Bug 32091

Summary:	mingw-nsis new security issue CVE-2023-37378
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, geiger.david68210, herman.viaene, sysadmin-bugs
Version:	8	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA8-64-OK
Source RPM:	mingw-nsis-3.08-2.mga9.src.rpm	CVE:
Status comment:	Fixed upstream in 3.09

Description David Walser 2023-07-10 22:27:51 CEST

Debian-LTS has issued an advisory on July 7:
https://www.debian.org/lts/security/2023/dla-3483

The issue is fixed upstream in 3.09.

Mageia 8 is also affected.

David Walser 2023-07-10 22:28:34 CEST

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 3.09

Comment 1 David GEIGER 2023-07-11 10:50:31 CEST

Done for both mga8 and cauldron!

freeze_move requested for cauldron!


Packages in 8/Core/Updates_testing:
======================
mingw32-nsis-3.06.1-1.1.mga8.x86_64.rpm

From SRPMS:
mingw-nsis-3.06.1-1.1.mga8.src.rpm

CC: (none) => geiger.david68210
Assignee: bugsquad => qa-bugs

Comment 2 Herman Viaene 2023-07-12 15:37:13 CEST

Trying to follow bug 21813, but I get:
$ makensis Example1.nsi 
Processing config: /etc/nsisconf.nsh
Can't open script "Example1.nsi"
Not a problem of access rights.

CC: (none) => herman.viaene

Comment 3 Dave Hodgins 2023-07-12 16:47:25 CEST

I just installed mingw32-nsis-3.06.1-1.1.mga8.x86_64.rpm

Having manually created /tmp/tmp (for easy deletion after testing),
copied /usr/share/doc/mingw-nsis/Examples/ to /tmp/tmp/ including the
sub directories ...

$ cd /tmp/tmp/Examples/
$ pwd
/tmp/tmp/Examples
$ makensis example1.nsi
Processing config: /etc/nsisconf.nsh
Processing script file: "example1.nsi" (UTF8)

Processed 1 file, writing output (x86-unicode):

Output: "example1.exe"
Install: 2 pages (128 bytes), 1 section (32792 bytes), 3 instructions (84 bytes), 222 strings (1758 bytes), 1 language table (230 bytes).

Using zlib compression.

EXE header size:               92160 / 93184 bytes
Install code:                   1033 / 19000 bytes
Install data:                    486 / 995 bytes
CRC (0x2E352F3E):                  4 / 4 bytes

Total size:                    93683 / 113183 bytes (82.7%)

Herman, did you cd to the Examples directory you just copied from /usr or
not include the sub directories when copying?

CC: (none) => davidwhodgins

Comment 4 David GEIGER 2023-07-12 19:32:10 CEST

package moved to Core/Release for cauldron!

Whiteboard: MGA8TOO => (none)
Version: Cauldron => 8

Comment 5 Herman Viaene 2023-07-13 08:40:27 CEST

@Dave: No, I just copied one single example.nsi file. Will follow your recommendation.

Comment 6 Herman Viaene 2023-07-14 11:05:00 CEST

Copied /usr/share/doc/mingw-nsis/Examples/ to ~/tmp
$ cd tmp/Examples/
$ makensis example1.nsi
Processing config: /etc/nsisconf.nsh
Processing script file: "example1.nsi" (UTF8)

Processed 1 file, writing output (x86-unicode):

Output: "example1.exe"
Install: 2 pages (128 bytes), 1 section (32792 bytes), 3 instructions (84 bytes), 222 strings (1758 bytes), 1 language table (230 bytes).

Using zlib compression.

EXE header size:               92160 / 93184 bytes
Install code:                   1033 / 19000 bytes
Install data:                    486 / 995 bytes
CRC (0x2E352F3E):                  4 / 4 bytes

Total size:                    93683 / 113183 bytes (82.7%)
 That confirms the result Dave got and is equivalent with bug 21813, so good to go.

Whiteboard: (none) => MGA8-64-OK

Comment 7 Dave Hodgins 2023-07-14 15:09:22 CEST

Advisory committed to svn. Validating the update.

Keywords: (none) => advisory, validated_update
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2023-07-19 21:55:04 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0236.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED