Bug 303021

Summary: CVE-2007-4033 Buffer overflow in t1lib triggerable by long filename string
Product: [Fedora] Fedora Reporter: Lubomir Kundrak <lkundrak>
Component: t1libAssignee: José Matos <jamatos>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: 7CC: roozbeh
Target Milestone: ---Keywords: EasyFix, Patch, Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.bugtraq.ir/adv/t1lib.txt
Whiteboard: impact=none?
Fixed In Version: t1lib-5.1.1-3.fc8 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-09-27 16:18:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 352271    

Description Lubomir Kundrak 2007-09-24 13:47:37 UTC
Description of problem:

Please see [1] and [2] for more information, [3] contains the patch.
[1] http://www.bugtraq.ir/adv/t1lib.txt
[2] http://secunia.com/advisories/26241/
[3] http://bugs.gentoo.org/show_bug.cgi?id=193437

Additional info:

This is most likely not exploitable on Fedora, due to FORTIFY_SOURCE protection,
as the overflow is strcat() call which is protected.

According to the Gentoo bug, the CVE identifier for this was requested.

Comment 1 Tomas Hoger 2007-09-27 12:15:15 UTC
CVE name is CVE-2007-4033, which was originally described as php_gd2
vulnerability.  Description on CVE site is already updated.

Comment 2 José Matos 2007-09-27 15:01:49 UTC
I read it here as well
http://lwn.net/Articles/250737/

I am applying the fix and rebuilding for FC-6, F-7 and F-8.

Comment 3 José Matos 2007-09-27 16:18:33 UTC
Build finished for F-7 and F-8. I will issue the build for FC-6 later (due to 
problems with plague and the local firewall).


Comment 4 Fedora Update System 2007-09-28 21:21:44 UTC
t1lib-5.1.1-3.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.