Bug 26231 - texlive new security issue CVE-2019-19601
Summary: texlive new security issue CVE-2019-19601
Status: RESOLVED INVALID
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: Marc Krämer
QA Contact: Sec team
URL:
Whiteboard: MGA7TOO
Keywords:
Depends on:
Blocks:
 
Reported: 2020-02-20 22:32 CET by David Walser
Modified: 2020-02-22 15:31 CET (History)
1 user (show)

See Also:
Source RPM: texlive-20190410-10.mga8.src.rpm
CVE:
Status comment: Patch available from Fedora

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2020-02-20 22:32:42 CET 
Fedora has issued an advisory on February 8:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JF3RU3VMLP5SS4MXAEKQKAGTSPN3KMHJ/

Mageia 7 is also affected.
David Walser 2020-02-20 22:32:53 CET

Whiteboard: (none) => MGA7TOO

David Walser 2020-02-21 17:54:25 CET

Status comment: (none) => Patch available from Fedora

Comment 1 Lewis Smith 2020-02-21 21:16:02 CET 
Assigning to Marc as the registered maintainer, CC wally as the main recent committer of 'texlive'.

Assignee: bugsquad => mageia
CC: (none) => jani.valimaa

Comment 2 Marc Krämer 2020-02-22 13:55:09 CET 
I don't think we are affected. This is only true if not linked against libkpathsea; but we link against it.

Running the testcase does not produce any buffer overflows. I thnik we can close this one.
Comment 3 David Walser 2020-02-22 15:31:26 CET 
Sometimes our compiler flags can protect us from actually seeing the buffer overflows, but I think that you're right that we're not hitting that codepath.

Status: NEW => RESOLVED
Resolution: (none) => INVALID
Note You need to log in before you can comment on or make changes to this bug.