Bug 1223817 – CVE-2015-4042 coreutils: possible buffer overflow in keycompare_mb()

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1223817 - (CVE-2015-4042) CVE-2015-4042 coreutils: possible buffer overflow in keycompare_mb()

Summary:	CVE-2015-4042 coreutils: possible buffer overflow in keycompare_mb()

Status:	CLOSED WONTFIX

Aliases:	CVE-2015-4042

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20150427,reported=2...
Keywords:	Security

Depends On:	1223821
Blocks:	1223819
	Show dependency tree / graph

Reported:	2015-05-21 09:30 EDT by Vasyl Kaigorodov
Modified:	2015-07-01 03:52 EDT (History)
CC List:	9 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-06-30 09:49:34 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Vasyl Kaigorodov 2015-05-21 09:30:59 EDT

It was reported that there might be a buffer overflow triggered in sort(1)  with data around SIZE_MAX/2.
This appears to be related to the new "SIZE_MAX - lenb - 2 < lena" test, which is not specifically associated with use of multibyte characters.

Initial report: https://bugzilla.suse.com/show_bug.cgi?id=928749
Fix: https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940
CVE assignment: http://seclists.org/oss-sec/2015/q2/502

Comment 1 Vasyl Kaigorodov 2015-05-21 09:35:40 EDT

Created coreutils tracking bugs for this issue:

Affects: fedora-all [bug 1223821]

Note You need to log in before you can comment on or make changes to this bug.