Bug 852481 (CVE-2015-2785)

This issue affects the version of the byzanz package, as shipped with Red Hat Enterprise Linux 6.

--

This issue affects the versions of the byzanz package, as shipped with Fedora release of 16 and 17.

Hi Jan,

(In reply to Jan Lieskovsky from comment #0)
> Out-of heap-based buffer write flaw was found in the way Graphics
> Interchange Format (GIF) image format encoder of Byzanz, a desktop recorder,
> performed encoding of certain Byzanz debug data recordings (ByzanzRecording
> files) into GIF images. A remote attacker could provide a specially-crafted
> Byzanz debug data recording file that, when opened in byzanz-playback
> executable would lead to that executable crash or, potentially, arbitrary
> code execution with the privileges of the user running the byzanz-playback
> binary.
> 
> This issue was found by: Murray McAllister, Red Hat Security Response Team

Are there more information which you could share? I see Bug 852484 is at least restricted. Are there patches available for this issue in byzanz?

Regards,
Salvatore

(In reply to Salvatore Bonaccorso from comment #6)
> Hi Jan,
> 
> (In reply to Jan Lieskovsky from comment #0)
> > Out-of heap-based buffer write flaw was found in the way Graphics
> > Interchange Format (GIF) image format encoder of Byzanz, a desktop recorder,
> > performed encoding of certain Byzanz debug data recordings (ByzanzRecording
> > files) into GIF images. A remote attacker could provide a specially-crafted
> > Byzanz debug data recording file that, when opened in byzanz-playback
> > executable would lead to that executable crash or, potentially, arbitrary
> > code execution with the privileges of the user running the byzanz-playback
> > binary.
> > 
> > This issue was found by: Murray McAllister, Red Hat Security Response Team
> 
> Are there more information which you could share? I see Bug 852484 is at
> least restricted. Are there patches available for this issue in byzanz?

Hello Salvatore,

  I am not part of Red Hat Product Security Team any more (=> can't share progress done on this issue with you). Please contact secalert for further issue details.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> Regards,
> Salvatore

Statement:

This issue affects the versions of byzanz as shipped with Red Hat Enterprise Linux 6. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Hello Salvatore,

(In reply to Salvatore Bonaccorso from comment #6)
> 
> Are there more information which you could share? I see Bug 852484 is at
> least restricted. Are there patches available for this issue in byzanz?

Are you still looking for more information on this bug? I see that the needinfo flag was set to a generic internal address so nobody got a notification when it was set.

Thank you for your attention,
Fábio Olivé

(In reply to Fabio Olive Leite from comment #9)
> Hello Salvatore,
> 
> (In reply to Salvatore Bonaccorso from comment #6)
> > 
> > Are there more information which you could share? I see Bug 852484 is at
> > least restricted. Are there patches available for this issue in byzanz?
> 
> Are you still looking for more information on this bug? I see that the
> needinfo flag was set to a generic internal address so nobody got a
> notification when it was set.

Hello,

I'm the Debian maintainer of byzanz. CVE-2015-2785 was assigned to this bug report but we still don't know anything about the vulnerability. What part of the code is affected? Can someone provide a test case? Are there any patches available?

Regards,

Markus Koschany