| Summary: | qpdf new security issue CVE-2024-24246 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Nicolas Salguero <nicolas.salguero> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | andrewsfarm, geiger.david68210, sysadmin-bugs |
| Version: | 9 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA9-64-OK | ||
| Source RPM: | qpdf-11.3.0-1.mga9.src.rpm | CVE: | CVE-2024-24246 |
| Status comment: | |||
|
Description
Nicolas Salguero
2024-03-11 16:12:39 CET
Nicolas Salguero
2024-03-11 16:13:55 CET
CVE:
(none) =>
CVE-2024-24246 Done for Cauldron! Patch from fedora do not apply for our 11.3.0 release :( Version:
Cauldron =>
9 Sooner done than said! Is there any reason why we cannot push v11.9.0 to Mageia 9? Even the M9 version is recent: Mar 14 2023 - 11.3.0 - update qpdf-relax patch from fedora and it has been version updated 3 times even before 11.9.0. CC:
(none) =>
lewyssmith Yeah we've updated it without issue in the past. Thanks for this confirmation. Keep in touch! More for DavidG... CC:
lewyssmith =>
(none) Suggested advisory: ======================== The updated packages fix a security vulnerability: Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h. (CVE-2024-24246) References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4WLK6ICPJUMOJNHZQWXAA5MPXG5JHZZL/ ======================== Updated packages in core/updates_testing: ======================== lib(64)qpdf29-11.9.0-1.mga9 lib(64)qpdf-devel-11.9.0-1.mga9 qpdf-11.9.0-1.mga9 qpdf-doc-11.9.0-1.mga9 from SRPM: qpdf-11.9.0-1.mga9.src.rpm Assignee:
geiger.david68210 =>
qa-bugs The CVE description sounds wrong. It says the issue is in 11.9.0, but we're saying the fix was in that version. Maybe it's supposed to say before, rather than in?
katnatek
2024-03-19 20:13:43 CET
Keywords:
(none) =>
advisory RH mageia 9 x86_64
Before the update
qpdf --json-input POC_qpdf11-9-0_heap-buffer-overflow output_json.pdf
WARNING: POC_qpdf11-9-0_heap-buffer-overflow (obj:3 0 R, offset 738): "stream.data" must be a string
Violación de segmento (`core' generado)
Update without issues
installing qpdf-11.9.0-1.mga9.x86_64.rpm lib64qpdf29-11.9.0-1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing... ######################################################################################
1/2: lib64qpdf29 ######################################################################################
2/2: qpdf ######################################################################################
1/2: removing qpdf-11.3.0-1.mga9.x86_64
######################################################################################
2/2: removing lib64qpdf29-11.3.0-1.mga9.x86_64
######################################################################################
After the update
qpdf --json-input POC_qpdf11-9-0_heap-buffer-overflow output_json.pdf
WARNING: POC_qpdf11-9-0_heap-buffer-overflow (obj:3 0 R, offset 738): "stream.data" must be a string
qpdf: POC_qpdf11-9-0_heap-buffer-overflow: JSON: offset 1664: expected ',' or '}'
katnatek
2024-03-19 21:30:04 CET
CC:
(none) =>
andrewsfarm
katnatek
2024-03-19 21:30:19 CET
Whiteboard:
(none) =>
MGA9-64-OK Validating. Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0076.html Resolution:
(none) =>
FIXED |