Bug 1570185 (CVE-2018-10111)
Summary: | CVE-2018-10111 gegl: unbounded memory allocation in render_rectangle function in process/gegl-processor.c | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | dakingun, jridky, nphilipp |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2021-10-21 20:02:15 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1570186, 1570187, 1570189, 1609099, 1609100 | ||
Bug Blocks: | 1570194 |
Description
Laura Pardo
2018-04-20 20:27:41 UTC
Created gegl tracking bugs for this issue: Affects: fedora-all [bug 1570186] Created gegl03 tracking bugs for this issue: Affects: fedora-all [bug 1609100] As an upstream contributor to GEGL, and a downstream Fedora packager, I am surprised that this managed to bubble all the way up to becoming a CVE! As far as I can make out, this was originally filed as https://bugzilla.gnome.org/show_bug.cgi?id=795249, which got migrated to https://gitlab.gnome.org/GNOME/gegl/issues/65 Note the complete lack of response from the reporter after the initial submission. Anyway, I have added a comment to the Gitlab issue that should clarify the situation a bit more. In short, this is a known problem that's being worked on. It's not possible to fix it with a small localized fix that can be carried downstream. |