Bug 760714 – <media-video/motion-4.3.2: segmentation fault via crafted HTTP request (CVE-2020-26566)

• Status: CONFIRMED
• Product: Gentoo Security

[Description John Helmert III 2020-12-19 09:04:16 UTC]

CVE-2020-26566 (https://github.com/Motion-Project/motion/issues/1227):

A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.


Maintainers, please let us know when ready to stable.

[Comment 1 Johannes Willem (Hans) Fernhout 2020-12-29 09:54:57 UTC]

The differences between 4.3.2 and 4.3.1 are only two bug fixes, including a fix for this CVE.

Suggest to stabilize 4.3.2, and mask 4.3.1.

[Comment 2 Sam James 2020-12-31 04:13:14 UTC]

(In reply to Johannes Willem (Hans) Fernhout from comment #1)
> The differences between 4.3.2 and 4.3.1 are only two bug fixes, including a
> fix for this CVE.
> 
> Suggest to stabilize 4.3.2, and mask 4.3.1.

Thanks!

[Comment 3 Sam James 2021-01-01 23:00:19 UTC]

amd64 done

[Comment 4 Sam James 2021-01-04 09:32:14 UTC]

x86 done

all arches done

[Comment 5 Sam James 2021-01-04 09:33:15 UTC]

Please cleanup, thanks!