Bug 371221 (CVE-2007-5395) - CVE-2007-5395 link-grammar buffer overflow in tokenize.c
Summary: CVE-2007-5395 link-grammar buffer overflow in tokenize.c
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-5395
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On: Confidential372341 Confidential372351 Confidential372361
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-11-08 14:12 UTC by Tomas Hoger
Modified: 2019-09-29 12:22 UTC (History)
1 user (show)

Fixed In Version: 4.2.5-1.fc8
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-11-13 00:06:56 UTC

Attachments (Terms of Use)
Upstream patch (2.79 KB, patch)
2007-11-12 10:02 UTC, Tomas Hoger 		no flags Details | Diff
View All

Description Tomas Hoger 2007-11-08 14:12:47 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-5395 to the following vulnerability:

Stack-based buffer overflow in the separate_word function in tokenize.c in Link Grammar 4.1b and possibly other versions, as used in AbiWord Link Grammar 4.2.4, allows remote attackers to execute arbitrary code via a long word, as reachable through the separate_sentence function.

References:

http://secunia.com/secunia_research/2007-78/advisory/
http://secunia.com/secunia_research/2007-79/advisory/
http://secunia.com/advisories/27300
http://secunia.com/advisories/27340
Comment 2 Tomas Hoger 2007-11-12 10:02:27 UTC 
Created attachment 255061 [details]
Upstream patch
Comment 3 Marc Maurer 2007-11-12 19:07:13 UTC 
I sent a 4.2.5 package to koji, which is pending approval to be pushed.
Comment 4 Fedora Update System 2007-11-13 00:06:54 UTC 
link-grammar-4.2.5-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2007-11-15 03:37:06 UTC 
link-grammar-4.2.5-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.