Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 585268 (CVE-2016-4456, GNUTLS-SA-2016-1)

Summary: =net-libs/gnutls-3.4.12: insecure getenv() on GNUTLS_KEYLOGFILE
Product: Gentoo Security Reporter: Kristian Fiskerstrand <k_f>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: alonbl, crypto+disabled
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: ̃~2 [noglsa]
Package list:
Runtime testing required: ---

Description Kristian Fiskerstrand gentoo-dev Security 2016-06-07 10:23:06 UTC
Tag	Other identifiers	Severity	Information
	- 	File overwrite by setuid programs 	Setuid programs using GnuTLS 3.4.12 could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 and fixed in GnuTLS 3.4.13. Recommendation: Upgrade to GnuTLS 3.4.13, or later versions.
Comment 1 Alon Bar-Lev gentoo-dev 2016-06-11 04:34:46 UTC
Already in tree, let's wait for a few days as build changes are not trivial.
Comment 2 Kristian Fiskerstrand gentoo-dev Security 2016-06-11 11:42:28 UTC
(In reply to Alon Bar-Lev from comment #1)
> Already in tree, let's wait for a few days as build changes are not trivial.

Thanks, since this does not affect stable, once affected version (3.4.12) is removed from tree you can close the bug.
Comment 3 Alon Bar-Lev gentoo-dev 2016-06-11 11:53:43 UTC
OK, I cleaned up all unstable packages.