| Summary: | harbour new security issue CVE-2014-4607 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, sysadmin-bugs, wilcal.int, zen25000 |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/604237/ | ||
| Whiteboard: | MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory | ||
| Source RPM: | harbour-3.2.0-1.19101.314.1.mga5.src.rpm | CVE: | |
| Status comment: | |||
| Bug Depends on: | |||
| Bug Blocks: | 13943 | ||
|
Description
David Walser
2014-08-18 21:53:29 CEST
David Walser
2014-08-18 21:53:36 CEST
Whiteboard:
(none) =>
MGA4TOO, MGA3TOO I tried building using system version, but as yet no joy - it's not finding it. I have prodded upstream dev-ml so they may update it to 2.08 soon and we can update our snapshot. Even though we have a system liblzo, I don't think we have a system minilzo packaged. That could explain why I (and Harbour) have been struggling to find it :\
David Walser
2014-08-19 18:44:50 CEST
Blocks:
(none) =>
13943 I have patched the bundled minilzo in Harbour up to 2.08, the same patch works for the various Harbour snapshots in 3, 4 and cauldron. I will push updates after some testing. ####################################### Update Advisory harbour-3.2.0-1.18925.255.3.mga4 has been pushed to 4/updates_testing harbour-3.2.0-0.18748_111.3.mga3 has been pushed to 3/updates_testing An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker (CVE-2014-4607). The harbour is built with a bundled copy of minilzo, which is a part of liblzo containing the vulnerable code. This update is patched to update the bundled minilzo to version 2.8. References: http://www.oberhumer.com/opensource/lzo/#news http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4607 http://advisories.mageia.org/MGASA-2014-0290.html This update patches the bundled minilzo in harbour to version 2.8. Affected files: Mageia 4 harbour-3.2.0-1.18925.255.3.mga4.src.rpm harbour-3.2.0-1.18925.255.3.mga4.x86_64.rpm harbour-bundle-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-contrib3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-allegro3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-cairo3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-cups3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-curl3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-firebird3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-freeimage3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-gd3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-mysql3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-odbc3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-pgsql3-3.2.0-1.18925.255.3.mga4.x86_64.rpm lib64harbour-qt3-3.2.0-1.18925.255.3.mga4.x86_64.rpm harbour-hbide-3.2.0-1.18925.255.3.mga4.x86_64.rpm harbour-hbdbu-3.2.0-1.18925.255.3.mga4.x86_64.rpm harbour-3.2.0-1.18925.255.3.mga4.i586.rpm harbour-bundle-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-contrib3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-allegro3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-cairo3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-cups3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-curl3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-firebird3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-freeimage3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-gd3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-mysql3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-odbc3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-pgsql3-3.2.0-1.18925.255.3.mga4.i586.rpm lib64harbour-qt3-3.2.0-1.18925.255.3.mga4.i586.rpm harbour-hbide-3.2.0-1.18925.255.3.mga4.i586.rpm harbour-hbdbu-3.2.0-1.18925.255.3.mga4.i586.rpm Mageia 3 harbour-3.2.0-0.18748_111.3.mga3.src.rpm harbour-3.2.0-0.18748_111.3.mga3.x86_64.rpm harbour-bundle-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-contrib3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-allegro3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-cairo3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-cups3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-curl3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-firebird3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-freeimage3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-gd3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-mysql3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-odbc3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-pgsql3-3.2.0-0.18748_111.3.mga3.x86_64.rpm lib64harbour-qt3-3.2.0-0.18748_111.3.mga3.x86_64.rpm harbour-hbide-3.2.0-0.18748_111.3.mga3.x86_64.rpm harbour-3.2.0-0.18748_111.3.mga3.i586.rpm harbour-bundle-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-contrib3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-allegro3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-cairo3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-cups3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-curl3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-firebird3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-freeimage3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-gd3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-mysql3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-odbc3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-pgsql3-3.2.0-0.18748_111.3.mga3.i586.rpm lib64harbour-qt3-3.2.0-0.18748_111.3.mga3.i586.rpm harbour-hbide-3.2.0-0.18748_111.3.mga3.i586.rpm Assignee:
zen25000 =>
qa-bugs Thanks Barry. CC:
(none) =>
zen25000 In VirtualBox, M3, KDE, 32-bit Package(s) under test: harbour default install of harbour [root@localhost wilcal]# urpmi harbour Package harbour-3.2.0-0.18748_111.2.mga3.i586 is already installed harbour installs without reporting errors install harbour from updates_testing [root@localhost wilcal]# urpmi harbour Package harbour-3.2.0-0.18748_111.3.mga3.i586 is already installed harbour update installs without reporting errors Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver virtualbox-4.3.10-1.1.mga4.x86_64 virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64 CC:
(none) =>
wilcal.int In VirtualBox, M3, KDE, 64-bit Package(s) under test: harbour default install of harbour [root@localhost wilcal]# urpmi harbour Package harbour-3.2.0-0.18748_111.2.mga3.x86_64 is already installed harbour installs without reporting errors install harbour from updates_testing [root@localhost wilcal]# urpmi harbour Package harbour-3.2.0-0.18748_111.3.mga3.x86_64 is already installed harbour update installs without reporting errors Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver virtualbox-4.3.10-1.1.mga4.x86_64 virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64 In VirtualBox, M4, KDE, 32-bit Package(s) under test: harbour default install of harbour [root@localhost wilcal]# urpmi harbour Package harbour-3.2.0-1.18925.255.2.mga4.i586 is already installed harbour installs without reporting errors install harbour from updates_testing [root@localhost wilcal]# urpmi harbour Package harbour-3.2.0-1.18925.255.3.mga4.i586 is already installed harbour update installs without reporting errors Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver virtualbox-4.3.10-1.1.mga4.x86_64 virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64 In VirtualBox, M4, KDE, 64-bit Package(s) under test: harbour default install of harbour [root@localhost wilcal]# urpmi harbour Package harbour-3.2.0-1.18925.255.2.mga4.x86_64 is already installed harbour installs without reporting errors install harbour from updates_testing [root@localhost wilcal]# urpmi harbour Package harbour-3.2.0-1.18925.255.3.mga4.x86_64 is already installed harbour update installs without reporting errors Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver virtualbox-4.3.10-1.1.mga4.x86_64 virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64 For me this update works fine. Testing complete for mga3 32-bit & 64-bit Testing complete for mga4 32-bit & 64-bit Validating the update. Could someone from the sysadmin team push this to updates. Thanks Keywords:
(none) =>
validated_update Advisory 13934.adv added to svn. CC:
(none) =>
davidwhodgins An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2014-0355.html Status:
NEW =>
RESOLVED |