A few security issues in patch have been announced today (February 13): http://openwall.com/lists/oss-security/2018/02/13/3 It looks like the first two have been fixed upstream and the third hasn't been. Mageia 5 and Mageia 6 are also affected.
Whiteboard: (none) => MGA6TOOStatus comment: (none) => First two issues fixed upstream, third not fixed yet
Assigning to the registered maintainer.
CC: (none) => marja11Assignee: bugsquad => tmb
Flags: (none) => in_errata7-CC: (none) => saintdoux95
comment telecharger ce patch merci
Flags: in_errata7- => (none)
Patch 2.7.6 itself fixed CVE-2016-10713, CVE-2018-6951, CVE-2018-6952, according to this Fedora advisory on February 20: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/32RICOL2D42H2MIK22XRP4LDOLKVPUFP/
Whiteboard: MGA6TOO => MGA6TOO, MGA5TOO
Another issue, CVE-2018-1000156: http://openwall.com/lists/oss-security/2018/04/06/1
Ubuntu has issued an advisory for this on April 10: https://usn.ubuntu.com/3624-1/
SUSE has issued an advisory for this today (May 2): https://lists.opensuse.org/opensuse-security-announce/2018-05/msg00001.html
openSUSE has issued an advisory for this today (May 3): https://lists.opensuse.org/opensuse-updates/2018-05/msg00008.html
Fedora advisory for CVE-2018-1000156 from May 9: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RUC23G7ZFQGZFYM2XXLHLOLBR6Y3FTMH/
Fixed in cauldron in patch-2.7.6-2.mga7 Mga6 package updated to 2.7.6 and added the fix for CVE-2018-1000156 SRPM and RPM name: patch-2.7.6-1.mga6
Assignee: tmb => qa-bugsWhiteboard: MGA6TOO, MGA5TOO => (none)Version: Cauldron => 6
Advisory: ======================== Updated patch package fixes security vulnerabilities: It was discovered that Patch incorrectly handled certain files. An attacker could possibly use this to cause a denial of service (CVE-2016-10713). It was discovered that Patch incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service (CVE-2018-6951). It was discovered that Patch incorrectly handled certain input validation. An attacker could possibly use this to execute arbitrary code (CVE-2018-1000156). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10713 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6951 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000156 https://usn.ubuntu.com/3624-1/ ======================== Updated packages in core/updates_testing: ======================== patch-2.7.6-1.mga5 patch-2.7.6-1.mga6 from SRPMS: patch-2.7.6-1.mga5.src.rpm patch-2.7.6-1.mga6.src.rpm
Whiteboard: (none) => MGA5TOOSeverity: normal => major
MGA5-32 on Dell Latitude D600 Xfce No installation issues. Followed test as per bug 16436 Comment 3: $ mkdir dir1 $ ln -s dir1 dir2 $ echo a > dir2/a $ echo b > dir2/b $ diff -u dir2/a dir2/b > foo.diff $ patch -p0 < foo.diff $ more dir2/a b Seems OK to me.
Whiteboard: MGA5TOO => MGA5TOO MGA5-32-OKCC: (none) => herman.viaene
Installed and tested without issue. System: Mageia 6, x86_64, Intel CPU. Tested using the trigger diff file at https://savannah.gnu.org/bugs/index.php?45990#attached Also tested in normal use. No problems noticed. $ uname -a Linux marte 4.14.44-desktop-2.mga6 #1 SMP Mon May 28 22:35:45 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux $ rpm -q patch patch-2.7.6-1.mga6
Whiteboard: MGA5TOO MGA5-32-OK => MGA5TOO MGA5-32-OK MGA6-64-OKCC: (none) => mageia
$ uname -a Linux localhost 4.14.44-desktop-2.mga6 #1 SMP Mon May 28 23:51:04 UTC 2018 i686 i686 i686 GNU/Linux The following 2 packages are going to be installed: - meta-task-6-3.1.mga6.noarch - patch-2.7.6-1.mga6.i586 43KB of additional disk space will be used. 164KB of packages will be retrieved. Is it ok to continue? --- I followed the same example above and it worked.
Whiteboard: MGA5TOO MGA5-32-OK MGA6-64-OK => MGA5TOO MGA5-32-OK MGA6-64-OK mga6-32-okCC: (none) => brtians1
Validating
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Advisoried
Keywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0277.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED