From ${URL} : I would like to request a CVE for a buffer overrun bug in CHICKEN Scheme which is very similar to CVE-2013-4385. It affects a very particular, not very common use of the read-u8vector! procedure. If given a buffer and #f (the Scheme value for "false") as the buffer's size (which should trigger automatic size detection but doesn't), it will read beyond the buffer, until the input port (file, socket, etc) is exhausted. This may result in the typical potential remote code execution or denial of service; in CHICKEN, these buffers are initially allocated on the stack and moved to the heap upon GC. In normal usage, users would usually pass in the buffer's size. This is also the workaround for this bug. For the official announcement, see http://lists.gnu.org/archive/html/chicken-announce/2014-05/msg00001.html The patch on the discussion list is http://lists.gnu.org/archive/html/chicken-hackers/2014-05/msg00032.html and it got applied as http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commit;h=1d06ce7e21c7e903ca5dca11fda6fcf2cc52de5e All versions of CHICKEN prior to 4.9.0 (soon to be released) and 4.8.0.7 (not yet(?) released) are affected. @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
CHICKEN 4.9.0 and a possible 4.8.0.7 will include the fix, as will all development snapshots starting with 4.9.1. http://lists.gnu.org/archive/html/chicken-announce/2014-05/msg00001.html
CVE-2014-3776 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3776): Buffer overflow in the "read-u8vector!" procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.
I'm sorry for the long delay on this. I'm preparing an ebuild for the latest CHICKEN release, 4.10.0 which addresses this, and all open dev-scheme/chicken issues.
I have submitted an updated ebuild for the latest version of CHICKEN to bug #467966
This issue was resolved and addressed in GLSA 201612-54 at https://security.gentoo.org/glsa/201612-54 by GLSA coordinator Thomas Deutschmann (whissi).
