Bug 591664 – <x11-misc/slock-1.3-r3 : segmentation fault on invalid password hash

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2016-08-19 08:39:13 UTC]

From ${URL} :

The screen locking application slock (http://tools.suckless.org/slock/)
calls crypt(3) and uses the return value for strcmp(3) without checking
to see if the return value of crypt(3) was a NULL pointer. If the hash
returned by (getspnam()->sp_pwdp) is invalid, crypt(3) will return NULL
and set errno to EINVAL. This will cause slock to segfault which then
leaves the machine unprotected.

References:

http://seclists.org/oss-sec/2016/q3/328
http://s1m0n.dft-labs.eu/files/slock/


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Jeroen Roovers (RETIRED) 2016-08-19 14:49:31 UTC]

Patch applied in =x11-misc/slock-1.3-r3

[Comment 2 Sergey Popov (RETIRED) 2016-08-25 08:53:42 UTC]

Arches, please test and mark stable =x11-misc/slock-1.3-r3

Target keywords: amd64 hppa x86

[Comment 3 Jeroen Roovers (RETIRED) 2016-08-28 08:51:50 UTC]

Stable for HPPA.

[Comment 4 Agostino Sarubbo 2016-09-10 12:49:43 UTC]

amd64 stable

[Comment 5 Jeroen Roovers (RETIRED) 2016-09-11 06:07:50 UTC]

Stable for x86.

[Comment 6 Yury German 2016-09-11 06:23:34 UTC]

Arches and Maintainer(s), Thank you for your work.

GLSA Vote: No
Closing noglsa.