Bug 1622242 (CVE-2018-1000221) - CVE-2018-1000221 pkgconf: 1 byte out of bounds read for 0 length keys
Summary: CVE-2018-1000221 pkgconf: 1 byte out of bounds read for 0 length keys
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2018-1000221
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1696297
TreeView+ depends on / blocked
 
Reported: 2018-08-24 21:14 UTC by Pedro Sampaio
Modified: 2019-09-29 14:57 UTC (History)
3 users (show)

Fixed In Version: pkgconf 1.5.3
Clone Of:
Environment:
Last Closed: 2018-08-25 21:16:30 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2018-08-24 21:14:46 UTC 
pkgconf version 1.5.0 to 1.5.2 contains a Buffer Overflow vulnerability in dequote() that can result in dequote() function returns 1-byte allocation if initial length is 0, leading to buffer overflow. This attack appear to be exploitable via specially crafted .pc file. This vulnerability appears to have been fixed in 1.5.3.

Upstream patch:

https://git.dereferenced.org/pkgconf/pkgconf/pulls/3
Comment 1 Neal Gompa 2018-08-25 19:42:48 UTC 
pkgconf 1.5.3 has been in Fedora 29/Rawhide since the end of July: https://koji.fedoraproject.org/koji/buildinfo?buildID=1132595
Comment 2 Stefan Cornelius 2019-04-17 14:40:12 UTC 
Probably introduced via https://git.dereferenced.org/pkgconf/pkgconf/commit/b46bb93cd1fe221dc4d6ff5e3ce99feda4ea31f1
Note You need to log in before you can comment on or make changes to this bug.