Bug 14385

Summary:	konversation new security issue CVE-2014-8483
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	geiger.david68210, rverschelde, sysadmin-bugs
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/618455/
Whiteboard:	MGA3TOO MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory
Source RPM:	konversation-1.5-0.rc1.2.mga4.src.rpm	CVE:
Status comment:

Description David Walser 2014-10-27 10:55:10 CET

A CVE has been assigned for a security issue fixed upstream on October 26:
http://openwall.com/lists/oss-security/2014/10/26/1

Patched packages uploaded for Mageia 3, Mageia 4, and Cauldron.

Advisory:
========================

Updated konversation package fixes security vulnerability:

Due to and out-of-bounds read issue in Konversation in The ECB Blowfish
decryption function, a malicious client can cause either denial of service or
disclosure of information from process memory by using an improperly formed
message (CVE-2014-8483).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8483
https://bugs.kde.org/show_bug.cgi?id=210792
http://openwall.com/lists/oss-security/2014/10/26/1
========================

Updated packages in core/updates_testing:
========================
konversation-1.5-0.rc1.2.mga3
konversation-1.5-0.rc1.3.mga4

from SRPMS:
konversation-1.5-0.rc1.2.mga3.src.rpm
konversation-1.5-0.rc1.3.mga4.src.rpm

Reproducible: 

Steps to Reproduce:

David Walser 2014-10-27 10:55:16 CET

Whiteboard: (none) => MGA3TOO

Comment 1 Rémi Verschelde 2014-10-28 13:40:21 CET

Testing complete Mageia 3 x86_64.

CC: (none) => remi
Whiteboard: MGA3TOO => MGA3TOO MGA3-64-OK

Comment 2 Rémi Verschelde 2014-10-28 14:02:15 CET

Advisory uploaded.

Whiteboard: MGA3TOO MGA3-64-OK => MGA3TOO MGA3-64-OK advisory

Comment 3 David Walser 2014-10-28 14:05:53 CET

Updated konversation working fine on Mageia 4 i586.

Whiteboard: MGA3TOO MGA3-64-OK advisory => MGA3TOO MGA3-64-OK MGA4-32-OK advisory

Comment 4 David GEIGER 2014-10-28 19:18:32 CET

Tested mga4_64,

Testing complete for the new konversation-1.5-0.rc1.3.mga4, ok for me, all seems to work properly. 

I use Konversation daily.

CC: (none) => geiger.david68210
Whiteboard: MGA3TOO MGA3-64-OK MGA4-32-OK advisory => MGA3TOO MGA3-64-OK MGA4-32-OK MGA4-64-OK advisory

Comment 5 Rémi Verschelde 2014-10-29 09:52:12 CET

Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 6 Mageia Robot 2014-10-29 12:31:30 CET

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0437.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2014-10-29 18:18:59 CET

URL: (none) => http://lwn.net/Vulnerabilities/618455/