Bug 724510 – <net-nntp/tin-2.4.5: Multiple vulnerabilities

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2020-05-21 21:08:48 UTC]

From change log (ftp://ftp.tin.org/pub/news/clients/tin/stable/CHANGES) for 2.4.3:
       BUG. possible buffer overflow when prompting for a wildcard search
            pattern in get_search_pattern()
       BUG. possible buffer overflows with long translations
       BUG. pointer arithmetic with possible NULL pointer

[Comment 1 Sam James 2020-05-21 21:09:32 UTC]

This needs  a bump to 2.4.4 ideally (latest version).

Noticed when prodding at bug 724504.

[Comment 2 Larry the Git Cow 2021-01-24 01:48:16 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e0b9b10345bbd1d162bfb3d8a2430b60d3341666

commit e0b9b10345bbd1d162bfb3d8a2430b60d3341666
Author:     John Helmert III <[e-mail]>
AuthorDate: 2021-01-23 05:24:05 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2021-01-24 01:48:02 +0000

    net-nntp/tin: security bump to 2.4.5
    
    Bump to EAPI 7, formatting fixes.
    
    Bug: https://bugs.gentoo.org/724510
    Package-Manager: Portage-3.0.14, Repoman-3.0.2
    Signed-off-by: John Helmert III <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/19166
    Signed-off-by: Sam James <[e-mail]>

 net-nntp/tin/Manifest         |  1 +
 net-nntp/tin/tin-2.4.5.ebuild | 73 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 74 insertions(+)

[Comment 3 Sam James 2021-01-28 17:47:12 UTC]

arm done

[Comment 4 Sam James 2021-01-30 10:02:58 UTC]

amd64 done

[Comment 5 Sam James 2021-01-30 10:04:15 UTC]

ppc done

[Comment 6 Sam James 2021-02-01 04:42:54 UTC]

x86 done

all arches done

[Comment 7 Sam James 2021-02-01 04:48:02 UTC]

Please cleanup.

[Comment 8 Larry the Git Cow 2021-02-22 03:24:26 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=56f43fc3fec4f9f6916d4ae11487299b9cbe96c2

commit 56f43fc3fec4f9f6916d4ae11487299b9cbe96c2
Author:     John Helmert III <[e-mail]>
AuthorDate: 2021-02-22 03:22:56 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2021-02-22 03:24:00 +0000

    net-nntp/tin: security cleanup (drop <2.4.5)
    
    Bug: https://bugs.gentoo.org/724510
    Package-Manager: Portage-3.0.14, Repoman-3.0.2
    Signed-off-by: John Helmert III <[e-mail]>

 net-nntp/tin/Manifest         |  1 -
 net-nntp/tin/tin-2.4.2.ebuild | 77 -------------------------------------------
 2 files changed, 78 deletions(-)

[Comment 9 Thomas Deutschmann (RETIRED) 2021-06-02 11:48:04 UTC]

Nothing to report for us.

Repository is clean, all done!