Bug 30195

Summary:	abcm2ps new security issues CVE-2021-3243[4-6]
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	andrewsfarm, davidwhodgins, mageia, sysadmin-bugs, tarazed25
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA8-64-OK
Source RPM:	abcm2ps-8.14.7-2.mga9.src.rpm	CVE:
Status comment:

Description David Walser 2022-03-22 17:36:04 CET

Fedora has issued an advisory today (March 22):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6333SXWMES3K22DBAOAW34G6EU6WIJEY/

The issues are fixed upstream in 8.14.13.

Mageia 8 is also affected.

David Walser 2022-03-22 17:36:23 CET

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 8.14.13
CC: (none) => mageia

Comment 1 Lewis Smith 2022-03-22 20:58:25 CET

In the absence of a visible maintainer, assigning this update too globally.

Assignee: bugsquad => pkg-bugs

Comment 2 Nicolas Lécureuil 2022-03-22 22:31:01 CET

Package updated in mga8:

src:
    - abcm2ps-8.14.13-1.mga8

Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8
Status comment: Fixed upstream in 8.14.13 => (none)
Assignee: pkg-bugs => qa-bugs

Comment 3 Len Lawrence 2022-03-23 10:25:07 CET

Copied the example ABC notation file from https://abcnotation.com/

$ abcm2ps -E -O = speedtheplough
Used gs to show the output file.
$ gs Speed_the_Plough.eps

$ abcm2ps -g -O = speedtheplough
The output file Speed_the_Plough.svg displayed fine using ImageMagick.
$ display Speed_the_Plough.svg

Both images matched that at https://abcnotation.com/

Removed the output files and updated the package.
Ran the same tests....
The resulting images were identical to the earlier ones.
Giving this an OK for 64-bits.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => tarazed25

Comment 4 Thomas Andrews 2022-03-23 13:07:03 CET

Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2022-03-24 00:49:32 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 5 Mageia Robot 2022-03-24 10:04:14 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0116.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED