Summary: | <dev-lang/vala-0.26.2: Heap-buffer overflow in vala-gstreamer bindings at Gst.MapInfo() (CVE-2014-8154) | ||||||
---|---|---|---|---|---|---|---|
Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> | ||||
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | normal | CC: | gnome, realnot | ||||
Priority: | Normal | ||||||
Version: | unspecified | ||||||
Hardware: | All | ||||||
OS: | Linux | ||||||
URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1181404 | ||||||
Whiteboard: | B2 [noglsa/cve] | ||||||
Package list: | Runtime testing required: | --- | |||||
Attachments: |
|
Description
Agostino Sarubbo
![]() CVE-2014-8154 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8154): The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overflow. Already fixed in >=dev-lang/vala-0.26.2 - added to the tree in January and stabilized. Vunlerable versions (vala-0.26.0 and 0.26.1) have been removed from the tree. Created attachment 411634 [details]
Vala sandbox access violation
I tried to emerge different version of the package, with the same/similar error as result.
I have removed /.git dir to make it work (In reply to Mauro Crociara from comment #3) > Created attachment 411634 [details] > Vala sandbox access violation > > I tried to emerge different version of the package, with the same/similar > error as result. That is a completely different issue (nothing to do with buffer overflow in gstreamer bindings) caused by your /.git directory, I've made a separate bug #560308 about it. (In reply to Alexandre Rostovtsev from comment #2) > Already fixed in >=dev-lang/vala-0.26.2 - added to the tree in January and > stabilized. > > Vunlerable versions (vala-0.26.0 and 0.26.1) have been removed from the tree. Thank you! Security Please Vote. GLSA Vote: No Arches and Maintainer(s), Thank you for your work. Thank you all. Closing as noglsa. |