662158 – (CVE-2018-9240) <media-sound/ncmpc-0.31: NULL pointer deference vulnerability (CVE-2018-9240)

Bug 662158 (CVE-2018-9240) - <media-sound/ncmpc-0.31: NULL pointer deference vulnerability (CVE-2018-9240)

Summary: <media-sound/ncmpc-0.31: NULL pointer deference vulnerability (CVE-2018-9240)

Status:	RESOLVED FIXED

Alias:	CVE-2018-9240

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://raw.githubusercontent.com/Mus...
Whiteboard:	B3 [noglsa cve]
Keywords:

Depends on:
Blocks:

Reported:	2018-07-26 06:57 UTC by GLSAMaker/CVETool Bot
Modified:	2018-09-21 10:36 UTC (History)
CC List:	1 user (show)

See Also:
Package list:	media-sound/ncmpc-0.31
Runtime testing required:	---

Flags:	stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description GLSAMaker/CVETool Bot gentoo-dev

2018-07-26 06:57:48 UTC

CVE-2018-9240 (https://nvd.nist.gov/vuln/detail/CVE-2018-9240):
  ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user
  uses the chat screen and another client sends a long chat message, a crash
  and denial of service could occur.


@Maintainers debian has marked version 0.24 as vulnerable, please confirm if we are affected too. 

Thank you

Comment 1 Jeroen Roovers (RETIRED) gentoo-dev

2018-09-20 05:26:14 UTC

ncmpc 0.30 - (2018-04-04)
...
* fix crash bug in chat screen

Comment 2 Mikle Kolyada (RETIRED) archtester

2018-09-20 06:53:57 UTC

I bumped it to 0.31 yesterday, lets proceed with this one.

Comment 3 Mikle Kolyada (RETIRED) archtester

2018-09-21 10:36:02 UTC

I've handled everything.