Ubuntu has issued an advisory on October :
https://ubuntu.com/security/notices/USN-7062-1

Fixed upstream in 1.14.53 already in Cauldron. Remains M9.

https://security-tracker.debian.org/tracker/libgsf
https://security-tracker.debian.org/tracker/source-package/libgsf
 but I could not find the patch.

Different packagers have dealt with this pkg, so assigning bug globally.

Assignee: bugsquad => pkg-bugs

Suggested advisory:
========================

The updated packages fix security vulnerabilities:

An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2024-36474)

An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. (CVE-2024-42415)

References:
https://lwn.net/Articles/993121/
https://ubuntu.com/security/notices/USN-7062-1
========================

Updated packages in core/updates_testing:
========================
lib(64)gsf1_114-1.14.50-1.1.mga9
lib(64)gsf-devel-1.14.50-1.1.mga9
lib(64)gsf-gir1-1.14.50-1.1.mga9
libgsf-1.14.50-1.1.mga9

from SRPM:
libgsf-1.14.50-1.1.mga9.src.rpm

Status comment: Fixed upstream in 1.14.53 and patch available from Debian => (none)
Status: NEW => ASSIGNED
Assignee: pkg-bugs => qa-bugs

MGA9-64 MATE on HP-Pavillion
No installation issues.
Ref bug 19932 for test: gchemtable works OK.
Good enough.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0337.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED