CVE-2017-14631 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14631): In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow. References: https://github.com/pts/sam2p/issues/14 CVE-2017-14630 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14630): In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation. References: https://github.com/pts/sam2p/issues/14 CVE-2017-14629 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14629): In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element. References: https://github.com/pts/sam2p/issues/14 CVE-2017-14628 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14628): In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp. References: https://github.com/pts/sam2p/issues/14
These bugs have now been fixed in the newest 0.49.4 release. https://github.com/pts/sam2p/releases/tag/v0.49.4 @Maintainer(s): Please provide a fixed ebuild, thank you.
Adding CVE-2017-14636 and CVE-2017-14637 to the list
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=173810552f074b83f9d0bdee1e50e5691904b9d9 commit 173810552f074b83f9d0bdee1e50e5691904b9d9 Author: John Helmert III <jchelmert3@posteo.net> AuthorDate: 2020-10-04 17:09:13 +0000 Commit: David Seifert <soap@gentoo.org> CommitDate: 2020-10-04 17:09:13 +0000 media-gfx/sam2p: Security bump Bug: https://bugs.gentoo.org/631636 Bug: https://bugs.gentoo.org/636876 Bug: https://bugs.gentoo.org/649750 Package-Manager: Portage-2.3.101, Repoman-2.3.22 Signed-off-by: John Helmert III <jchelmert3@posteo.net> Closes: https://github.com/gentoo/gentoo/pull/16286 Signed-off-by: David Seifert <soap@gentoo.org> media-gfx/sam2p/Manifest | 1 + media-gfx/sam2p/files/sam2p-configure-strip.patch | 30 +++++++++++ media-gfx/sam2p/sam2p-0.49.4_p20190718.ebuild | 62 +++++++++++++++++++++++ 3 files changed, 93 insertions(+)
noglsa following suit with dependency.
