+++ This bug was initially created as a clone of Bug #17731 +++ A CVE was requested for an integer overflow that affects gtk+ and several apps: http://openwall.com/lists/oss-security/2016/02/10/2 A commit upstream in gtk+ to fix it is linked in the message above.
Pushed new release [1] to core/updates_testing which fixes the issue. [1] thunar-1.6.6-1.1.mga5
Assignee: bugsquad => qa-bugs
SRPM: thunar-1.6.6-1.1.mga5 RPMS: thunar-1.6.6-1.1.mga5 lib(|64)thunarx2_0-1.6.6-1.1.mga5 lib(|64)thunarx-devel-1.6.6-1.1.mga5
CC: cvargas, jani.valimaa, luigiwalser, matteo.pasotti, olav, tarakbumba => (none)Severity: normal => major
CVE: (none) => CVE-2013-7447
URL: (none) => http://www.openwall.com/lists/oss-security/2016/02/10/2
Suggested advisory: ======================== Updated thunar packages fix security vulnerability: Due to a logic error, an attempt to allocate a large block of memory fails in thunar_gdk_cairo_set_surface, leading to a crash of thunar (CVE-2013-7447). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7447 http://openwall.com/lists/oss-security/2016/02/10/6
Testing M5 x64, real HW, XFCE, OK lib64thunarx2_0-1.6.6-1.1.mga5 thunar-1.6.6-1.1.mga5 [+ thunar-volman-0.8.1-1.mga5] Played with directory browsing, opening by double-clicking all sorts of files, USB stick, DVD. Everything seems normal.
CC: (none) => lewyssmithWhiteboard: (none) => MGA5-64-OK
Reply to comment #4 Are you able to run this on 32-bit Lewis, real or virtual? If not I can try it.
CC: (none) => tarazed25
mga5 i586 in virtualbox Mate [lcl@cursa ~/qa]$ sudo urpmi thunar Package thunar-1.6.6-1.mga5.i586 is already installed Installed thunar-1.6.6-1.1.mga5.i586 libthunarx2_0-1.6.6-1.1.mga5 # urpmi thunar-volman Package thunar-volman-0.8.1-1.mga5.i586 is already installed Thunar appeared under System Tools in the Applications menu. Brought up image viewer by double-clicking an image file. Invoked Amarok on an ogg file. Examined a tar file. DragonPlayer came up on double-clicking an already downloaded Youtube video clip. Installed latex2rtf from an rpm lying around in Downloads. Imported documents.tar from a USB drive and extracted the files. Opened Documents/ and double-clicked on an odt file to invoke Libreoffice writer. Finally, tried network browsing but nothing happened except that "network:///" appeared in the address bar. On the host machine thunar -> Browse Network raises an error whereas caja (the Mate default file manager) allows remote logins. For caja in the vm 'Browse Network' does nothing either so that may be a restriction in virtual machines. If there is a bug for network browsing in thunar on real hardware it is probably irrelevant to this update. Will wait for feedback on that one. If David agrees that it can be ignored here I shall OK the update for 32-bit. Might there be an addon for network browsing?
As a rider to comment #6 I tried out Thunar in xfce where thunar is the default file manager and it behaved as in Mate with a few differences in file associations. e.g. to play a music track Amarok needed to be selected rather than going with the default Parole media player which foundered on a GStreamer backend error (Could not initialise Xv output). Pretty sure that is irrelevant to the current testing.
The lack of network browsing in a VM is likely down to VM network config Len. If using vbox set it to bridged network for it to be able to access other computers on the lan. Testing you've done for Thunar is perfectly good though.
@Claire. Yes I guess it must be down to configuration, although I do use a bridged network; doing scp's back and forth all the time. We can let this run then. Validating, and would someone from sysadmin please push to Mageia 5 core updates please.
Whiteboard: MGA5-64-OK => MGA5-64-OK MGA5-32-OK
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
advisory uploaded.
Whiteboard: MGA5-64-OK MGA5-32-OK => has_procedure advisory MGA5-64-OK MGA5-32-OK
URL: http://www.openwall.com/lists/oss-security/2016/02/10/2 => http://lwn.net/Vulnerabilities/675834/
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0071.html
Status: NEW => RESOLVEDResolution: (none) => FIXED