Date: Thu, 08 Apr 2010 20:55:57 +1000 From: Tim Starling <tstarling@...imedia.org> To: Jan Lieskovsky <jlieskov@...hat.com> CC: oss-security@...ts.openwall.com, Jean-François Moine <moinejf@...e.fr>, "Steven M. Christey" <coley@...us.mitre.org>, Gerard Milmeister <gemi@...ewin.ch> Subject: Re: CVE Request -- Abcm2ps v5.9.12 -- multiple unspecified vulnerabilities I found: * A BSS overflow from an overlong command-line parameter (-O) * BSS overflows in a collection of output macros (PUT0, PUT1, etc.) exploitable using crafted input files * A stack overflow in trim_title(), also exploitable using input files This is assuming my understanding of the linux memory model is correct and uninitialised global variables are stored in the BSS segment. They were all the classic sort of overflow, with arbitrary-length strings copied into fixed-sized buffers. Anyway, "multiple buffer overflow vulnerabilities" is probably a good enough summary for most of you. I haven't reviewed the patch. -- Tim Starling Jan Lieskovsky wrote: > Resending the query again (as first time used improper address > for Jean-François Moine :(). > > Apologize other parties for unwanted spam. > > Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Response Team > > > Jan Lieskovsky wrote: >> Hi Steve, vendors, >> >> Abcm2ps upstream has released: >>  http://moinejf.free.fr/ >>  http://moinejf.free.fr/abcm2ps-5.9.12.tar.gz >> >> latest v5.9.12 version, addressing >> "some security vulnerabilities" >>  http://moinejf.free.fr/abcm2ps-5.txt >> >> References: >>  http://secunia.com/advisories/39345/ >> >> Jean, Tim, could you please provide further details how many >> and what kind of flaws (i.e. describe each of the deficiencies shortly) >> has been addressed in this Abcm2ps release? (so we know, how >> many CVE identifiers: >>  http://cve.mitre.org/ >> >> and each of them for what, should be assigned [without comparing >> source code differences among Abcm2ps v5.9.12 and Abcm2ps v5.9.11 >> versions, potentially resulting in situation, we omit something] ) >> >> Jean, Tim -- thanks in advance for your cooperation. >> >> Regards, Jan. >> -- >> Jan iankko Lieskovsky / Red Hat Security Response Team >> >> >> >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.