Incoming details.
CVE-2017-13089: The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. CVE-2017-13090: The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer.
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c52583a431acfca8fcfc89b3b91dd3078b82b3b3 @ Arches, please test and mark stable: =net-misc/wget-1.19.1-r2 Target keywords: alpha amd64 arm arm64 hppa ia64 m68k ppc ppc64 s390 sh sparc x86
amd64 stable
x86 stable
hppa stable
sparc stable (thanks to Rolf Eike Beer)
ia64 stable
ppc/ppc64 stable
m68k/s390/sh stable
Stable on alpha.
@ Maintainer(s): Stabilization is complete, please clean the vulnerable versions from the tree.
While security coverage doesn't include arm architecture at the moment security team can proceed with GLSA handling. But we cannot cleanup without arm so we have to keep this stable request...
This issue was resolved and addressed in GLSA 201711-06 at https://security.gentoo.org/glsa/201711-06 by GLSA coordinator Aaron Bauman (b-man).
Re-opened for cleanup and final arches.
arm stable
arm64 done and ald revision is gone. Should be fine to close this now.
