Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 567254 (CVE-2015-8366, CVE-2015-8367) - <media-libs/libraw-0.17.1: multiple vulnerabilities (CVE-2015-{8366,8367})
Summary: <media-libs/libraw-0.17.1: multiple vulnerabilities (CVE-2015-{8366,8367})
Alias: CVE-2015-8366, CVE-2015-8367
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa cve]
Depends on:
Blocks: 549338
  Show dependency tree
Reported: 2015-12-01 13:39 UTC by Agostino Sarubbo
Modified: 2017-01-24 10:53 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---
kensington: sanity-check+


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-12-01 13:39:42 UTC

It was found that phase_one_correct function does not handle memory object’s initialization 
correctly, which may have unspecified impact.

Upstream patch:


It was found that smal_decode_segment function do not handle index carefully, which may cause index overflow.

Upstream patch:

@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Markus Meier gentoo-dev 2015-12-08 18:06:19 UTC
Version bumped in tree that should fix this security issue. I'd say let's wait for a day or two before stabilizing.
Comment 2 Markus Meier gentoo-dev 2016-01-08 18:12:16 UTC
No reported regressions so far, so I guess it should be okay to stabilize media-libs/libraw-0.17.1
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-22 13:02:43 UTC
@ Arches,

please test and mark stable: =media-libs/libraw-0.17.2
Comment 4 Tobias Klausmann (RETIRED) gentoo-dev 2016-11-23 09:21:26 UTC
Stable on alpha.
Comment 5 Agostino Sarubbo gentoo-dev 2016-11-25 18:29:50 UTC
amd64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2016-11-25 18:56:37 UTC
x86 stable
Comment 7 Markus Meier gentoo-dev 2016-11-29 17:34:43 UTC
arm stable
Comment 8 Agostino Sarubbo gentoo-dev 2017-01-01 12:47:03 UTC
ppc stable
Comment 9 Agostino Sarubbo gentoo-dev 2017-01-03 10:40:36 UTC
ppc64 stable
Comment 10 Agostino Sarubbo gentoo-dev 2017-01-11 10:39:16 UTC
sparc stable
Comment 11 Jeroen Roovers (RETIRED) gentoo-dev 2017-01-14 12:26:12 UTC
Stable for HPPA.
Comment 12 Agostino Sarubbo gentoo-dev 2017-01-17 14:27:25 UTC
ia64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 13 Markus Meier gentoo-dev 2017-01-17 17:11:46 UTC
vulnerable versions removed.
Comment 14 Aaron Bauman (RETIRED) gentoo-dev 2017-01-18 08:13:08 UTC
GLSA request filed.
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2017-01-24 10:53:53 UTC
This issue was resolved and addressed in
 GLSA 201701-60 at
by GLSA coordinator Aaron Bauman (b-man).