Bug 1545501

Summary: milkytracker: Multiple flaws in module loaders potentially leading to remote code execution
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED UPSTREAM QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: muep
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-12 13:05:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1545502    
Bug Blocks:    

Description Sam Fowler 2018-02-15 05:13:23 UTC
MilkyTracker through version 1.01 is vulnerable to multiple issues in various module loaders that could potentially lead to remote code execution.

Upstream Issue:

https://github.com/milkytracker/MilkyTracker/issues/35

Upstream Patch:

https://github.com/milkytracker/MilkyTracker/commit/6f7922616f31e5ceddd6f346cfc7f5d61a2f7683

Comment 1 Sam Fowler 2018-02-15 05:14:17 UTC
Created milkytracker tracking bugs for this issue:

Affects: fedora-all [bug 1545502]

Comment 2 Joonas Sarajärvi 2018-02-17 13:33:47 UTC
This should now be fixed in git for f26, f27 and master.

Updates for F26 and F27 are at 
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2331a462fb
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7d90e269a4

In the RPM package changelog I accidentally had inserted an incorrect upstream issue number (15 instead of 35). When I noticed this the packages were already pushed and built.

Comment 3 Fedora Update System 2018-02-25 20:52:03 UTC
milkytracker-1.01.00-1.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Product Security DevOps Team 2019-07-12 13:05:05 UTC
ARRAY(0x558ebdb04e08)