Bug 428320 - (CVE-2008-0172) CVE-2008-0172 boost regular expression NULL dereference flaw
CVE-2008-0172 boost regular expression NULL dereference flaw
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 428974 428975 428976 537842 766755
Blocks: 742493
  Show dependency treegraph
Reported: 2008-01-10 15:05 EST by Josh Bressers
Modified: 2016-03-04 07:11 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-02-21 04:28:02 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
patch (1.62 KB, patch)
2008-01-14 16:37 EST, Benjamin Kosnik
no flags Details | Diff
boost spec file (12.78 KB, text/plain)
2008-01-14 16:38 EST, Benjamin Kosnik
no flags Details
Fix for 1.33.1 (1.69 KB, patch)
2008-01-16 15:41 EST, Petr Machata
no flags Details | Diff

  None (edit)
Description Josh Bressers 2008-01-10 15:05:18 EST
Will Drewry discovered a flaw in boost's regular expression library where a
crafted regular expression can trigger a NULL dereference flaw.
Comment 9 Benjamin Kosnik 2008-01-14 16:37:24 EST
Created attachment 291643 [details]

from boost svn
Comment 10 Benjamin Kosnik 2008-01-14 16:38:11 EST
Created attachment 291644 [details]
boost spec file

for boost-1.34.1.-6
Comment 12 Tomas Hoger 2008-01-15 08:13:21 EST
> Looks like this is the fix:
> http://lists.boost.org/boost-commit/2008/01/5400.php

Which is: http://svn.boost.org/trac/boost/changeset/42674

Additional fix for the test suite: http://svn.boost.org/trac/boost/changeset/42745
Comment 14 Tomas Hoger 2008-01-16 10:18:22 EST
Lifting embargo, upstream SVN commits are publicly available.
Comment 16 Petr Machata 2008-01-16 15:41:24 EST
Created attachment 291890 [details]
Fix for 1.33.1

The example regexes from the reproducer all unambiguously SIGSEGV boost_regex,
with or without the patch in file 291643.  This patch contains one additional
change that fixes this.  I checked that it introduces no new regressions, and
that with this patch, reproducer testcases all throw exception as they should.
Comment 17 Petr Machata 2008-01-16 15:44:39 EST
(The patch from comment #16 is relevant for boost distributed with RHEL-5 as
well as Fedora 7.  Fedora build is spinning right now, taskID=353614.)
Comment 18 Fedora Update System 2008-01-22 10:30:58 EST
boost-1.34.1-7.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update boost'
Comment 19 Fedora Update System 2008-03-13 03:49:09 EDT
boost-1.34.1-7.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 22 Vincent Danen 2010-11-15 14:21:00 EST

This issue did not affect the version of boost as shipped with Red Hat Enterprise Linux 4 and 6. This issue was addressed in boost packages in Red Hat Enterprise Linux 5 via RHSA-2012:0305.
Comment 25 Murray McAllister 2012-01-19 19:02:38 EST

Red Hat would like to thank Will Drewry for reporting these issues.
Comment 27 errata-xmlrpc 2012-02-20 22:15:50 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0305 https://rhn.redhat.com/errata/RHSA-2012-0305.html

Note You need to log in before you can comment on or make changes to this bug.