CVEs have been assigned for issues fixed in libidn 1.33: http://openwall.com/lists/oss-security/2016/07/21/4 https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html Freeze push requested for Cauldron. Mageia 5 is also affected.
Whiteboard: (none) => MGA5TOO
Updated packages uploaded for Mageia 5 and Cauldron. libidn is used by wget and curl, so those can be used to test this. Advisory: ======================== Updated libidn packages fix security vulnerabilities: Out-of-bounds stack read in libidn before 1.33 in idna_to_ascii_4i (CVE-2016-6261). Out-of-bounds-read in libidn when reading one zero byte as input (CVE-2015-8948, CVE-2016-6262). In libidn before 1.33, stringprep_utf8_nfkc_normalize would crash when presented with invalid UTF-8 (CVE-2016-6263). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8948 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6261 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6262 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6263 https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html http://openwall.com/lists/oss-security/2016/07/21/4 ======================== Updated packages in core/updates_testing: ======================== libidn11-1.33-1.mga5 libidn-devel-1.33-1.mga5 idn-1.33-1.mga5 libidn11-java-1.33-1.mga5 libidn11-mono-1.33-1.mga5 from libidn-1.33-1.mga5.src.rpm
Version: Cauldron => 5Assignee: bugsquad => qa-bugsWhiteboard: MGA5TOO => has_procedure
Note that some of the security issues have tests in the package's test suite, which is run at build time. General testing of wget and curl should suffice.
wget and curl work fine on Mageia 5 i586.
Whiteboard: has_procedure => has_procedure MGA5-32-OK
wget and curl work fine on Mageia 5 x86_64.
Whiteboard: has_procedure MGA5-32-OK => has_procedure MGA5-32-OK MGA5-64-OK
Fedora has issued an advisory for this on July 24: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EQDCSQNM5LICMOIEU5H63QDQ4Z436KC5/
URL: (none) => http://lwn.net/Vulnerabilities/695325/
Keywords: (none) => validated_updateWhiteboard: has_procedure MGA5-32-OK MGA5-64-OK => has_procedure MGA5-32-OK MGA5-64-OK advisoryCC: (none) => davidwhodgins, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0269.html
Status: NEW => RESOLVEDResolution: (none) => FIXED