Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 664328 (CVE-2018-14447) - dev-libs/confuse: Out-of-bounds read in src/lexer.l:trim_whitespace() (CVE-2018-14447)
Summary: dev-libs/confuse: Out-of-bounds read in src/lexer.l:trim_whitespace() (CVE-20...
Status: RESOLVED FIXED
Alias: CVE-2018-14447
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/martinh/libconfuse...
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2018-08-22 23:18 UTC by GLSAMaker/CVETool Bot
Modified: 2019-02-04 13:25 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2018-08-22 23:18:47 UTC 
CVE-2018-14447 (https://nvd.nist.gov/vuln/detail/CVE-2018-14447):
  trim_whitespace in lexer.l in libConfuse v3.2.1 has an out-of-bounds read.
Comment 1 Larry the Git Cow gentoo-dev 2018-11-26 10:18:04 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4c2385e6d6f176d0dc4a2d91b5a36ea883b89f3f

commit 4c2385e6d6f176d0dc4a2d91b5a36ea883b89f3f
Author:     Jeroen Roovers <jer@gentoo.org>
AuthorDate: 2018-11-26 10:17:07 +0000
Commit:     Jeroen Roovers <jer@gentoo.org>
CommitDate: 2018-11-26 10:17:58 +0000

    dev-libs/confuse: Version 3.2.2
    
    Package-Manager: Portage-2.3.52, Repoman-2.3.12
    Bug: https://bugs.gentoo.org/664328
    Signed-off-by: Jeroen Roovers <jer@gentoo.org>

 dev-libs/confuse/Manifest             |  1 +
 dev-libs/confuse/confuse-3.2.2.ebuild | 53 +++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2018-11-26 10:19:55 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=200ea45a05f7777a7bf4538426157d5f5a4e4115

commit 200ea45a05f7777a7bf4538426157d5f5a4e4115
Author:     Jeroen Roovers <jer@gentoo.org>
AuthorDate: 2018-11-26 10:19:28 +0000
Commit:     Jeroen Roovers <jer@gentoo.org>
CommitDate: 2018-11-26 10:19:51 +0000

    dev-libs/confuse: Old
    
    Package-Manager: Portage-2.3.52, Repoman-2.3.12
    Bug: https://bugs.gentoo.org/664328
    Signed-off-by: Jeroen Roovers <jer@gentoo.org>

 dev-libs/confuse/Manifest             |  1 -
 dev-libs/confuse/confuse-3.2.1.ebuild | 50 -----------------------------------
 2 files changed, 51 deletions(-)
Comment 3 Jeroen Roovers (RETIRED) gentoo-dev 2018-11-26 11:13:11 UTC 
3.0 is still stable and vulnerable 3.1 <= VERSION < 3.2.2 have left the tree.
Comment 4 Sergey Popov gentoo-dev 2019-02-04 13:25:15 UTC 
Vulnerable versions was never in stable

Closing this as fixed, thanks guys