Debian-LTS has issued an advisory today (November 25): https://lwn.net/Alerts/707332/ Information about the fixes in the Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=844771 Mageia 5 is also affected.
Whiteboard: (none) => MGA5TOO
Assigning to the registered maintainer of gc
CC: (none) => marja11Assignee: bugsquad => luis.daniel.lucio
Patched packages uploaded for Mageia 5 and Cauldron. Advisory: ======================== Updated gc packages fix security vulnerability: Kuang-che Wu discovered that multiple integer overflow vulnerabilities existed in libgc. An attacker could use these to cause a denial of service (application crash) or possibly execute arbitrary code (CVE-2016-9427). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9427 https://www.ubuntu.com/usn/usn-3197-1/ ======================== Updated packages in core/updates_testing: ======================== libgc1-7.4.2-3.1.mga5 libgc-devel-7.4.2-3.1.mga5 from gc-7.4.2-3.1.mga5.src.rpm
Whiteboard: MGA5TOO => (none)Version: Cauldron => 5Assignee: luis.daniel.lucio => qa-bugs
Testing on x86_64, Mate, real hardware. It looks like libgc is a garbage collector used as a replacement for malloc in C and C++. The CVE link leads to http://www.openwall.com/lists/oss-security/2016/11/18/3 which lists many issues affecting w3m which is a text-based web browser, CVE-2016-9427 amongst them. w3m is a text-based web browser supported by Mageia but there do not appear to be any other applications which require this library. Installed w3m and tried it out: $ w3m http://exoplanet.eu That brought up the pager OK. Q to exit. Running under strace is not very satisfactory as all the text output goes to the trace file. At least it shows that libgc is being used. $ cat w3m.trace | grep gc open("/usr/lib64/libgc.so.1", O_RDONLY|O_CLOEXEC) = 3 read(3, "/lib64/libgc.so.1.0.3\n7fe0ba6060"..., 1024) = 1024 getcwd("/home/lcl/qa/libgc", 4096) = 19 Installed the two update packages and ran w3m again. The navigation commands worked and it was possible to follow hyperlinks. Another site: https://apod.nasa.gov/apod/astropix.html displayed an image in the terminal including colours and pressing return while the cursor was on the image brought up gqview (my default image viewer) with the same image. Passing this for 64-bits.
CC: (none) => tarazed25
Whiteboard: (none) => MGA5-64-OK
Similar testing on i586. Advisory committed to svn. Validating the update.
CC: (none) => davidwhodginsWhiteboard: MGA5-64-OK => MGA5-64-OK advisory
Whiteboard: MGA5-64-OK advisory => MGA5-64-OK advisory MGA5-32-OKKeywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0157.html
Status: NEW => RESOLVEDResolution: (none) => FIXED