Bug 213820 – app-arch/bzip2 <1.0.5 CERT-FI: 20469 Buffer overread (CVE-2008-1372)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Hanno Böck 2008-03-18 12:30:45 UTC]

CERT-FI did a fuzzing tool test and discovered issues in various archiving tools.

bzip2 is vulnerable, fixed in 1.0.5. This code is probably bundled in some other packages.

[Comment 1 SpanKY 2008-03-18 13:38:19 UTC]

ive added 1.0.5 to the tree ... now if only they didnt screw up the packaging of it ...

[Comment 2 Robert Buchholz (RETIRED) 2008-03-18 13:47:14 UTC]

Arches, please test and mark stable:
=app-arch/bzip2-1.0.5
Target keywords : "alpha amd64 arm hppa ia64 m68k mips ppc ppc64 release s390 sh sparc x86"

[Comment 3 Robert Buchholz (RETIRED) 2008-03-18 14:16:44 UTC]

Created attachment 146488 [details, diff]
bzip2-CERT-FI-20469.patch

Just for reference, the patch.

[Comment 4 Ferris McCormick (RETIRED) 2008-03-18 16:31:22 UTC]

Sparc stable.  All tests pass, it works on my files, and portage can use it.

[Comment 5 Jeroen Roovers (RETIRED) 2008-03-18 17:17:26 UTC]

(In reply to comment #4)
> Sparc stable.  All tests pass, it works on my files, and portage can use it.

That's odd. Ferris forgot to mark the ebuild. So er, stable for HPPA and SPARC then. :)

[Comment 6 Tobias Scherbaum (RETIRED) 2008-03-18 18:28:17 UTC]

ppc stable

[Comment 7 Raúl Porcel (RETIRED) 2008-03-18 18:30:32 UTC]

alpha/ia64/x86 stable

[Comment 8 Steve Dibb (RETIRED) 2008-03-19 00:34:46 UTC]

amd64 stable

[Comment 9 Ryan Hill (RETIRED) 2008-03-19 01:58:29 UTC]

there's no need to cc mips on security stabilization bugs.  we're ~arch only.

[Comment 10 Markus Rothe (RETIRED) 2008-03-19 19:00:37 UTC]

ppc64 stable

[Comment 11 Peter Volkov (RETIRED) 2008-03-19 20:53:31 UTC]

Fixed in release snapshot.

[Comment 12 Robert Buchholz (RETIRED) 2008-03-21 02:17:53 UTC]

request filed

[Comment 13 Pierre-Yves Rofes (RETIRED) 2008-04-02 21:31:43 UTC]

GLSA 200804-02