| Summary: | dia new security issue CVE-2019-19451 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | fri, geiger.david68210, joequant, lewyssmith, sysadmin-bugs, tarazed25, tmb |
| Version: | 7 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7-64-OK | ||
| Source RPM: | dia-0.97.3-10.mga8.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2019-12-31 04:58:40 CET
David Walser
2019-12-31 04:58:48 CET
Whiteboard:
(none) =>
MGA7TOO Assigning globally; CC Joseph as a recent committer. --- When the update becomes available, I offer to test it (if possible). Dia I knew. CC:
(none) =>
joequant, lewyssmith Done for both Cauldron and mga7! CC:
(none) =>
geiger.david68210 7 64 bit updated cleanly. Swedish locale OK, looking good, made a small diagram. I dont know how to make a filename with invalid encoding Output in konsole where i launched it from: ** (dia:15131): WARNING **: 00:02:08.353: expected enumeration type GtkUpdateType, but got GtkPolicyType instead CC:
(none) =>
fri
David Walser
2020-01-05 04:45:29 CET
Whiteboard:
MGA7TOO =>
(none) Advisory: ======================== Updated dia package fixes security vulnerability: An endless loop on filenames with invalid encoding (CVE-2019-19451). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19451 http://lists.suse.com/pipermail/sle-security-updates/2019-December/006293.html ======================== Updated packages in core/updates_testing: ======================== dia-0.97.3-8.1.mga7 from dia-0.97.3-8.1.mga7.src.rpm Assignee:
pkg-bugs =>
qa-bugs dia already installed. This one looks dangerous to test. https://gitlab.gnome.org/GNOME/dia/issues/428 $ touch $'\374'.dia $ dia $'\374' Filename conversion failed: � <repeated many times> Ctrl-C Updated the drawing package and repeated the test. $ dia $'\374' Filename conversion failed: � <this appears only once> The diagram editor appears with a tools interface and a default diagram Diagram1.dia. Added a few blocks and squiggles and some coloured text then saved file. Reopened dia on the new file and it loaded fine. Good for 64-bits. Whiteboard:
(none) =>
MGA7-64-OK
Thomas Backlund
2020-01-05 15:43:38 CET
Keywords:
(none) =>
advisory, validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0022.html Status:
NEW =>
RESOLVED |