Bug 755848 – <gnome-base/gnome-shell-3.36.7: Denial of service in bundled libcroco (CVE-2020-12825)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2020-11-20 16:52:21 UTC]

As per tracker, the gnome-shell version is more up to date but IIRC has parts of the main (now abandoned) dev-libs/libcroco removed.

See https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1404?commit_id=44cbd1e718d6a08e59b9300280c340218a84e089.

[Comment 1 Sam James 2020-11-20 16:53:34 UTC]

Fixed in 3.36.7. Thanks leio for prodding. Let us know when ready to stable.

[Comment 2 Thomas Deutschmann (RETIRED) 2020-11-21 18:16:05 UTC]

x86 stable

[Comment 3 Sam James 2020-11-22 03:23:47 UTC]

amd64 done

all arches done

[Comment 4 Sam James 2020-11-22 03:32:25 UTC]

Please cleanup, thanks!

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2020-12-04 01:36:53 UTC Comment hidden (obsolete)]

Unable to check for sanity:

> no match for package: x11-wm/mutter-3.36.7

[Comment 6 Matt Turner 2020-12-27 18:53:09 UTC]

Cleaned.

[Comment 7 Thomas Deutschmann (RETIRED) 2021-05-31 21:03:34 UTC]

New GLSA request filed.

[addCollapseLink(8, 1, 'Toggle comment display'); Comment 8 NATTkA bot 2021-07-29 17:25:19 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(9, 1, 'Toggle comment display'); Comment 9 NATTkA bot 2021-07-29 17:33:51 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(10, 1, 'Toggle comment display'); Comment 10 NATTkA bot 2021-07-29 17:41:44 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(11, 1, 'Toggle comment display'); Comment 11 NATTkA bot 2021-07-29 17:49:53 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 12 NATTkA bot 2021-07-29 18:05:47 UTC]

Package list is empty or all packages have requested keywords.

[Comment 13 Larry the Git Cow 2022-08-21 02:09:26 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=2a92e2043bdf43ba9d8813b5b7aca6e24d69f047

commit 2a92e2043bdf43ba9d8813b5b7aca6e24d69f047
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-21 01:34:48 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-08-21 01:40:47 +0000

    [ GLSA 202208-33 ] Gnome Shell, gettext, libcroco: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/722752
    Bug: https://bugs.gentoo.org/755848
    Bug: https://bugs.gentoo.org/769998
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202208-33.xml | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

[Comment 14 John Helmert III 2022-08-21 02:15:02 UTC]

GLSA released, all done!