Bug 427197 (CVE-2007-6613)
| Summary: | CVE-2007-6613 libcdio: long Joliet file name buffer overflow | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Red Hat Product Security <security-response-team> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | adrian |
| Target Milestone: | --- | Keywords: | EasyFix, Patch, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://lists.gnu.org/archive/html/libcdio-devel/2007-12/msg00009.html | ||
| Whiteboard: | |||
| Fixed In Version: | 0.78.2-4.fc7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-05-29 06:55:12 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 427198, 427199, 427200 | ||
| Bug Blocks: | |||
|
Description
Lubomir Kundrak
2008-01-02 08:49:39 UTC
[1] http://lists.gnu.org/archive/html/libcdio-devel/2007-12/msg00009.html [2] http://bugs.gentoo.org/show_bug.cgi?id=203777 Actually, this is not that serious. The applications that use libcdio are not vulnerable, as the problem lies in iso-info program only. libcdio-0.78.2-4.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report. libcdio-0.78.2-4.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report. This issue got CVE name CVE-2007-6613 Robert Buchholz pointed out that original patch has an issue: The original patches are off by two in the size calculation, as they calculate strlen(psz_iso_name+1) instead of strlen(psz_iso_name)+1 This was reported by bannedit. Updates: http://cvs.savannah.gnu.org/viewvc/libcdio/src/iso-info.c?root=libcdio&r1=1.36&r2=1.37 http://cvs.savannah.gnu.org/viewvc/libcdio/src/cd-info.c?root=libcdio&r1=1.150&r2=1.151 Discussion in the referenced Gentoo bug. I have fixed it in CVS and will make updates available for EL-5, F-7, F-8 and rawhide. this is top level bug for tracking this issue across all red hat products and services, (reopening) Updates pushed to Fedora as: https://admin.fedoraproject.org/updates/F7/FEDORA-2008-0104 https://admin.fedoraproject.org/updates/F8/FEDORA-2008-0136 + off-by-two fix: https://admin.fedoraproject.org/updates/F7/FEDORA-2008-0258 https://admin.fedoraproject.org/updates/F8/FEDORA-2008-0242 Fixed now across all products. Reporter changed to security-response-team by request of Jay Turner. |