| Summary: | <dev-libs/icu-58.2-r1 : heap overflow | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | major | CC: | alexander, arthur, melendro, office, sudormrfhalt |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: | https://bugs.gentoo.org/show_bug.cgi?id=617888 | ||
| Whiteboard: | A2 [glsa+ cve] | ||
| Package list: |
dev-libs/icu-58.2-r1
dev-libs/icu-layoutex-58.2 amd64 hppa ia64 ppc ppc64 x86
app-office/libreoffice-bin-5.2.7.2-r1 amd64 x86
app-office/libreoffice-bin-debug-5.2.7.2-r1 amd64 x86
|
Runtime testing required: | Yes |
|
Description
Agostino Sarubbo
2017-04-24 11:38:00 UTC
Jer, is bug 617888 includes the patch for this vulnerability? (In reply to Yury German from comment #1) > Jer, is bug 617888 includes the patch for this vulnerability? AFAIK it's NOT fixed in ICU 59.1 (and the linked patch only works for 58.2). The upstream ticket is restricted, so no clue what's happening there. (In reply to Andreas K. Hüttel from comment #2) > (In reply to Yury German from comment #1) > > Jer, is bug 617888 includes the patch for this vulnerability? > > AFAIK it's NOT fixed in ICU 59.1 (and the linked patch only works for 58.2). > The upstream ticket is restricted, so no clue what's happening there. Correction, last comment is wrong. It *is* fixed in 59.1 as-released. Also Gentoo 58.2-r1 now contains a backport. Testing now. [Note, the two CVEs describe the same issue and are fixed by the same patch.] Arches please stabilize: All stable arches: dev-libs/icu-58.2-r1 amd64 and x86: app-office/libreoffice-bin-5.2.7.2-r1 app-office/libreoffice-bin-debug-5.2.7.2-r1 amd64 stable what about sqlite?
dev-libs/icu:0
(dev-libs/icu-58.1-r1:0/58.1::gentoo, installed) pulled in by
dev-libs/icu:0/58.1=[abi_x86_64(-)] required by (dev-db/sqlite-3.17.0:3/3::gentoo, installed)
^^^^^^^^
(and 15 more with the same problem)
(dev-libs/icu-58.2-r1:0/58.2::gentoo, ebuild scheduled for merge) pulled in by
dev-libs/icu:0/58.2 required by (app-office/libreoffice-bin-5.2.7.2-r1:0/0::gentoo, ebuild scheduled for merge)
^^^^^^^
(In reply to Andreas K. Hüttel from comment #4) > Arches please stabilize: > > All stable arches: > dev-libs/icu-58.2-r1 > > amd64 and x86: > app-office/libreoffice-bin-5.2.7.2-r1 > app-office/libreoffice-bin-debug-5.2.7.2-r1 Can we add dev-libs/icu-layoutex-58.2 to this list please? arm stable x86 stable Adding arches back, please *also* stabilize =dev-libs/icu-layoutex-58.2 (needs to be at the same version as icu) Pachakge list is updated *** Bug 620346 has been marked as a duplicate of this bug. *** An automated check of this bug failed - repoman reported dependency errors (21 lines truncated):
> dependency.bad dev-libs/icu-layoutex/icu-layoutex-58.2.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['dev-libs/icu-le-hb[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?]']
> dependency.bad dev-libs/icu-layoutex/icu-layoutex-58.2.ebuild: RDEPEND: alpha(default/linux/alpha/13.0) ['dev-libs/icu-le-hb[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?]']
> dependency.bad dev-libs/icu-layoutex/icu-layoutex-58.2.ebuild: DEPEND: alpha(default/linux/alpha/13.0) ['dev-libs/icu-le-hb[abi_x86_32(-)?,abi_x86_64(-)?,abi_x86_x32(-)?,abi_mips_n32(-)?,abi_mips_n64(-)?,abi_mips_o32(-)?,abi_ppc_32(-)?,abi_ppc_64(-)?,abi_s390_32(-)?,abi_s390_64(-)?]']
Stable on alpha. amd64 stable arm stable *** Bug 620014 has been marked as a duplicate of this bug. *** x86 stable sparc stable ia64 stable ppc64 stable ppc stable Arches, please finish stabilizing hppa Gentoo Security Padawan ChrisADR hppa stable Thank you all, New GLSA Request filed. Gentoo Security Padawan ChrisADR @Maintainers please remove vulnerable versions. This issue was resolved and addressed in GLSA 201710-03 at https://security.gentoo.org/glsa/201710-03 by GLSA coordinator Aaron Bauman (b-man). re-opened for cleanup. cleanup done. Thank you all, |
