Date: Sun, 18 May 2014 13:43:18 +0200 From: Peter Bex <Peter.Bex@...all.nl> To: Open Source Security <oss-security@...ts.openwall.com> Subject: CVE request for buffer overrun in CHICKEN Scheme Hi all, I would like to request a CVE for a buffer overrun bug in CHICKEN Scheme which is very similar to CVE-2013-4385. It affects a very particular, not very common use of the read-u8vector! procedure. If given a buffer and #f (the Scheme value for "false") as the buffer's size (which should trigger automatic size detection but doesn't), it will read beyond the buffer, until the input port (file, socket, etc) is exhausted. This may result in the typical potential remote code execution or denial of service; in CHICKEN, these buffers are initially allocated on the stack and moved to the heap upon GC. In normal usage, users would usually pass in the buffer's size. This is also the workaround for this bug. For the official announcement, see http://lists.gnu.org/archive/html/chicken-announce/2014-05/msg00001.html The patch on the discussion list is http://lists.gnu.org/archive/html/chicken-hackers/2014-05/msg00032.html and it got applied as http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=commit;h=1d06ce7e21c7e903ca5dca11fda6fcf2cc52de5e All versions of CHICKEN prior to 4.9.0 (soon to be released) and 18.104.22.168 (not yet(?) released) are affected. Cheers, Peter Bex -- http://www.more-magic.net
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.