A flaw was found in AFFLIB (aka AFFLIBv3) through 3.7.16. The af_get_page() function in lib/afflib_pages.cpp allows remote attackers to cause a denial of service (segmentation fault) via a corrupt AFF image that triggers an unexpected pagesize value. References: https://github.com/sshock/AFFLIBv3/pull/31 Upstream Patch: https://github.com/sshock/AFFLIBv3/commit/435a2ca802358a3debb6d164d2c33049131df81c
Created afflib tracking bugs for this issue: Affects: fedora-all [bug 1554426] Affects: epel-7 [bug 1554427]
The fedora security fixes are on their way. But on epel-7, I think the previous afflib package wasn't built by the previous maintainer there (as the build failed). So there is a diff between what's in git and what's in repos. If you have more info about which version is affected here I will try to work on this as possible.
(In reply to Nicolas Chauvet (kwizart) from comment #3) > The fedora security fixes are on their way. But on epel-7, I think the > previous afflib package wasn't built by the previous maintainer there (as > the build failed). So there is a diff between what's in git and what's in > repos. > > If you have more info about which version is affected here I will try to > work on this as possible. Hello Nicolas :) Thank you for working on this! I'm completely fine with either rebasing epel-7 to fedora version, or waiting on the upstream version. This security issue does not seem to be very impactful. As a side note, please, don't modify this bug in any way as it's used as a placeholder to store all flaw neutral information from the Product Security Team perspective. Thanks!