oss-security - Tcsh: Out-of-bounds read in c

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <b002dfc4-7395-1991-2c14-995fa46dc930@redhat.com>
Date: Tue, 6 Dec 2016 14:51:26 +0100
From: Andrej Nemec <anemec@...hat.com>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Cc: dkaspar@...hat.com
Subject: Tcsh: Out-of-bounds read in c_substitute()

Hello folks,

We were made aware of an out-of-bounds read issue that was reported to
Tcsh upstream and fixed. This issue could result in a crash after
starting tcsh and hitting TAB on some systems.

Right now, the issue is contained in Fedora/RHEL, because we're using
glibc's sysmalloc (not the builtin malloc), which masks the issue.
Fedora maintainer decided to fix this anyway just to be safe. As far as
our systems are concerned we don't consider this a security issue for
now. I am looking forward to hearing other opinions if anyone is interested.

Bug report:

http://mx.gw.com/pipermail/tcsh-bugs/2016-December/001103.html

Upstream fix:

https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b94596

Best Regards,

-- 
Andrej Nemec, Red Hat Product Security
3701 3214 E472 A9C3 EFBE 8A63 8904 44A1 D57B 6DDA

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.