https://bugzilla.redhat.com/show_bug.cgi?id=1647043
Bug ID: 1647043
Summary: CVE-2018-18751 gettext: double free in
default_add_message in read-catalog.c
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: ahardin(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dajohnso(a)redhat.com,
dclarizi(a)redhat.com, dedgar(a)redhat.com,
dmetzger(a)redhat.com, dueno(a)redhat.com,
eng-i18n-bugs(a)redhat.com, eparis(a)redhat.com,
erik-fedora(a)vanpienbroek.nl, gblomqui(a)redhat.com,
gmccullo(a)redhat.com, gtanzill(a)redhat.com,
i18n-bugs(a)lists.fedoraproject.org, jfrey(a)redhat.com,
jgoulding(a)redhat.com, jhardy(a)redhat.com,
jokerman(a)redhat.com, jprause(a)redhat.com,
kdixon(a)redhat.com, mchappel(a)redhat.com,
nphilipp(a)redhat.com, obarenbo(a)redhat.com,
petersen(a)redhat.com, praiskup(a)redhat.com,
rh-spice-bugs(a)redhat.com, rjones(a)redhat.com,
roliveri(a)redhat.com, simaishi(a)redhat.com
An issue was discovered in GNU gettext 0.19.8. There is a double free in
default_add_message in read-catalog.c, related to an invalid free in
po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
References:
https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-gettext-0.19.8.1/...
https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-gettext-0.19.8.1/...
--
You are receiving this mail because:
You are on the CC list for the bug.