| Summary: | gc new security issue CVE-2012-2673 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | major | ||
| Priority: | Normal | CC: | davidwhodgins, n54, sysadmin-bugs, tmb |
| Version: | 2 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/504072/ | ||
| Whiteboard: | MGA1TOO MGA1-32-OK MGA1-64-OK MGA2-32-OK MGA2-64-OK | ||
| Source RPM: | gc-7.2-0.alpha6.3.mga2.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2012-07-01 19:44:08 CEST
David Walser
2012-07-01 19:44:23 CEST
CC:
(none) =>
jani.valimaa
David Walser
2012-07-01 19:44:31 CEST
CC:
(none) =>
n54
David Walser
2012-07-01 19:56:15 CEST
Whiteboard:
(none) =>
MGA2TOO, MGA1TOO
Kamil Rytarowski
2012-07-04 21:37:19 CEST
Assignee:
bugsquad =>
n54 Fixed in Cauldron
David Walser
2012-07-07 16:17:21 CEST
Version:
Cauldron =>
2
Jani Välimaa
2012-08-08 21:38:34 CEST
CC:
jani.valimaa =>
(none) Ubuntu has issued an advisory for this on August 28: http://www.ubuntu.com/usn/usn-1546-1/ They have patches for 7.1, which we have in Mageia 1. Patched packages uploaded for Mageia 1 and Mageia 2. Advisory: ======================== Updated gc packages fix security vulnerability: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc funtions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected (CVE-2012-2673). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2673 http://www.ubuntu.com/usn/usn-1546-1/ ======================== Updated packages in core/updates_testing: ======================== libgc1-7.1-7.1.mga1 libgc-devel-7.1-7.1.mga1 libgc-static-devel-7.1-7.1.mga1 libgc1-7.2-0.alpha6.3.1.mga2 libgc-devel-7.2-0.alpha6.3.1.mga2 from SRPMS: gc-7.1-7.1.mga1.src.rpm gc-7.2-0.alpha6.3.1.mga2.src.rpm Assignee:
n54 =>
qa-bugs Testing complete on Mageia 1 i586 and x86-64. Testing using inkscape under strace, confirming it's using the library. CC:
(none) =>
davidwhodgins Testing complete on Mageia 2 i586 and x86-64. Could someone from the sysadmin team push the srpm gc-7.2-0.alpha6.3.1.mga2.src.rpm from Mageia 2 Core Updates Testing to Core Updates and the srpm gc-7.1-7.1.mga1.src.rpm from Mageia 1 Core Updates Testing to Core Updates. Advisory: Updated gc packages fix security vulnerability: Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc funtions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected (CVE-2012-2673). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2673 http://www.ubuntu.com/usn/usn-1546-1/ https://bugs.mageia.org/show_bug.cgi?id=6652 Keywords:
(none) =>
validated_update Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0249 Status:
ASSIGNED =>
RESOLVED |