Bug 1162166 (CVE-2014-8625)

Summary:	CVE-2014-8625 dpkg: format string vulnerability
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	andrew, sergio, vanmeeuwen+fedora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-05-14 11:29:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1162168, 1162169
Bug Blocks:

Description Vasyl Kaigorodov 2014-11-10 12:17:49 UTC

It was reported [1] that dpkg have a format string vulnerability.
When building a .deb file using dpkg-deb --build, if the 'control' file inside DEBIAN/ has a % in it, it will segfault.
Example of control file and GDB backtrace is available at [1] as well.

[1]: https://bugs.launchpad.net/ubuntu/+source/dpkg/+bug/1389135

Comment 1 Vasyl Kaigorodov 2014-11-10 12:18:12 UTC

Created dpkg tracking bugs for this issue:

Affects: fedora-all [bug 1162168]
Affects: epel-all [bug 1162169]

Comment 2 Martin Prpič 2014-11-11 13:37:17 UTC

Note that a second, similar issue was reported to Debian:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769111

Comment 3 Sergio Basto 2014-12-03 21:30:08 UTC

http://anonscm.debian.org/cgit/dpkg/dpkg.git/log/?h=wheezy 

we still  haven't any fix for wheezy .

I found commit here : 
http://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/?id=446f11df6302716c2a1f993761ee54ecb44d42bb

says: "Regression introduced in dpkg 1.16.0. Fixes CVE-2014-8625. Closes: #768485"

Should I wait a little more ?

Comment 4 Fedora Update System 2015-05-08 07:45:06 UTC

dpkg-1.16.16-5.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-05-12 20:48:21 UTC

dpkg-1.16.16-5.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-05-12 20:49:28 UTC

dpkg-1.16.16-5.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-05-14 06:29:22 UTC

dpkg-1.16.16-5.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2015-05-14 06:30:10 UTC

dpkg-1.16.16-5.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Sergio Basto 2015-05-14 11:29:39 UTC

I couldn't build dpkg for el5 because 

DEBUG util.py:388:  Error: No Package found for po4a [1]


[1] https://kojipkgs.fedoraproject.org//work/tasks/5213/9525213/root.log