| Summary: | x11-libs/pango New version fixes DoS vuln in xchat with hangul characters | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Sune Kloppenborg Jeppesen (RETIRED) <jaervosz> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | gnome |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| URL: | https://sourceforge.net/tracker/?func=detail&atid=100239&aid=984373&group_id=239 | ||
| Whiteboard: | A3? [ glsa? ] jaervosz | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Sune Kloppenborg Jeppesen (RETIRED)
2004-08-07 07:09:24 UTC
Please bump pango to 1.4.1 it is already in.. i guess it needs to go stable ? foser thanks for the swift reaction. Arches please mark stable. Target keywords: alpha amd64 arm hppa ia64 mips ppc ppc64 sparc x86 stable on ia64 x86 is stable stable on amd64 sparc'd it like a hurricane hppa stable stable on arm lu_zero thanks for the ppc mark though next time please put a note on the bug. Security: time to decide GLSA status. Please place your votes I don't have any objections to issuing a GLSA, but I don't think it's really necessary unless there's some arbitrary code execution going on. It's not clear from the SourceForge bug whether or not this is possible. It appears that if you use utf8 and xft backend it will result in a xchats dropping out of IRC if another client pastes in some Hangul text. Locally xchat can crash if xtext is used as backend. I guess it could cause other Gnome apps to crash. I tend to vote for no GLSA. I bet if you try to exploit it, you can do it in many ways. I believe xchat is just an easy show, but afaics any pango using applications is vulnerable. I'm not sure what the exact conditions need to be, but there have been more bugreports of crashes in the hangul module over time with different applications. I'm also voting for no GLSA here; but I have no objections to one getting released if somebody wants to do it. I see no other Pango advisories and the Release Announcement just says: * Fix common crash in Hangul shaper [Changwoo Ryu] No mention of any security implications. Sune, sorry, I thought I put a comment here, probably got miss due my feeble uplink =/ sounds like a fairly obscure exploit, so I'm OK with no GLSA. Closing without GLSA. If anyone disagrees feel free to reopen and provide information for a GLSA. Stable on alpha. stable on mips nothing to do here. ppc64 is already stable on 1.4.1 |