Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 585268 (CVE-2016-4456, GNUTLS-SA-2016-1) - =net-libs/gnutls-3.4.12: insecure getenv() on GNUTLS_KEYLOGFILE
Summary: =net-libs/gnutls-3.4.12: insecure getenv() on GNUTLS_KEYLOGFILE
Status: RESOLVED FIXED
Alias: CVE-2016-4456, GNUTLS-SA-2016-1
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://gnutls.org/security.html#GNUTL...
Whiteboard: ̃~2 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-06-07 10:23 UTC by Kristian Fiskerstrand
Modified: 2016-06-11 12:00 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand gentoo-dev Security 2016-06-07 10:23:06 UTC
Tag	Other identifiers	Severity	Information
GNUTLS-SA-2016-1
	- 	File overwrite by setuid programs 	Setuid programs using GnuTLS 3.4.12 could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 and fixed in GnuTLS 3.4.13. Recommendation: Upgrade to GnuTLS 3.4.13, or later versions.
Comment 1 Alon Bar-Lev gentoo-dev 2016-06-11 04:34:46 UTC
Already in tree, let's wait for a few days as build changes are not trivial.
Comment 2 Kristian Fiskerstrand gentoo-dev Security 2016-06-11 11:42:28 UTC
(In reply to Alon Bar-Lev from comment #1)
> Already in tree, let's wait for a few days as build changes are not trivial.

Thanks, since this does not affect stable, once affected version (3.4.12) is removed from tree you can close the bug.
Comment 3 Alon Bar-Lev gentoo-dev 2016-06-11 11:53:43 UTC
OK, I cleaned up all unstable packages.