Bug 428320 (CVE-2008-0172) - CVE-2008-0172 boost regular expression NULL dereference flaw
Summary: CVE-2008-0172 boost regular expression NULL dereference flaw
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-0172
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 428974 428975 428976 537842 766755
Blocks: 742493
TreeView+ depends on / blocked
 
Reported: 2008-01-10 20:05 UTC by Josh Bressers
Modified: 2023-05-13 01:51 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-21 09:28:02 UTC
Embargoed:

Attachments (Terms of Use)
patch (1.62 KB, patch)
2008-01-14 21:37 UTC, Benjamin Kosnik 		no flags Details | Diff
boost spec file (12.78 KB, text/plain)
2008-01-14 21:38 UTC, Benjamin Kosnik 		no flags Details
Fix for 1.33.1 (1.69 KB, patch)
2008-01-16 20:41 UTC, Petr Machata 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0305 0 normal SHIPPED_LIVE Low: boost security and bug fix update 2012-02-21 07:24:46 UTC

Description Josh Bressers 2008-01-10 20:05:18 UTC 
Will Drewry discovered a flaw in boost's regular expression library where a
crafted regular expression can trigger a NULL dereference flaw.
Comment 9 Benjamin Kosnik 2008-01-14 21:37:24 UTC 
Created attachment 291643 [details]
patch


from boost svn
Comment 10 Benjamin Kosnik 2008-01-14 21:38:11 UTC 
Created attachment 291644 [details]
boost spec file


for boost-1.34.1.-6
Comment 12 Tomas Hoger 2008-01-15 13:13:21 UTC 
> Looks like this is the fix:
> http://lists.boost.org/boost-commit/2008/01/5400.php

Which is: http://svn.boost.org/trac/boost/changeset/42674

Additional fix for the test suite: http://svn.boost.org/trac/boost/changeset/42745
Comment 14 Tomas Hoger 2008-01-16 15:18:22 UTC 
Lifting embargo, upstream SVN commits are publicly available.
Comment 16 Petr Machata 2008-01-16 20:41:24 UTC 
Created attachment 291890 [details]
Fix for 1.33.1

The example regexes from the reproducer all unambiguously SIGSEGV boost_regex,
with or without the patch in file 291643.  This patch contains one additional
change that fixes this.  I checked that it introduces no new regressions, and
that with this patch, reproducer testcases all throw exception as they should.
Comment 17 Petr Machata 2008-01-16 20:44:39 UTC 
(The patch from comment #16 is relevant for boost distributed with RHEL-5 as
well as Fedora 7.  Fedora build is spinning right now, taskID=353614.)
Comment 18 Fedora Update System 2008-01-22 15:30:58 UTC 
boost-1.34.1-7.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update boost'
Comment 19 Fedora Update System 2008-03-13 07:49:09 UTC 
boost-1.34.1-7.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 22 Vincent Danen 2010-11-15 19:21:00 UTC 
Statement:

This issue did not affect the version of boost as shipped with Red Hat Enterprise Linux 4 and 6. This issue was addressed in boost packages in Red Hat Enterprise Linux 5 via RHSA-2012:0305.
Comment 25 Murray McAllister 2012-01-20 00:02:38 UTC 
Acknowledgements:

Red Hat would like to thank Will Drewry for reporting these issues.
Comment 27 errata-xmlrpc 2012-02-21 03:15:50 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0305 https://rhn.redhat.com/errata/RHSA-2012-0305.html
Note You need to log in before you can comment on or make changes to this bug.