[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <200903170017.58197.rbu@gentoo.org>
Date: Tue, 17 Mar 2009 00:17:50 +0100
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Cc: Will Drewry <redpig@...rt.org>,
cve@...too.org
Subject: Re: [oCERT-2008-015] glib and glib-predecessor heap overflows
On Thursday 12 March 2009, Will Drewry wrote:
> #2008-015 glib and glib-predecessors heap overflows
>
> Description:
>
> Base64 encoding and decoding functions in glib suffer from
> vulnerabilities during memory allocation which may result in
> arbitrary code execution when processing large strings. A number of
> other GNOME-related applications which predate glib are vulnerable
> due to the commonality of this flawed code.
...
> (older versions affected only)
> libsoup < 2.2.x
> libsoup < 2.24
> evolution-data-server < 2.24.5
Evolution Data Server is not affected since version 2.21.1, as it uses
GLib's base64 functions. Obviously, using a vulnerable GLib with a
current Evolution Data Server still presents a vulnerable setup --
however the advisory and CVE entry should not reflect that as a
vulnerability in Evolution Data Server 2.21.1 to 2.24.5.
References to changelog entries are in our bug report:
https://bugs.gentoo.org/show_bug.cgi?id=262555
Robert
Download attachment "signature.asc " of type "application/pgp-signature" (836 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
