Bug 25995 - dia new security issue CVE-2019-19451
Summary: dia new security issue CVE-2019-19451
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-12-31 04:58 CET by David Walser
Modified: 2020-01-05 16:40 CET (History)
7 users (show)

See Also:
Source RPM: dia-0.97.3-10.mga8.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2019-12-31 04:58:40 CET 
SUSE has issued an advisory on December 27:
http://lists.suse.com/pipermail/sle-security-updates/2019-December/006293.html

Mageia 7 is also affected.
David Walser 2019-12-31 04:58:48 CET

Whiteboard: (none) => MGA7TOO

Comment 1 Lewis Smith 2019-12-31 19:47:40 CET 
Assigning globally; CC Joseph as a recent committer.
---
When the update becomes available, I offer to test it (if possible). Dia I knew.

CC: (none) => joequant, lewyssmith
Assignee: bugsquad => pkg-bugs

Comment 2 David GEIGER 2020-01-04 20:08:11 CET 
Done for both Cauldron and mga7!

CC: (none) => geiger.david68210

Comment 3 Morgan Leijström 2020-01-05 00:08:45 CET 
7 64 bit updated cleanly.

Swedish locale OK, looking good, made a small diagram.
I dont know how to make a filename with invalid encoding

Output in konsole where i launched it from: ** (dia:15131): WARNING **: 00:02:08.353: expected enumeration type GtkUpdateType, but got GtkPolicyType instead

CC: (none) => fri

David Walser 2020-01-05 04:45:29 CET

Whiteboard: MGA7TOO => (none)
Version: Cauldron => 7

Comment 4 David Walser 2020-01-05 04:47:21 CET 
Advisory:
========================

Updated dia package fixes security vulnerability:

An endless loop on filenames with invalid encoding (CVE-2019-19451).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19451
http://lists.suse.com/pipermail/sle-security-updates/2019-December/006293.html
========================

Updated packages in core/updates_testing:
========================
dia-0.97.3-8.1.mga7

from dia-0.97.3-8.1.mga7.src.rpm

Assignee: pkg-bugs => qa-bugs

Comment 5 Len Lawrence 2020-01-05 14:47:32 CET 
dia already installed.
This one looks dangerous to test.
https://gitlab.gnome.org/GNOME/dia/issues/428

$ touch $'\374'.dia
$ dia $'\374'
Filename conversion failed: �
<repeated many times>
Ctrl-C

Updated the drawing package and repeated the test.
$ dia $'\374'
Filename conversion failed: �
<this appears only once>

The diagram editor appears with a tools interface and a default diagram Diagram1.dia.  Added a few blocks and squiggles and some coloured text then saved file.
Reopened dia on the new file and it loaded fine.
Good for 64-bits.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => tarazed25

Thomas Backlund 2020-01-05 15:43:38 CET

Keywords: (none) => advisory, validated_update
CC: (none) => tmb, sysadmin-bugs

Comment 6 Mageia Robot 2020-01-05 16:40:19 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0022.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.