Comment 5 Agostino Sarubbo 2016-09-10 12:49:23 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2016-09-29 08:41:25 UTC]

x86 stable

[Comment 7 Agostino Sarubbo 2016-09-29 09:36:09 UTC]

sparc stable

[Comment 8 Agostino Sarubbo 2016-09-29 12:36:55 UTC]

ppc stable

[Comment 9 Agostino Sarubbo 2016-09-29 13:29:32 UTC]

ia64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

[Comment 10 Yury German 2016-10-31 06:05:17 UTC]

Arches, Thank you for your work.
GLSA Vote: No

Maintainer(s), please drop the vulnerable version(s).

[Comment 11 Aaron Bauman (RETIRED) 2016-11-20 06:00:45 UTC]

Please clean the vulnerable versions.

[Comment 12 Aaron Bauman (RETIRED) 2016-12-27 09:18:22 UTC]

Please clean vulnerable versions from tree.

[Comment 13 Thomas Deutschmann (RETIRED) 2017-01-08 22:38:56 UTC]

Cleanup PR: https://github.com/gentoo/gentoo/pull/3383

[Comment 14 Aaron Bauman (RETIRED) 2017-01-15 07:39:16 UTC]

Tree is clean.