Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 695538 (CVE-2019-15531) - <media-libs/libextractor-1.9: heap-based buffer over-read in function EXTRACTOR_dvi_extract_method (CVE-2019-15531)
Summary: <media-libs/libextractor-1.9: heap-based buffer over-read in function EXTRACT...
Status: RESOLVED FIXED
Alias: CVE-2019-15531
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://bugs.gnunet.org/view.php?id=5846
Whiteboard: B3 [noglsa cve]
Keywords:
: 767238 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-09-24 12:26 UTC by GLSAMaker/CVETool Bot
Modified: 2021-01-26 03:16 UTC (History)
2 users (show)

See Also:
Package list:
media-libs/libextractor-1.9
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2019-09-24 12:26:07 UTC 
CVE-2019-15531 (https://nvd.nist.gov/vuln/detail/CVE-2019-15531):
  GNU Libextractor through 1.9 has a heap-based buffer over-read in the
  function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2019-09-24 12:27:06 UTC 
Upstream fix: https://git.gnunet.org/libextractor.git/commit/?id=d2b032452241708bee68d02aa02092cfbfba951a
Comment 2 Larry the Git Cow gentoo-dev 2019-10-26 20:32:46 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f03e8e6318164311ede00819aa2cef46ad83cc4b

commit f03e8e6318164311ede00819aa2cef46ad83cc4b
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2019-10-26 20:32:18 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2019-10-26 20:32:39 +0000

    media-libs/libextractor: bump to v1.9
    
    Bug: https://bugs.gentoo.org/695538
    Package-Manager: Portage-2.3.78, Repoman-2.3.17
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 media-libs/libextractor/Manifest                   |   1 +
 .../files/libextractor-1.9-CVE-2019-15531.patch    |  15 +++
 media-libs/libextractor/libextractor-1.9.ebuild    | 118 +++++++++++++++++++++
 3 files changed, 134 insertions(+)
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2019-10-27 23:22:13 UTC 
x86 stable
Comment 4 Agostino Sarubbo gentoo-dev 2019-10-28 09:44:26 UTC 
amd64 stable
Comment 5 ernsteiswuerfel archtester 2019-10-31 01:17:21 UTC 
Looking good on ppc.

# cat libextractor-695538.report 
USE tests started on Do 31. Okt 00:58:39 CET 2019

FEATURES=' test' USE='' succeeded for =media-libs/libextractor-1.9
USE='-archive -bzip2 ffmpeg -flac -gif -gsf -gstreamer -gtk jpeg -magic midi -mp4 -mpeg tidy tiff -vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive bzip2 -ffmpeg flac -gif gsf gstreamer gtk jpeg magic -midi mp4 mpeg -tidy -tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive -bzip2 -ffmpeg flac gif -gsf -gstreamer -gtk jpeg -magic midi mp4 mpeg -tidy -tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive bzip2 -ffmpeg -flac -gif -gsf -gstreamer -gtk jpeg magic midi mp4 -mpeg tidy -tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive -bzip2 ffmpeg -flac -gif -gsf -gstreamer -gtk jpeg -magic midi -mp4 mpeg -tidy tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive bzip2 ffmpeg -flac -gif gsf gstreamer gtk -jpeg -magic midi mp4 mpeg -tidy tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive -bzip2 -ffmpeg -flac -gif -gsf gstreamer gtk jpeg magic midi -mp4 -mpeg tidy tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive -bzip2 ffmpeg flac gif gsf -gstreamer gtk -jpeg -magic midi mp4 -mpeg -tidy -tiff -vorbis zlib' succeeded for =media-libs/libextractor-1.9
USE='archive bzip2 ffmpeg -flac -gif gsf gstreamer -gtk -jpeg magic -midi -mp4 mpeg -tidy tiff -vorbis zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive -bzip2 -ffmpeg -flac gif -gsf gstreamer -gtk jpeg magic -midi mp4 -mpeg tidy tiff -vorbis zlib' succeeded for =media-libs/libextractor-1.9
USE='archive bzip2 -ffmpeg flac -gif -gsf gstreamer -gtk jpeg -magic midi -mp4 mpeg tidy -tiff vorbis zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive -bzip2 ffmpeg flac -gif gsf gstreamer gtk jpeg magic midi -mp4 -mpeg tidy tiff vorbis zlib' succeeded for =media-libs/libextractor-1.9

revdep tests started on Do 31. Okt 02:12:01 CET 2019

FEATURES=' test' USE='' succeeded for dev-python/libextractor-python
Comment 6 ernsteiswuerfel archtester 2019-11-01 16:11:08 UTC 
Looking good on ppc64.

# cat libextractor-695538.report 
USE tests started on Do 31. Okt 19:49:58 CET 2019

FEATURES=' test' USE='' succeeded for =media-libs/libextractor-1.9
USE='archive bzip2 -ffmpeg -flac gif -gsf -gstreamer gtk -jpeg -magic midi -mp4 -mpeg tidy -tiff -vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive -bzip2 -ffmpeg -flac -gif -gsf -gstreamer gtk jpeg magic midi -mp4 -mpeg tidy -tiff -vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive bzip2 -ffmpeg -flac gif -gsf gstreamer gtk jpeg -magic midi -mp4 mpeg tidy -tiff -vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive bzip2 -ffmpeg -flac gif gsf gstreamer -gtk -jpeg magic -midi -mp4 mpeg -tidy tiff -vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive -bzip2 -ffmpeg -flac gif -gsf -gstreamer gtk jpeg magic midi -mp4 -mpeg tidy tiff -vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive bzip2 ffmpeg -flac -gif -gsf gstreamer -gtk -jpeg -magic -midi -mp4 -mpeg -tidy -tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive bzip2 -ffmpeg -flac gif gsf gstreamer -gtk -jpeg -magic -midi -mp4 -mpeg -tidy -tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive -bzip2 ffmpeg flac gif -gsf -gstreamer -gtk -jpeg -magic -midi -mp4 -mpeg tidy -tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='archive bzip2 ffmpeg -flac -gif gsf gstreamer -gtk jpeg -magic -midi -mp4 -mpeg tidy -tiff vorbis -zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive bzip2 ffmpeg -flac gif gsf gstreamer gtk -jpeg -magic -midi mp4 mpeg -tidy tiff -vorbis zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive bzip2 -ffmpeg -flac gif gsf -gstreamer -gtk jpeg magic -midi -mp4 mpeg -tidy -tiff vorbis zlib' succeeded for =media-libs/libextractor-1.9
USE='-archive bzip2 ffmpeg -flac -gif -gsf -gstreamer gtk -jpeg -magic midi -mp4 -mpeg tidy tiff vorbis zlib' succeeded for =media-libs/libextractor-1.9

revdep tests started on Do 31. Okt 20:35:43 CET 2019

FEATURES=' test' USE='' succeeded for dev-python/libextractor-python
Comment 7 Sergei Trofimovich (RETIRED) gentoo-dev 2019-11-01 23:31:12 UTC 
ppc/ppc64 stable thanks to ernsteiswuerfel!
Comment 8 Thomas Deutschmann (RETIRED) gentoo-dev 2020-03-20 01:09:50 UTC 
GLSA Vote: No!
Comment 9 Larry the Git Cow gentoo-dev 2020-03-20 01:10:11 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6bfcfe0e2e9ff16339f5799db47ca978381ae095

commit 6bfcfe0e2e9ff16339f5799db47ca978381ae095
Author:     Sam James (sam_c) <sam@cmpct.info>
AuthorDate: 2020-03-20 00:03:29 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2020-03-20 01:10:03 +0000

    media-libs/libextractor: Cleanup vulnerable version
    
    Bug: https://bugs.gentoo.org/695538
    Signed-off-by: Sam James (sam_c) <sam@cmpct.info>
    Closes: https://github.com/gentoo/gentoo/pull/15019
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 media-libs/libextractor/Manifest                   |   1 -
 media-libs/libextractor/libextractor-1.8-r1.ebuild | 118 ---------------------
 2 files changed, 119 deletions(-)
Comment 10 Thomas Deutschmann (RETIRED) gentoo-dev 2020-03-20 01:10:37 UTC 
Repository is clean, all done!
Comment 11 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-01-26 03:16:38 UTC 
*** Bug 767238 has been marked as a duplicate of this bug. ***