| Summary: | <media-gfx/graphite2-1.3.10: multiple vulnerabilities | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | major | Flags: | stable-bot:
sanity-check+
|
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/#CVE-2017-7778 | ||
| Whiteboard: | A2 [glsa cve] | ||
| Package list: |
media-gfx/graphite2-1.3.10
|
Runtime testing required: | --- |
@ Arches, please test and mark stable: =media-gfx/graphite2-1.3.10 amd64 stable x86 stable Stable on alpha. ppc stable ppc64 stable arm stable ia64 stable sparc stable Arches, please finish stabilizing hppa Gentoo Security Padawan ChrisADR Vulnerable version dropped in git commit 13cc021ade3a4a769c1ad789fb73f351fbd45a54, hppa destabilised. GLSA Request filed. Gentoo Security Padawan ChrisADR This issue was resolved and addressed in GLSA 201710-13 at https://security.gentoo.org/glsa/201710-13 by GLSA coordinator Aaron Bauman (b-man). hppa stable |
From ${URL} : A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. References Graphite2 lz4::decompress out of bounds write (CVE-2017-7778) Graphite2 out of bounds read [@ graphite2::Pass::readPass] (CVE-2017-7771) Graphite2 heap-buffer-overflow write [@ lz4::decompress] (CVE-2017-7772) Graphite2 heap-buffer-overflow write [@ lz4::decompress] src/Decompressor (CVE-2017-7773) Graphite2 out of bounds read [@ graphite2::Silf::readGraphite] (CVE-2017-7774) Graphite2 Assertion 'size() > n' failed (CVE-2017-7775) Graphite2 heap-buffer-overflow read [@ graphite2::Silf::getClassGlyph] (CVE-2017-7776) Graphite2 use of uninitialized memory [@ graphite2::GlyphCache::Loader::read_glyph] (CVE-2017-7777) @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.