Bug 30622 - gerbv new security issues CVE-2021-4039[134] and CVE-2021-4040[01]
Summary: gerbv new security issues CVE-2021-4039[134] and CVE-2021-4040[01]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-07-10 20:55 CEST by David Walser
Modified: 2022-07-13 22:45 CEST (History)
5 users (show)

See Also:
Source RPM: gerbv-2.7.0-3.1.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2022-07-10 20:55:12 CEST
Fedora has issued an advisory on July 9:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TUM5GIUZJ7AVHVCXDZW6ZVCAPV2ISN47/

The issues are fixed upstream in 2.9.2:
https://github.com/gerbv/gerbv/releases

Mageia 8 is also affected.
David Walser 2022-07-10 20:55:26 CEST

Status comment: (none) => Fixed upstream in 2.9.2
Whiteboard: (none) => MGA8TOO

Comment 1 Lewis Smith 2022-07-10 21:18:57 CEST
2.7.0 we had over 3y ago!

This package has beein committed by different people over the years, so asigning this update globally.
CC'ing NicolasS as you did a patch not so long ago.

Assignee: bugsquad => pkg-bugs
CC: (none) => nicolas.salguero

Comment 2 Nicolas Salguero 2022-07-11 15:01:32 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). (CVE-2021-40391)

An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit 71493260). (CVE-2021-40393, CVE-2021-40394)

An out-of-bounds read vulnerability exists in the RS-274X aperture macro outline primitive functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and the forked version of Gerbv (commit d7f42a9a). (CVE-2021-40400)

A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. (CVE-2021-40401)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40391
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40393
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40394
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40400
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40401
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TUM5GIUZJ7AVHVCXDZW6ZVCAPV2ISN47/
========================

Updated packages in core/updates_testing:
========================
gerbv-2.7.3-1.mga8
gerbv-examples-2.7.3-1.mga8
lib(64)gerbv1-2.7.3-1.mga8
lib(64)gerbv-devel-2.7.3-1.mga8

from SRPM:
gerbv-2.7.3-1.mga8.src.rpm

Assignee: pkg-bugs => qa-bugs
Source RPM: gerbv-2.7.0-5.mga9.src.rpm => gerbv-2.7.0-3.1.mga8.src.rpm
Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)
Status: NEW => ASSIGNED
Status comment: Fixed upstream in 2.9.2 => (none)

Comment 3 Herman Viaene 2022-07-13 11:00:23 CEST
MGA8-64 Plasma on Acer Aspire 5253
No installation issues.
Following bug 30391, launched gerbv from CLI, opened examples /usr/share/gerbv/example/am-test/am-test.gbx and /usr/share/gerbv/example/amacro-ref/full-ex.grb and in both I could select some objects and dispay the properties.
Looks good.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => herman.viaene

Comment 4 Thomas Andrews 2022-07-13 13:58:14 CEST
Validating. Advisory in Comment 2.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2022-07-13 19:06:44 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 5 Mageia Robot 2022-07-13 22:45:04 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0260.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.