Bug 31247

Summary:	woff2 possible new double free security issue
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Jean-Pierre Aubin <jean-pierre>
Status:	RESOLVED INVALID	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	geiger.david68210
Version:	Cauldron
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	woff2-1.0.2-5.mga9.src.rpm	CVE:
Status comment:

Description David Walser 2022-12-08 15:35:14 CET

Fedora has issued an advisory today (December 8):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UKXGAHTBXYEQGJAG6MQPCH7QNBP5SY7S/

This is in the original woff, but woff2 should be checked to see if it's affected too.  If so, Mageia 8 is also affected.

Comment 1 Lewis Smith 2022-12-08 21:20:47 CET

Jean-pierre (pol4n) has updated this package recently, so assigning to you.
If this is not right, please re-assign it to pkg-bugs.

Assignee: bugsquad => jean-pierre

Comment 2 David GEIGER 2023-07-02 07:51:25 CEST

I checked wolff2 source code and I confirm that wolff2 is NOT affected by this double free security issue!

CC: (none) => geiger.david68210

Comment 3 David Walser 2023-07-02 14:35:41 CEST

Thanks!

Resolution: (none) => INVALID
Status: NEW => RESOLVED