It is that time once again. Quoting release changelog: This as a security release fixing the following list of issues: * The function family git__strtol is used to parse integers from a buffer. As the functions do not take a buffer length as argument, they will scan either until the end of the current number or until a NUL byte is encountered. Many callers have been misusing the function and called it on potentially non-NUL-terminated buffers, resulting in possible out-of-bounds reads. Callers have been fixed to use git__strntol functions instead and git__strtol functions were removed. * The function git__strntol64 relied on the undefined behavior of signed integer overflows. While the code tried to detect such overflows after they have happened, this is unspecified behavior and may lead to weird behavior on uncommon platforms. * In the case where git__strntol32 was unable to parse an integer because it doesn't fit into an int32_t, it printed an error message containing the string that is currently being parsed. The code didn't truncate the string though, which caused it to print the complete string until a NUL byte is encountered and not only the currently parsed number. In case where the string was not NUL terminated, this could have lead to an out-of-bounds read. * When parsing tags, all unknown fields that appear before the tag message are skipped. This skipping is done by using a plain strstr(buffer, "\n\n") to search for the two newlines that separate tag fields from tag message. As it is not possible to supply a buffer length to strstr, this call may skip over the buffer's end and thus result in an out of bounds read. As strstr may return a pointer that is out of bounds, the following computation of buffer_end - buffer will overflow and result in an allocation of an invalid length. Note that when reading objects from the object database, we make sure to always NUL terminate them, making the use of strstr safe. * When parsing the "encoding" field of a commit, we may perform an out of bounds read due to using git__prefixcmp instead of git__prefixncmp. This can result in the parsed commit object containing uninitialized data in both its message encoding and message fields. Note that when reading objects from the object database, we make sure to always NUL terminate them, making the use of strstr safe.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1cfad8aadd257d4a15ac4b7a75a29e64bd140c23 commit 1cfad8aadd257d4a15ac4b7a75a29e64bd140c23 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-10-27 07:07:53 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-10-27 07:29:51 +0000 dev-libs/libgit2: Sec + bugfix bump to 0.27.7 Bug: https://bugs.gentoo.org/669736 Signed-off-by: Michał Górny <mgorny@gentoo.org> dev-libs/libgit2/Manifest | 1 + dev-libs/libgit2/libgit2-0.27.7.ebuild | 75 ++++++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b999cc8deec2aaa7d25a5a46b8ed3ebbea143f30 commit b999cc8deec2aaa7d25a5a46b8ed3ebbea143f30 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-10-27 07:06:54 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-10-27 07:29:47 +0000 dev-libs/libgit2: Sec-bump to 0.26.8 Bug: https://bugs.gentoo.org/669736 Signed-off-by: Michał Górny <mgorny@gentoo.org> dev-libs/libgit2/Manifest | 1 + dev-libs/libgit2/libgit2-0.26.8.ebuild | 75 ++++++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+)
Arch teams, please stabilize.
amd64 stable
x86 stopped stabilization due to bug 669892.
x86 stable
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0e108cd964ad141485245e8919a8f3d2e5f7eebb commit 0e108cd964ad141485245e8919a8f3d2e5f7eebb Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-10-29 07:14:17 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-10-29 07:14:17 +0000 dev-libs/libgit2: Remove vulnerable versions Bug: https://bugs.gentoo.org/669736 Signed-off-by: Michał Górny <mgorny@gentoo.org> dev-libs/libgit2/Manifest | 2 - dev-libs/libgit2/libgit2-0.26.7.ebuild | 82 ---------------------------------- dev-libs/libgit2/libgit2-0.27.5.ebuild | 82 ---------------------------------- 3 files changed, 166 deletions(-)
ping @security
