841881 – (CVE-2022-1507) <media-gfx/chafa-1.10.2: null pointer dereference

Bug 841881 (CVE-2022-1507) - <media-gfx/chafa-1.10.2: null pointer dereference

Summary: <media-gfx/chafa-1.10.2: null pointer dereference

Status:	IN_PROGRESS

Alias:	CVE-2022-1507

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor
Assignee:	Gentoo Security

URL:	https://huntr.dev/bounties/104d8c5d-c...
Whiteboard:	B3 [glsa?]
Keywords:

Depends on:	842429
Blocks:
	Show dependency tree

Reported:	2022-04-30 21:49 UTC by John Helmert III
Modified:	2022-05-10 15:51 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-04-30 21:49:01 UTC

CVE-2022-1507 (https://github.com/hpjansson/chafa/commit/e4b777c7b7c144cd16a0ea96108267b1004fe6c9):

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.

Please stabilize 1.10.2.

Comment 1 Larry the Git Cow gentoo-dev

2022-05-05 09:50:49 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=30b1bd64f799dc229c78cee52ea486e4b2ff6e23

commit 30b1bd64f799dc229c78cee52ea486e4b2ff6e23
Author:     Jakov Smolić <jsmolic@gentoo.org>
AuthorDate: 2022-05-05 08:46:05 +0000
Commit:     Jakov Smolić <jsmolic@gentoo.org>
CommitDate: 2022-05-05 09:50:20 +0000

    media-gfx/chafa: drop 1.8.0
    
    Bug: https://bugs.gentoo.org/841881
    Signed-off-by: Jakov Smolić <jsmolic@gentoo.org>

 media-gfx/chafa/Manifest           |  1 -
 media-gfx/chafa/chafa-1.8.0.ebuild | 36 ------------------------------------
 2 files changed, 37 deletions(-)

Comment 2 John Helmert III archtester

2022-05-10 15:51:14 UTC

Thanks!