| Summary: | perl-Gtk2 possible security issue from memory management bug | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | olchal, sysadmin-bugs, thierry.vignaud |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/633094/ | ||
| Whiteboard: | has_procedure advisory MGA4-64-OK MGA4-32-OK | ||
| Source RPM: | perl-Gtk2-1.249.200-5.mga5.src.rpm | CVE: | |
| Status comment: | |||
| Attachments: | perl-Gtk2 script files | ||
|
Description
David Walser
2015-01-31 18:39:38 CET
David Walser
2015-01-31 18:39:57 CET
Whiteboard:
(none) =>
MGA4TOO Updated packages uploaded for Mageia 4 and Cauldron by tv. perl-Gtk2-1.249.500-2.mga4 perl-Gtk2-doc-1.249.500-2.mga4 from perl-Gtk2-1.249.500-2.mga4.src.rpm Assigning to QA. Advisory to come later. For now, see the upstream NEWS file. CC:
(none) =>
thierry.vignaud Created attachment 5860 [details] perl-Gtk2 script files 5 perl-Gtk2 script files I used for my test. They were found here : http://www.drdobbs.com/web-development/programming-graphical-applications-with/184416060?pgno=1 CC:
(none) =>
olchal Testing on Mageia4x64 real hardware using script files in Comment 2 Did not find any PoC From current package : -------------------- perl-Gtk2-1.249.0-2.mga4 To updated package : ------------------ perl-Gtk2-1.249.500-2.mga4.x86_64 Perl-Gtk2 scripts ran well with both versions. Whiteboard:
(none) =>
MGA4-64-OK
claire robinson
2015-02-09 20:01:04 CET
Whiteboard:
MGA4-64-OK =>
has_procedure MGA4-64-OK The seven programs from the Dr. Dobbs article work fine on Mageia 4 i586. Whiteboard:
has_procedure MGA4-64-OK =>
has_procedure MGA4-64-OK MGA4-32-OK Need an advisory for this one please David. Advisory: ======================== Updated perl-Gtk2 packages fix security vulnerability: Incorrect memory management in Gtk2::Gdk::Display::list_devices in perl-Gtk2 before 1.2495, where, the code was freeing memory that gtk+ still holds onto and might access later. The perl-Gtk2 package has been updated to version 1.2495 to fix this issue and other bugs. References: https://www.mail-archive.com/gtk-perl-list@gnome.org/msg07793.html http://cpansearch.perl.org/src/XAOC/Gtk2-1.2495/NEWS Thanks. Validating. Advisory uploaded. Please push to 4 updates Keywords:
(none) =>
validated_update An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0059.html Status:
NEW =>
RESOLVED
David Walser
2015-02-12 16:36:50 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/633094/ A CVE was requested for this, but it's unclear whether one is appropriate. MITRE cited our bug in the discussion: http://openwall.com/lists/oss-security/2015/03/12/12 |