Bug 852481 (CVE-2015-2785) - CVE-2015-2785 byzanz: Out-of heap-based buffer write in GIF encoder
Summary: CVE-2015-2785 byzanz: Out-of heap-based buffer write in GIF encoder
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-2785
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 852484
TreeView+ depends on / blocked
 
Reported: 2012-08-28 16:53 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:55 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-04-09 04:49:02 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2012-08-28 16:53:44 UTC
Out-of heap-based buffer write flaw was found in the way Graphics Interchange Format (GIF) image format encoder of Byzanz, a desktop recorder, performed encoding of certain Byzanz debug data recordings (ByzanzRecording files) into GIF images. A remote attacker could provide a specially-crafted Byzanz debug data recording file that, when opened in byzanz-playback executable would lead to that executable crash or, potentially, arbitrary code execution with the privileges of the user running the byzanz-playback binary.

This issue was found by: Murray McAllister, Red Hat Security Response Team

Comment 2 Jan Lieskovsky 2012-08-28 17:19:18 UTC
This issue affects the version of the byzanz package, as shipped with Red Hat Enterprise Linux 6.

--

This issue affects the versions of the byzanz package, as shipped with Fedora release of 16 and 17.

Comment 6 Salvatore Bonaccorso 2015-02-16 06:12:16 UTC
Hi Jan,

(In reply to Jan Lieskovsky from comment #0)
> Out-of heap-based buffer write flaw was found in the way Graphics
> Interchange Format (GIF) image format encoder of Byzanz, a desktop recorder,
> performed encoding of certain Byzanz debug data recordings (ByzanzRecording
> files) into GIF images. A remote attacker could provide a specially-crafted
> Byzanz debug data recording file that, when opened in byzanz-playback
> executable would lead to that executable crash or, potentially, arbitrary
> code execution with the privileges of the user running the byzanz-playback
> binary.
> 
> This issue was found by: Murray McAllister, Red Hat Security Response Team

Are there more information which you could share? I see Bug 852484 is at least restricted. Are there patches available for this issue in byzanz?

Regards,
Salvatore

Comment 7 Jan Lieskovsky 2015-02-16 10:53:41 UTC
(In reply to Salvatore Bonaccorso from comment #6)
> Hi Jan,
> 
> (In reply to Jan Lieskovsky from comment #0)
> > Out-of heap-based buffer write flaw was found in the way Graphics
> > Interchange Format (GIF) image format encoder of Byzanz, a desktop recorder,
> > performed encoding of certain Byzanz debug data recordings (ByzanzRecording
> > files) into GIF images. A remote attacker could provide a specially-crafted
> > Byzanz debug data recording file that, when opened in byzanz-playback
> > executable would lead to that executable crash or, potentially, arbitrary
> > code execution with the privileges of the user running the byzanz-playback
> > binary.
> > 
> > This issue was found by: Murray McAllister, Red Hat Security Response Team
> 
> Are there more information which you could share? I see Bug 852484 is at
> least restricted. Are there patches available for this issue in byzanz?

Hello Salvatore,

  I am not part of Red Hat Product Security Team any more (=> can't share progress done on this issue with you). Please contact secalert@redhat.com for further issue details.

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team

> 
> Regards,
> Salvatore

Comment 8 Kurt Seifried 2015-04-09 04:49:02 UTC
Statement:

This issue affects the versions of byzanz as shipped with Red Hat Enterprise Linux 6. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 9 Fabio Olive Leite 2015-05-05 02:54:20 UTC
Hello Salvatore,

(In reply to Salvatore Bonaccorso from comment #6)
> 
> Are there more information which you could share? I see Bug 852484 is at
> least restricted. Are there patches available for this issue in byzanz?

Are you still looking for more information on this bug? I see that the needinfo flag was set to a generic internal address so nobody got a notification when it was set.

Thank you for your attention,
Fábio Olivé

Comment 10 Markus Koschany 2015-05-15 21:31:50 UTC
(In reply to Fabio Olive Leite from comment #9)
> Hello Salvatore,
> 
> (In reply to Salvatore Bonaccorso from comment #6)
> > 
> > Are there more information which you could share? I see Bug 852484 is at
> > least restricted. Are there patches available for this issue in byzanz?
> 
> Are you still looking for more information on this bug? I see that the
> needinfo flag was set to a generic internal address so nobody got a
> notification when it was set.

Hello,

I'm the Debian maintainer of byzanz. CVE-2015-2785 was assigned to this bug report but we still don't know anything about the vulnerability. What part of the code is affected? Can someone provide a test case? Are there any patches available?

Regards,

Markus Koschany


Note You need to log in before you can comment on or make changes to this bug.