Bug 18422 - dhcpcd new security issue CVE-2014-7913
Summary: dhcpcd new security issue CVE-2014-7913
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/688209/
Whiteboard: MGA5-32-OK advisory
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-05-09 23:37 CEST by David Walser
Modified: 2016-05-20 18:06 CEST (History)
3 users (show)

See Also:
Source RPM: dhcpcd-6.10.0-1.mga5.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Comment 1 Marja Van Waes 2016-05-10 12:39:50 CEST 
Assigning to dhpcd maintainer

CC: (none) => marja11
Assignee: bugsquad => shlomif

Comment 2 David Walser 2016-05-19 00:24:58 CEST 
Updated package uploaded for Mageia 5.

Advisory:
========================

Updated dhcpcd package fixes security vulnerability:

The print_option function in dhcp-common.c in dhcpcd through 6.10.2
misinterprets the return value of the snprintf function, which allows remote
DHCP servers to execute arbitrary code or cause a denial of service (memory
corruption) via a crafted message (CVE-2014-7913).

The dhcpcd package has been updated to version 6.11.0 which fixes this issue
and has several other bug fixes and enhancements.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7913
http://roy.marples.name/archives/dhcpcd-discuss/2016/1146.html
http://roy.marples.name/archives/dhcpcd-discuss/2016/1244.html
http://roy.marples.name/archives/dhcpcd-discuss/2016/1251.html
http://roy.marples.name/archives/dhcpcd-discuss/2016/1292.html
========================

Updated packages in core/updates_testing:
========================
dhcpcd-6.11.0-1.mga5

from dhcpcd-6.11.0-1.mga5.src.rpm

Assignee: shlomif => qa-bugs

Comment 3 David Walser 2016-05-20 04:53:15 CEST 
Works fine on Mageia 5 i586.

Whiteboard: (none) => MGA5-32-OK

Dave Hodgins 2016-05-20 11:39:00 CEST

Keywords: (none) => validated_update
Whiteboard: MGA5-32-OK => MGA5-32-OK advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 4 Mageia Robot 2016-05-20 13:39:28 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0190.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2016-05-20 18:06:41 CEST

URL: (none) => http://lwn.net/Vulnerabilities/688209/
Note You need to log in before you can comment on or make changes to this bug.