Bug 905308 – <app-text/editorconfig-core-c-0.12.6: arbitrary stack write

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2023-04-29 18:23:29 UTC]

CVE-2023-0341 (https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e):

A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.

URL is 404, but patch is above. Please bump to 0.12.6.

[Comment 1 Larry the Git Cow 2023-04-30 07:03:31 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc3eedc2af4a8481630f374e1542699ae1235e92

commit bc3eedc2af4a8481630f374e1542699ae1235e92
Author:     Sam James <[e-mail]>
AuthorDate: 2023-04-30 07:02:33 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-04-30 07:03:19 +0000

    app-text/editorconfig-core-c: add 0.12.6
    
    Bug: https://bugs.gentoo.org/905308
    Signed-off-by: Sam James <[e-mail]>

 app-text/editorconfig-core-c/Manifest              |  1 +
 .../editorconfig-core-c-0.12.6.ebuild              | 51 ++++++++++++++++++++++
 2 files changed, 52 insertions(+)

[Comment 2 Hans de Graaff 2024-04-05 09:21:11 UTC]

commit 0fe4d955423d5499061f7d52ce90ab13d4d05b12
Author: Zac Medico <[e-mail]>
Date:   Sat Mar 2 15:33:34 2024 -0800

    app-text/editorconfig-core-c: drop 0.12.5

[Comment 3 Larry the Git Cow 2024-11-06 13:46:05 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=014147910c929fd96062a85f21100b2f7c778424

commit 014147910c929fd96062a85f21100b2f7c778424
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-11-06 13:45:42 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-11-06 13:46:04 +0000

    [ GLSA 202411-04 ] EditorConfig core C library: arbitrary stack write
    
    Bug: https://bugs.gentoo.org/905308
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202411-04.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)