oss-security - Re: CVE request

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 29 Oct 2008 10:22:36 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - libgadu

On Tue, 28 Oct 2008 11:23:56 +0100 Tomas Hoger <thoger@...hat.com>
wrote:

> New upstream libgadu version 1.8.2 is marked as security update and
> seems to fix a buffer over-read flaw:
> 
> http://toxygen.net/libgadu/releases/1.8.2.html
> https://bugzilla.redhat.com/show_bug.cgi?id=468830
> https://admin.fedoraproject.org/updates/libgadu-1.8.2-1.fc9

Just for the future reference:

CVE-2008-4776:
libgadu before 1.8.2 allows remote servers to cause a denial of
service (crash) via a contact description with a large length, which
triggers a buffer over-read.

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.