Bug 192535

Summary:	CVE-2006-2480: dia format string vulnerability
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <scop>
Component:	dia	Assignee:	Hans de Goede <hdegoede>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5	CC:	extras-qa, fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2480
Whiteboard:
Fixed In Version:	0.95-2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-05-20 12:45:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2006-05-20 09:27:06 UTC

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2480

Reproducer in GNOME Bugzilla, appears to affect 0.95 too:
http://bugzilla.gnome.org/show_bug.cgi?id=342111

The CVE notes that this may not be a vulnerability, but it is a reproducible
crash in any case.

Comment 1 Hans de Goede 2006-05-20 12:45:55 UTC

Fixed using the patch attached to upstream's BZ (after checking / verifying it).
The fix has been imported into CVS, build and pushed for FC-5 and devel.

I assume the Security Response Team will take care of the security announcement?

And yes, this most definetly is a vulnerability. The current example of the
string format vulnerability is rather harmless, but I _think_ it will be
possbile to exploit this by getting people to open malformed files with dia.