Bug 670042 – <net-misc/networkmanager-1.14.6: Out-of-bounds heap write in dhcpv6 option handling (CVE-2018-15688)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2018-10-31 15:34:29 UTC]

CVE-2018-15688 (https://nvd.nist.gov/vuln/detail/CVE-2018-15688):
  A buffer overflow vulnerability in the dhcp6 client of systemd allows a
  malicious dhcp6 server to overwrite heap memory in systemd-networkd.
  Affected releases are systemd: versions up to and including 239.

[Comment 1 Larry the Git Cow 2019-02-23 14:11:33 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=351cf8e77d67c77e5f705225ac0816367c7547c3

commit 351cf8e77d67c77e5f705225ac0816367c7547c3
Author:     Mart Raudsepp <[e-mail]>
AuthorDate: 2019-02-23 14:11:11 +0000
Commit:     Mart Raudsepp <[e-mail]>
CommitDate: 2019-02-23 14:11:11 +0000

    net-misc/networkmanager: security bump to 1.14.6
    
    Bug: https://bugs.gentoo.org/670042
    Package-Manager: Portage-2.3.52, Repoman-2.3.12
    Signed-off-by: Mart Raudsepp <[e-mail]>

 net-misc/networkmanager/Manifest                   |   1 +
 .../networkmanager/networkmanager-1.14.6.ebuild    | 339 +++++++++++++++++++++
 2 files changed, 340 insertions(+)

[Comment 2 Agostino Sarubbo 2019-02-24 09:03:35 UTC]

amd64 stable

[Comment 3 Thomas Deutschmann (RETIRED) 2019-02-24 19:02:04 UTC]

x86 stable

[Comment 4 Mikle Kolyada (RETIRED) 2019-03-02 15:35:29 UTC]

arm stable

[Comment 5 Sergei Trofimovich (RETIRED) 2019-04-28 07:45:23 UTC]

ppc stable

[Comment 6 Sergei Trofimovich (RETIRED) 2019-04-28 13:10:26 UTC]

ppc64 stable

[Comment 7 Larry the Git Cow 2019-04-28 14:41:21 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=70b4da0962bc78298d6bdec9af2229c637748d61

commit 70b4da0962bc78298d6bdec9af2229c637748d61
Author:     Mart Raudsepp <[e-mail]>
AuthorDate: 2019-04-28 14:40:59 +0000
Commit:     Mart Raudsepp <[e-mail]>
CommitDate: 2019-04-28 14:40:59 +0000

    net-misc/networkmanager: security cleanup
    
    Bug: https://bugs.gentoo.org/670042
    Package-Manager: Portage-2.3.62, Repoman-2.3.12
    Signed-off-by: Mart Raudsepp <[e-mail]>

 net-misc/networkmanager/Manifest                   |   1 -
 .../networkmanager/networkmanager-1.14.4.ebuild    | 339 ---------------------
 2 files changed, 340 deletions(-)

[Comment 8 Andreas Sturmlechner 2019-04-28 14:56:41 UTC]

Shouldn't this have been closed by bug 683958? Seems like a waste of time.

[Comment 9 Aaron Bauman (RETIRED) 2019-05-10 02:55:20 UTC]

tree is clean