Bug 631636 (CVE-2017-14628, CVE-2017-14629, CVE-2017-14630, CVE-2017-14631, CVE-2017-14636, CVE-2017-14637)

Summary:	media-gfx/sam2p: Multiple Denial of Service Vulnerabilities
Product:	Gentoo Security	Reporter:	Aleksandr Wagner (Kivak) <alwag>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	tex
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:	636876
Bug Blocks:

Description Aleksandr Wagner (Kivak) 2017-09-21 12:49:36 UTC

CVE-2017-14631 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14631):

In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow. 

References:

https://github.com/pts/sam2p/issues/14

CVE-2017-14630 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14630):

In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation. 

References:

https://github.com/pts/sam2p/issues/14

CVE-2017-14629 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14629):

In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-bounds array element. 

References:

https://github.com/pts/sam2p/issues/14

CVE-2017-14628 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14628):

In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp. 

References:

https://github.com/pts/sam2p/issues/14

Comment 1 Aleksandr Wagner (Kivak) 2017-10-02 03:45:47 UTC

These bugs have now been fixed in the newest 0.49.4 release.

https://github.com/pts/sam2p/releases/tag/v0.49.4

@Maintainer(s): Please provide a fixed ebuild, thank you.

Comment 2 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-10-23 20:55:09 UTC

Adding CVE-2017-14636 and CVE-2017-14637 to the list

Comment 3 Larry the Git Cow gentoo-dev

2020-10-04 17:09:30 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=173810552f074b83f9d0bdee1e50e5691904b9d9

commit 173810552f074b83f9d0bdee1e50e5691904b9d9
Author:     John Helmert III <jchelmert3@posteo.net>
AuthorDate: 2020-10-04 17:09:13 +0000
Commit:     David Seifert <soap@gentoo.org>
CommitDate: 2020-10-04 17:09:13 +0000

    media-gfx/sam2p: Security bump
    
    Bug: https://bugs.gentoo.org/631636
    Bug: https://bugs.gentoo.org/636876
    Bug: https://bugs.gentoo.org/649750
    Package-Manager: Portage-2.3.101, Repoman-2.3.22
    Signed-off-by: John Helmert III <jchelmert3@posteo.net>
    Closes: https://github.com/gentoo/gentoo/pull/16286
    Signed-off-by: David Seifert <soap@gentoo.org>

 media-gfx/sam2p/Manifest                          |  1 +
 media-gfx/sam2p/files/sam2p-configure-strip.patch | 30 +++++++++++
 media-gfx/sam2p/sam2p-0.49.4_p20190718.ebuild     | 62 +++++++++++++++++++++++
 3 files changed, 93 insertions(+)

Comment 4 John Helmert III archtester

2021-01-06 21:19:02 UTC

noglsa following suit with dependency.