Bug 479384

Summary:	lcms: multiple security flaws [EPEL-4]
Product:	[Fedora] Fedora EPEL	Reporter:	Tomas Hoger <thoger>
Component:	lcms	Assignee:	Andreas Bierfert <andreas.bierfert>
Status:	CLOSED WONTFIX	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	el4	CC:	andreas.bierfert
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	ActualBug
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-01 20:02:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	473462, 473463

Description Tomas Hoger 2009-01-09 08:47:05 UTC

Description of problem:
Version of lcms as shipped in EPEL4 (lcms version 1.15) is affected by two security flaws:

CVE-2008-5316 lcms: insufficient input validation in ReadEmbeddedTextTag
CVE-2008-5317 lcms: unsigned -> signed integer cast issue in cmsAllocGamma

Additional info:
See parent bugs ("Blocks" BZ field) for further details and patches.

Comment 1 Kevin Fenzi 2012-03-01 20:02:17 UTC

EPEL-4 has reached end of life and is no longer supported. 

Please retest your bug against EPEL-5 or EPEL-6 and re-open if the bug persists in the packages available in those releases, or file a new bug. 

See: http://lists.fedoraproject.org/pipermail/epel-announce/2012-February/000015.html