From $URL : SWI-Prolog upstream has released [2] 6.2.5 / 6.3.7 versions, correcting the following two security flaws: * Issue #1 (from [2]): ======================= * FIXED: Possible buffer overrun in patch canonisation code. Pushes pointers on an automatic array without checking for overflow. Can be used for DoS attacks. Will be extremely hard to make it execute arbitrary code. Relevant upstream patch: [1] http://www.swi-prolog.org/git/pl.git/commitdiff/a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c References: [2] https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html [3] https://bugzilla.redhat.com/show_bug.cgi?id=891577 * Issue #2 - from [2]: ====================== * SECURITY: Possible buffer overflows when expanding file-names with long paths. Affects expand_file_name/2. Can lead to crashes (DoS attacks) and possibly execution of arbitrary code if an attacker can control the names of the files searched for, e.g., if expand_file_name/2 is used in a directory to which an attacker can upload files for which he can control the name. Relevant upstream patch: [4] http://www.swi-prolog.org/git/pl.git/commitdiff/b2c88972e7515ada025e97e7d3ce3e34f81cf33e References: [5] https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html [6] https://bugzilla.redhat.com/show_bug.cgi?id=891577
CVE-2012-6090 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6090): Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename. CVE-2012-6089 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6089): Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.
-6.2.5 and -6.3.7 are both in portage. =dev-lang/swi-prolog-6.2.5 is the version recommended for stabilization.
(In reply to comment #2) > -6.2.5 and -6.3.7 are both in portage. > > =dev-lang/swi-prolog-6.2.5 is the version recommended for stabilization. Thanks, Keri. Arches, please test and mark stable.
amd64 stable
x86 stable
ppc stable
New GLSA request filed.
This issue was resolved and addressed in GLSA 201312-05 at http://security.gentoo.org/glsa/glsa-201312-05.xml by GLSA coordinator Sergey Popov (pinkbyte).