Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 833426 (CVE-2022-23803, CVE-2022-23804, CVE-2022-23946, CVE-2022-23947) - <sci-electronics/kicad-6.0.2: multiple vulnerabilities
Summary: <sci-electronics/kicad-6.0.2: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2022-23803, CVE-2022-23804, CVE-2022-23946, CVE-2022-23947
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial
Assignee: Gentoo Security
URL: https://www.kicad.org/blog/2022/02/Ki...
Whiteboard: ~2 [noglsa]
Keywords: PullRequest
Depends on:
Blocks:
 
Reported: 2022-02-15 19:02 UTC by jon R-B
Modified: 2022-02-19 17:15 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description jon R-B 2022-02-15 19:02:16 UTC
CVE-2022-23946 <= KiCad 6.0.1 Stack-based buffer overflow in GCodeNumber parsing
CVE-2022-23947 <= KiCad 6.0.1 Stack-based buffer overflow in DCodeNumber parsing
CVE-2022-23803 <= KiCad 6.0.1 Stack-based buffer overflow in ReadXYCoord
CVE-2022-23804 <= KiCad 6.0.1 Stack-based buffer overflow in ReadIJCoord

Reproducible: Always
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-15 22:32:21 UTC
Thanks for reporting! Maintainer, please bump.
Comment 2 Zoltan Puskas 2022-02-19 02:17:16 UTC
KiCad 6.0.2 is in the tree which has replaced 6.0.1. However we still have KiCad
5.1.12 in the tree becasue it's needed by some industrial users since 6 series is
not backward compatible with 5 series, and people need some time for migration.

What is the recommendation for such cases when we have to keep an older version
in the tree for a while longer?
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-19 02:41:02 UTC
In this case, simply masking the old version can be appropriate.
Comment 4 Larry the Git Cow gentoo-dev 2022-02-19 17:14:37 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fcf5b32f1c2ab571e4918ba97091eb0beb58f831

commit fcf5b32f1c2ab571e4918ba97091eb0beb58f831
Author:     Zoltan Puskas <zoltan@sinustrom.info>
AuthorDate: 2022-02-19 03:55:37 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-02-19 17:14:15 +0000

    sci-electronics/kicad.*: Mask vulnerable versions
    
    Signed-off-by: Zoltan Puskas <zoltan@sinustrom.info>
    Bug: https://bugs.gentoo.org/833426
    Closes: https://github.com/gentoo/gentoo/pull/24268
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 profiles/package.mask | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
Comment 5 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-19 17:15:58 UTC
Thanks! All done.

Please note that the Bug: tag should be used for security bugs, rather than Closes:.