Bug 1415619 (CVE-2017-5522)

Summary: CVE-2017-5522 mapserver: Stack-buffer overflow with specific WFS get feature requests
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED UPSTREAM QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: cristian.balint, devrim, jujens, oliver, pavel.lisy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: mapserver 6.0.6, mapserver 6.2.4, mapserver 6.4.5, mapserver 7.0.4 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:05:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1415621, 1415620    
Bug Blocks:    

Description Andrej Nemec 2017-01-23 09:30:01 UTC
A stack-buffer overflow vulnerability was found in mapserver. This might allow for remote code execution in specific circumstances.

References:

https://lists.osgeo.org/pipermail/mapserver-dev/2017-January/015007.html
http://mapserver.org/#recent-announcements

Comment 1 Andrej Nemec 2017-01-23 09:30:44 UTC
Created mapserver tracking bugs for this issue:

Affects: fedora-all [bug 1415620]
Affects: epel-6 [bug 1415621]

Comment 2 Product Security DevOps Team 2019-06-08 03:05:51 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.