Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 618178 - <net-libs/ldns-1.7.0-r1: Two memory corruption vulnerabilities
Summary: <net-libs/ldns-1.7.0-r1: Two memory corruption vulnerabilities
Status: RESOLVED DUPLICATE of bug 638338
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B2 [upstream/ebuild]
Keywords: PATCH
Depends on:
Blocks:
 
Reported: 2017-05-11 08:43 UTC by Agostino Sarubbo
Modified: 2020-03-18 03:27 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2017-05-11 08:43:41 UTC 
From ${URL} :

Hi,

i discovered two memory corruption vulnerabilities (double free) in ldns
1.7.0:

* https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1256
* https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1257

and reported it to https://www.nlnetlabs.nl/bugs-script/

Both fixed in upstream (in development branch):
* for bug 1256: https://git.nlnetlabs.nl/ldns/commit/?id=c8391790
* for bug 1257: https://git.nlnetlabs.nl/ldns/commit/?id=3bdeed02


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Aaron Bauman (RETIRED) gentoo-dev 2018-01-19 21:24:07 UTC 
ChangeLog from upstream shows the intended target is 1.7.1 release which is not available yet.  This would require a patch for now.
Comment 2 SpanKY gentoo-dev 2019-06-05 23:43:09 UTC 
this was fixed in the tree here:
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc5ac7f9daddfa46622cc9fed02ae05d0f1484cc

and is already stabilized at this point
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2020-03-18 03:27:34 UTC 
Already resolved and fixed in bug 638338

*** This bug has been marked as a duplicate of bug 638338 ***