Bug 567254 – <media-libs/libraw-0.17.1: multiple vulnerabilities (CVE-2015-{8366,8367})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2015-12-01 13:39:42 UTC]

From https://bugzilla.redhat.com/show_bug.cgi?id=1287076:

It was found that phase_one_correct function does not handle memory object’s initialization 
correctly, which may have unspecified impact.

Upstream patch:

https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2




From https://bugzilla.redhat.com/show_bug.cgi?id=1287056:

It was found that smal_decode_segment function do not handle index carefully, which may cause index overflow.

Upstream patch:

https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Markus Meier 2015-12-08 18:06:19 UTC]

Version bumped in tree that should fix this security issue. I'd say let's wait for a day or two before stabilizing.

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=959e17fc23e79e2bf93a39524c1c102a07548aa5

[Comment 2 Markus Meier 2016-01-08 18:12:16 UTC]

No reported regressions so far, so I guess it should be okay to stabilize media-libs/libraw-0.17.1

[Comment 3 Thomas Deutschmann (RETIRED) 2016-11-22 13:02:43 UTC]

@ Arches,

please test and mark stable: =media-libs/libraw-0.17.2

[Comment 4 Tobias Klausmann (RETIRED) 2016-11-23 09:21:26 UTC]

Stable on alpha.

[Comment 5 Agostino Sarubbo 2016-11-25 18:29:50 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2016-11-25 18:56:37 UTC]

x86 stable

[Comment 7 Markus Meier 2016-11-29 17:34:43 UTC]

arm stable

[Comment 8 Agostino Sarubbo 2017-01-01 12:47:03 UTC]

ppc stable

[Comment 9 Agostino Sarubbo 2017-01-03 10:40:36 UTC]

ppc64 stable

[Comment 10 Agostino Sarubbo 2017-01-11 10:39:16 UTC]

sparc stable

[Comment 11 Jeroen Roovers (RETIRED) 2017-01-14 12:26:12 UTC]

Stable for HPPA.

[Comment 12 Agostino Sarubbo 2017-01-17 14:27:25 UTC]

ia64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

[Comment 13 Markus Meier 2017-01-17 17:11:46 UTC]

vulnerable versions removed.

[Comment 14 Aaron Bauman (RETIRED) 2017-01-18 08:13:08 UTC]

GLSA request filed.

[Comment 15 GLSAMaker/CVETool Bot 2017-01-24 10:53:53 UTC]

This issue was resolved and addressed in
 GLSA 201701-60 at https://security.gentoo.org/glsa/201701-60
by GLSA coordinator Aaron Bauman (b-man).