833426 – (CVE-2022-23803, CVE-2022-23804, CVE-2022-23946, CVE-2022-23947) <sci-electronics/kicad-6.0.2: multiple vulnerabilities

Bug 833426 (CVE-2022-23803, CVE-2022-23804, CVE-2022-23946, CVE-2022-23947) - <sci-electronics/kicad-6.0.2: multiple vulnerabilities

Summary: <sci-electronics/kicad-6.0.2: multiple vulnerabilities

Status:	RESOLVED FIXED

Alias:	CVE-2022-23803, CVE-2022-23804, CVE-2022-23946, CVE-2022-23947

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal trivial (vote)
Assignee:	Gentoo Security

URL:	https://www.kicad.org/blog/2022/02/Ki...
Whiteboard:	~2 [noglsa]
Keywords:	PullRequest

Depends on:
Blocks:

Reported:	2022-02-15 19:02 UTC by jon R-B
Modified:	2022-02-19 17:15 UTC (History)
CC List:	2 users (show)

See Also:	https://github.com/gentoo/gentoo/pull/24268
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description jon R-B 2022-02-15 19:02:16 UTC

CVE-2022-23946 <= KiCad 6.0.1 Stack-based buffer overflow in GCodeNumber parsing
CVE-2022-23947 <= KiCad 6.0.1 Stack-based buffer overflow in DCodeNumber parsing
CVE-2022-23803 <= KiCad 6.0.1 Stack-based buffer overflow in ReadXYCoord
CVE-2022-23804 <= KiCad 6.0.1 Stack-based buffer overflow in ReadIJCoord

Reproducible: Always

Comment 1 John Helmert III archtester

2022-02-15 22:32:21 UTC

Thanks for reporting! Maintainer, please bump.

Comment 2 Zoltan Puskas 2022-02-19 02:17:16 UTC

KiCad 6.0.2 is in the tree which has replaced 6.0.1. However we still have KiCad
5.1.12 in the tree becasue it's needed by some industrial users since 6 series is
not backward compatible with 5 series, and people need some time for migration.

What is the recommendation for such cases when we have to keep an older version
in the tree for a while longer?

Comment 3 John Helmert III archtester

2022-02-19 02:41:02 UTC

In this case, simply masking the old version can be appropriate.

Comment 4 Larry the Git Cow gentoo-dev

2022-02-19 17:14:37 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fcf5b32f1c2ab571e4918ba97091eb0beb58f831

commit fcf5b32f1c2ab571e4918ba97091eb0beb58f831
Author:     Zoltan Puskas <zoltan@sinustrom.info>
AuthorDate: 2022-02-19 03:55:37 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-02-19 17:14:15 +0000

    sci-electronics/kicad.*: Mask vulnerable versions
    
    Signed-off-by: Zoltan Puskas <zoltan@sinustrom.info>
    Bug: https://bugs.gentoo.org/833426
    Closes: https://github.com/gentoo/gentoo/pull/24268
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 profiles/package.mask | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

Comment 5 John Helmert III archtester

2022-02-19 17:15:58 UTC

Thanks! All done.

Please note that the Bug: tag should be used for security bugs, rather than Closes:.