Bug 635358 (CVE-2017-10686, CVE-2017-14228)

Summary:	<dev-lang/nasm-2.13.02: Multiple vulnerabilities
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	mr_bones_, slyfox
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B2 [glsa+ cve]
Package list:		Runtime testing required:	---
Bug Depends on:	670884
Bug Blocks:

Description GLSAMaker/CVETool Bot gentoo-dev

2017-10-24 20:11:24 UTC

CVE-2017-14228 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14228):
  In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in
  the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It
  will lead to remote denial of service.

CVE-2017-11111 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-11111):
  In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote attackers to
  cause a denial of service (heap-based buffer overflow and application crash)
  or possibly have unspecified other impact via a crafted file.

CVE-2017-10686 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10686):
  In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free
  vulnerabilities in the tool nasm. The related heap is allocated in the
  token() function and freed in the detoken() function (called by
  pp_getline()) - it is used again at multiple positions later that could
  cause multiple damages. For example, it causes a corrupted double-linked
  list in detoken(), a double free or corruption in delete_Token(), and an
  out-of-bounds write in detoken(). It has a high possibility to lead to a
  remote code execution attack.

Comment 1 Sergei Trofimovich (RETIRED) gentoo-dev

2018-05-10 22:40:06 UTC

(In reply to GLSAMaker/CVETool Bot from comment #0)
> CVE-2017-14228 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14228):
https://bugzilla.nasm.us/show_bug.cgi?id=3392423


> CVE-2017-11111 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-11111):
Dup of https://bugs.gentoo.org/624646

> CVE-2017-10686 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-10686):
https://bugzilla.nasm.us/show_bug.cgi?id=3392414

All 3 were fixed in nasm-2.13.02.

Gentoo got nasm-2.13.03 in https://gitweb.gentoo.org/repo/gentoo.git/commit/dev-lang/nasm?id=5b594e538e38230b85a5f0164d1d8b90d137f81b

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2019-03-28 02:12:34 UTC

This issue was resolved and addressed in
 GLSA 201903-19 at https://security.gentoo.org/glsa/201903-19
by GLSA coordinator Aaron Bauman (b-man).