Bug 18293 - libksba: three vulnerabilities
Summary: libksba: three vulnerabilities
Status: RESOLVED INVALID
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal critical
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/685291/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-04-29 08:17 CEST by Nic Baxter
Modified: 2016-04-29 09:08 CEST (History)
0 users

See Also:
Source RPM:
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nic Baxter 2016-04-29 08:17:17 CEST 
libksba is vulnerable to two integer overflows and a Denial of Service vulnerability. 

    Denial of Service due to stack overflow in src/ber-decoder.c
    http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=07116a314f4dcd4d96990bbd74db95a03a9f650a
    Integer overflow in the BER decoder src/ber-decoder.c
    http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=aea7b6032865740478ca4b706850a5217f1c3887
    Integer overflow in the DN decoder src/dn.c
    http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=243d12fdec66a4360fbb3e307a046b39b5b4ffc3
Nic Baxter 2016-04-29 08:18:32 CEST

URL: (none) => http://lwn.net/Vulnerabilities/685291/
Hardware: All => i586

Comment 1 Rémi Verschelde 2016-04-29 08:37:30 CEST 
Thanks for the report. The Gentoo advisory mentions that version >= 1.3.3 are unaffected, and it's the version we have in Mageia 5 and Cauldron, so we should be good.

Status: NEW => RESOLVED
Resolution: (none) => INVALID

Comment 2 Rémi Verschelde 2016-04-29 08:37:56 CEST 
Forgot the reference: http://lwn.net/Alerts/685271/
Comment 3 Nic Baxter 2016-04-29 08:47:06 CEST 
I missed the version - sorry.
Comment 4 Rémi Verschelde 2016-04-29 09:08:21 CEST 
No problem - we're all learning how we can work as a team and share such information regarding security vulnerabilities, it'll take some time until we find the proper workflow :)
Note You need to log in before you can comment on or make changes to this bug.