Bug 528252

Summary:	<net-irc/konversation-1.5.1: DoS or information leak due to an out-of-bounds read (CVE-2014-8483)
Product:	Gentoo Security	Reporter:	Manuel Rüger (RETIRED) <mrueg>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	chiitoo, net-irc
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [noglsa]
Package list:		Runtime testing required:	---

Description Manuel Rüger (RETIRED) gentoo-dev

2014-11-04 19:11:42 UTC

From the changelog of 1.5.1:
Added a size sanity check for incoming Blowfish ECB blocks. The blind assumption of incoming blocks being the expected 12 bytes could lead to a crash or up to 11 byte information leak due to an out-of-bounds read. This fixes CVE-2014-8483.

Comment 1 Chiitoo gentoo-dev

2014-11-08 02:44:53 UTC

Renaming the ebuild for 1.5.1 is almost enough, but the sources no longer have the directory 'doc-translations', so something like this is necessary:


--- a/konversation-1.5.1.ebuild
+++ b/konversation-1.5.1.ebuild
@@ -7,7 +7,7 @@
 KDE_LINGUAS="bg bs ca ca@valencia cs da de el en_GB es et fi fr gl he hu it kk
 km lt nb nds nl pl pt pt_BR ru si sk sl sr sr@ijekavian sr@ijekavianlatin
 sr@latin sv tr uk zh_CN zh_TW"
-KDE_DOC_DIRS="doc doc-translations/%lingua_${PN}"
+KDE_DOC_DIRS="doc"
 KDE_HANDBOOK="optional"
 inherit kde4-base


This works for me at least, though I can't say anything about the translations as I don't make use of them normally.

Should there be a separate bug for the version bump, or will this one take care of it?

Comment 2 Michael Palimaka (kensington) gentoo-dev

2014-11-13 08:41:57 UTC

Thanks, bumped in CVS.

+  13 Nov 2014; Michael Palimaka <kensington@gentoo.org>
+  +konversation-1.5.1.ebuild:
+  Version bump wrt bug #528252. Fixes CVE-2014-8483.

Arch teams, please test and stabilise net-irc/konversation-1.5.1.

Target KEYWORDS="amd64 x86".

Thanks!

Comment 3 Agostino Sarubbo gentoo-dev

2014-11-13 10:03:17 UTC

amd64 stable

Comment 4 Agostino Sarubbo gentoo-dev

2014-11-13 10:04:09 UTC

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

Comment 5 Michael Palimaka (kensington) gentoo-dev

2014-11-13 10:06:11 UTC

Removed old.

Comment 6 Sean Amoss (RETIRED) gentoo-dev

2014-12-25 15:47:03 UTC

GLSA vote: no

Comment 7 Mikle Kolyada (RETIRED) archtester

2014-12-28 22:34:09 UTC

GLSA vote: no.

Closing as [noglsa]