Bug 905308 (CVE-2023-0341)

Summary:	<app-text/editorconfig-core-c-0.12.6: arbitrary stack write
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	zmedico
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://litios.github.io/2023/01/14/CVE-2023-0341.html
Whiteboard:	B2 [glsa+]
Package list:		Runtime testing required:	---
Bug Depends on:	907644
Bug Blocks:

Description John Helmert III archtester

2023-04-29 18:23:29 UTC

CVE-2023-0341 (https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e):

A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.

URL is 404, but patch is above. Please bump to 0.12.6.

Comment 1 Larry the Git Cow gentoo-dev

2023-04-30 07:03:31 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc3eedc2af4a8481630f374e1542699ae1235e92

commit bc3eedc2af4a8481630f374e1542699ae1235e92
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-04-30 07:02:33 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-04-30 07:03:19 +0000

    app-text/editorconfig-core-c: add 0.12.6
    
    Bug: https://bugs.gentoo.org/905308
    Signed-off-by: Sam James <sam@gentoo.org>

 app-text/editorconfig-core-c/Manifest              |  1 +
 .../editorconfig-core-c-0.12.6.ebuild              | 51 ++++++++++++++++++++++
 2 files changed, 52 insertions(+)

Comment 2 Hans de Graaff gentoo-dev

2024-04-05 09:21:11 UTC

commit 0fe4d955423d5499061f7d52ce90ab13d4d05b12
Author: Zac Medico <zmedico@gentoo.org>
Date:   Sat Mar 2 15:33:34 2024 -0800

    app-text/editorconfig-core-c: drop 0.12.5

Comment 3 Larry the Git Cow gentoo-dev

2024-11-06 13:46:05 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=014147910c929fd96062a85f21100b2f7c778424

commit 014147910c929fd96062a85f21100b2f7c778424
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-11-06 13:45:42 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-11-06 13:46:04 +0000

    [ GLSA 202411-04 ] EditorConfig core C library: arbitrary stack write
    
    Bug: https://bugs.gentoo.org/905308
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202411-04.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)