Summary: | media-gfx/sam2p: Multiple DoS vulnerabilities | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | GLSAMaker/CVETool Bot <glsamaker> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | ajak, tex |
Priority: | Normal | Keywords: | PullRequest |
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
See Also: | https://github.com/gentoo/gentoo/pull/16286 | ||
Whiteboard: | B3 [noglsa cve] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | 636876 | ||
Bug Blocks: |
Description
GLSAMaker/CVETool Bot
2018-03-06 15:18:16 UTC
(In reply to GLSAMaker/CVETool Bot from comment #0) > CVE-2018-7553 (https://nvd.nist.gov/vuln/detail/CVE-2018-7553): > There is a heap-based buffer overflow in the pcxLoadRaster function of > in_pcx.cpp in sam2p 0.49.4. A crafted input will lead to a denial of > service > or possibly unspecified other impact. Fixed in https://github.com/pts/sam2p/commit/2ca32ec848fd97074367bc26b239fa25bbf0e720 > CVE-2018-7552 (https://nvd.nist.gov/vuln/detail/CVE-2018-7552): > There is an invalid free in Mapping::DoubleHash::clear in mapping.cpp that > leads to a Segmentation fault in sam2p 0.49.4. A crafted input will lead to > a denial of service or possibly unspecified other impact. Fixed in https://github.com/pts/sam2p/commit/4aa27783d1e95fb0d65144a8a8f91104d1bdbe58 > CVE-2018-7487 (https://nvd.nist.gov/vuln/detail/CVE-2018-7487): > There is a heap-based buffer overflow in the LoadPCX function of in_pcx.cpp > in sam2p 0.49.4. A Crafted input will lead to a denial of service or > possibly unspecified other impact. Fixed in https://github.com/pts/sam2p/commit/22bb39092ac904e4951780930d7c5f2703c5accc > CVE-2018-7554 (https://nvd.nist.gov/vuln/detail/CVE-2018-7554): > There is an invalid free in ReadImage in input-bmp.ci that leads to a > Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial > of > service or possibly unspecified other impact. > Maintainer couldn't reproduce, issue closed: https://github.com/pts/sam2p/issues/29 > CVE-2018-7551 (https://nvd.nist.gov/vuln/detail/CVE-2018-7551): > There is an invalid free in MiniPS::delete0 in minips.cpp that leads to a > Segmentation fault in sam2p 0.49.4. A crafted input will lead to a denial > of service or possibly unspecified other impact. Maintainer couldn't reproduce, issue closed: https://github.com/pts/sam2p/issues/28#issuecomment-422041534 The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=173810552f074b83f9d0bdee1e50e5691904b9d9 commit 173810552f074b83f9d0bdee1e50e5691904b9d9 Author: John Helmert III <jchelmert3@posteo.net> AuthorDate: 2020-10-04 17:09:13 +0000 Commit: David Seifert <soap@gentoo.org> CommitDate: 2020-10-04 17:09:13 +0000 media-gfx/sam2p: Security bump Bug: https://bugs.gentoo.org/631636 Bug: https://bugs.gentoo.org/636876 Bug: https://bugs.gentoo.org/649750 Package-Manager: Portage-2.3.101, Repoman-2.3.22 Signed-off-by: John Helmert III <jchelmert3@posteo.net> Closes: https://github.com/gentoo/gentoo/pull/16286 Signed-off-by: David Seifert <soap@gentoo.org> media-gfx/sam2p/Manifest | 1 + media-gfx/sam2p/files/sam2p-configure-strip.patch | 30 +++++++++++ media-gfx/sam2p/sam2p-0.49.4_p20190718.ebuild | 62 +++++++++++++++++++++++ 3 files changed, 93 insertions(+) |