Bug 913880 (CVE-2023-36328)

Summary:	<dev-libs/libtommath-1.2.1: Integer overflow
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	sam
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://github.com/libtom/libtommath/pull/546
Whiteboard:	B3 [cleanup glsa?]
Package list:		Runtime testing required:	---
Bug Depends on:	915352
Bug Blocks:

Description Sam James archtester

2023-09-09 04:59:07 UTC

Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS).

Comment 1 Larry the Git Cow gentoo-dev

2023-09-09 05:03:46 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9e4b7c3ada9725aa4cf21c16d6fac8fa985e4b2f

commit 9e4b7c3ada9725aa4cf21c16d6fac8fa985e4b2f
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-09-09 04:57:54 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-09-09 04:59:22 +0000

    dev-libs/libtommath: add 1.2.1
    
    Bug: https://bugs.gentoo.org/913880
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-libs/libtommath/Manifest                |  1 +
 dev-libs/libtommath/libtommath-1.2.1.ebuild | 96 +++++++++++++++++++++++++++++
 2 files changed, 97 insertions(+)