Bug 26231

Summary:	texlive new security issue CVE-2019-19601
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Marc Krämer <mageia>
Status:	RESOLVED INVALID	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	jani.valimaa
Version:	Cauldron
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7TOO
Source RPM:	texlive-20190410-10.mga8.src.rpm	CVE:
Status comment:	Patch available from Fedora

Description David Walser 2020-02-20 22:32:42 CET

Fedora has issued an advisory on February 8:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JF3RU3VMLP5SS4MXAEKQKAGTSPN3KMHJ/

Mageia 7 is also affected.

David Walser 2020-02-20 22:32:53 CET

Whiteboard: (none) => MGA7TOO

David Walser 2020-02-21 17:54:25 CET

Status comment: (none) => Patch available from Fedora

Comment 1 Lewis Smith 2020-02-21 21:16:02 CET

Assigning to Marc as the registered maintainer, CC wally as the main recent committer of 'texlive'.

Assignee: bugsquad => mageia
CC: (none) => jani.valimaa

Comment 2 Marc Krämer 2020-02-22 13:55:09 CET

I don't think we are affected. This is only true if not linked against libkpathsea; but we link against it.

Running the testcase does not produce any buffer overflows. I thnik we can close this one.

Comment 3 David Walser 2020-02-22 15:31:26 CET

Sometimes our compiler flags can protect us from actually seeing the buffer overflows, but I think that you're right that we're not hitting that codepath.

Status: NEW => RESOLVED
Resolution: (none) => INVALID