Bug 662158 (CVE-2018-9240)

Summary:	<media-sound/ncmpc-0.31: NULL pointer deference vulnerability (CVE-2018-9240)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	sound
Priority:	Normal	Flags:	stable-bot: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://raw.githubusercontent.com/MusicPlayerDaemon/ncmpc/v0.31/NEWS
Whiteboard:	B3 [noglsa cve]
Package list:	media-sound/ncmpc-0.31	Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2018-07-26 06:57:48 UTC

CVE-2018-9240 (https://nvd.nist.gov/vuln/detail/CVE-2018-9240):
  ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user
  uses the chat screen and another client sends a long chat message, a crash
  and denial of service could occur.


@Maintainers debian has marked version 0.24 as vulnerable, please confirm if we are affected too. 

Thank you

Comment 1 Jeroen Roovers (RETIRED) gentoo-dev

2018-09-20 05:26:14 UTC

ncmpc 0.30 - (2018-04-04)
...
* fix crash bug in chat screen

Comment 2 Mikle Kolyada (RETIRED) archtester

2018-09-20 06:53:57 UTC

I bumped it to 0.31 yesterday, lets proceed with this one.

Comment 3 Mikle Kolyada (RETIRED) archtester

2018-09-21 10:36:02 UTC

I've handled everything.