Buffer overflow vulnerability has been reported [1] in CHICKEN Scheme's substring-index[-ci] procedures. This overrun is only triggered when an integer greater than zero is passed as the optional START argument. As a work-around users are advised to switch to the equivalent string-contains procedure from SRFI 13 which is also shipped with CHICKEN. All releases of CHICKEN up until 4.9.0.1 are affected. The issue is fixed by the patch at http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/txt2UqAS9CtvH.txt. This fix will be included in the upcoming release versions 4.9.0.2, 4.9.1, 4.10.0, and 5.0. The patch on the discussion list is http://lists.nongnu.org/archive/html/chicken-hackers/2014-12/msg00000.html and it got applied as http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commit;h=25db851b902606741b1a520bd7e4a3fbd12c9b2a and http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commit;h=63d0445ed379a43343cfcea7032a284cf7deca2b For the official announcement, see http://lists.nongnu.org/archive/html/chicken-users/2015-01/msg00048.html [1]: http://seclists.org/oss-sec/2015/q1/122
Created chicken tracking bugs for this issue: Affects: fedora-all [bug 1181484] Affects: epel-all [bug 1181485]
chicken-4.9.0.1-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
chicken-4.9.0.1-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
chicken-4.9.0.1-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
This has been fixed for a while.