Bug 877605 (CVE-2022-0699)

Summary:	sci-libs/shapelib: double free
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	normal	CC:	sci-geosciences
Priority:	Normal	Keywords:	PullRequest
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/OSGeo/shapelib/issues/39
See Also:	https://github.com/gentoo/gentoo/pull/36367
Whiteboard:	B2 [upstream/ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-10-19 02:06:32 UTC

CVE-2022-0699:

A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.

Patch: https://github.com/OSGeo/shapelib/commit/c75b9281a5b9452d92e1682bdfe6019a13ed819f

Comment 1 Hans de Graaff gentoo-dev

2023-10-17 15:37:43 UTC

Ping. Any reason we cannot apply the patch mentioned in the comment?