Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 624712 (CVE-2017-9988, CVE-2017-9989)

Summary: <media-libs/ming-0.20181112: Multiple vulnerabilities
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: graphics
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://bugzilla.redhat.com/show_bug.cgi?id=1470173
Whiteboard: B3 [glsa+ cve]
Package list:
Runtime testing required: ---
Bug Depends on: 646770    
Bug Blocks:    

Description Agostino Sarubbo gentoo-dev 2017-07-12 15:28:57 UTC
From ${URL} :

CVE-2017-9988

The readEncUInt30 function in util/read.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack against parser.c.

https://github.com/libming/libming/issues/85

CVE-2017-9989

util/outputtxt.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack.

https://github.com/libming/libming/issues/86


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2019-04-05 01:01:35 UTC
Both are fixed in master and a snapshot release has been added for the last commit (20181112) upstream.
Comment 2 Yury German Gentoo Infrastructure gentoo-dev Security 2019-04-19 01:44:26 UTC
GLSA Vote: Yes
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2019-04-24 23:58:20 UTC
This issue was resolved and addressed in
 GLSA 201904-24 at https://security.gentoo.org/glsa/201904-24
by GLSA coordinator Aaron Bauman (b-man).