Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 915500 (CVE-2023-43641) - <media-libs/libcue-2.2.1-r1: overflow leading to code execution
Summary: <media-libs/libcue-2.2.1-r1: overflow leading to code execution
Status: RESOLVED FIXED
Alias: CVE-2023-43641
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal critical (vote)
Assignee: Gentoo Security
URL: https://github.blog/2023-10-09-coordi...
Whiteboard: B1 [glsa+]
Keywords:
Depends on: 915507
Blocks:
  Show dependency tree
 
Reported: 2023-10-09 19:54 UTC by Sam James
Modified: 2023-10-28 04:01 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Larry the Git Cow gentoo-dev 2023-10-09 20:00:11 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bc96ef44f74ca888b006e06cc4b0aad99ac6530d

commit bc96ef44f74ca888b006e06cc4b0aad99ac6530d
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2023-10-09 19:59:34 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2023-10-09 19:59:34 +0000

    media-libs/libcue: fix CVE-2023-43641
    
    Bug: https://bugs.gentoo.org/915500
    Signed-off-by: Mart Raudsepp <leio@gentoo.org>

 media-libs/libcue/files/CVE-2023-43641.patch | 15 +++++++++++++++
 media-libs/libcue/libcue-2.2.1-r1.ebuild     | 24 ++++++++++++++++++++++++
 2 files changed, 39 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2023-10-10 06:14:11 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a3669b4bdf46773bb95ad9e15fad8bda3525a467

commit a3669b4bdf46773bb95ad9e15fad8bda3525a467
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-10-10 06:13:46 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-10-10 06:14:08 +0000

    [ GLSA 202310-10 ] libcue: Arbitrary Code Execution
    
    Bug: https://bugs.gentoo.org/915500
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202310-10.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)
Comment 3 Larry the Git Cow gentoo-dev 2023-10-10 21:39:51 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6065e11cdb9f0ac4b32187f2b0c4b91f33b762a9

commit 6065e11cdb9f0ac4b32187f2b0c4b91f33b762a9
Author:     Mart Raudsepp <leio@gentoo.org>
AuthorDate: 2023-10-10 21:39:14 +0000
Commit:     Mart Raudsepp <leio@gentoo.org>
CommitDate: 2023-10-10 21:39:35 +0000

    media-libs/libcue: drop 2.2.1
    
    Bug: https://bugs.gentoo.org/915500
    Signed-off-by: Mart Raudsepp <leio@gentoo.org>

 media-libs/libcue/libcue-2.2.1.ebuild | 20 --------------------
 1 file changed, 20 deletions(-)