https://bugzilla.redhat.com/show_bug.cgi?id=1529312
Bug ID: 1529312 Summary: CVE-2017-17810 nasm: Segfault via mishandled macro calls in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: java-sig-commits@lists.fedoraproject.org, mizdebsk@redhat.com, msimacek@redhat.com
In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments.
Upstream bug:
https://bugzilla.nasm.us/show_bug.cgi?id=3392431
Upstream patch:
http://repo.or.cz/nasm.git/commit/59ce1c67b16967c652765e62aa130b7e43f21dd4
https://bugzilla.redhat.com/show_bug.cgi?id=1529312
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20171221, |impact=low,public=20171221, |reported=20171221,source=cv |reported=20171221,source=cv |e,cvss3=4.0/CVSS:3.0/AV:L/A |e,cvss3=4.0/CVSS:3.0/AV:L/A |C:L/PR:N/UI:N/S:U/C:N/I:N/A |C:L/PR:N/UI:N/S:U/C:N/I:N/A |:L,cwe=CWE-20,fedora-all/na |:L,cwe=CWE-20,fedora-all/na |sm=affected,rhel-5/nasm=new |sm=affected,rhel-5/nasm=won |,rhel-6/nasm=new,rhel-7/nas |tifx,rhel-6/nasm=wontifx,rh |m=new,rhel-8/nasm=new |el-7/nasm=wontifx
https://bugzilla.redhat.com/show_bug.cgi?id=1529312
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1529336
--- Comment #1 from Pedro Sampaio psampaio@redhat.com --- Created nasm tracking bugs for this issue:
Affects: fedora-all [bug 1529336]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1529336 [Bug 1529336] CVE-2017-17810 CVE-2017-17811 CVE-2017-17812 CVE-2017-17813 CVE-2017-17814 CVE-2017-17815 CVE-2017-17816 CVE-2017-17817 CVE-2017-17818 CVE-2017-17819 CVE-2017-17820 nasm: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1529312 Bug 1529312 depends on bug 1529336, which changed state.
Bug 1529336 Summary: CVE-2017-17810 CVE-2017-17811 CVE-2017-17812 CVE-2017-17813 CVE-2017-17814 CVE-2017-17815 CVE-2017-17816 CVE-2017-17817 CVE-2017-17818 CVE-2017-17819 CVE-2017-17820 nasm: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1529336
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1529312
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20171221, |impact=low,public=20171221, |reported=20171221,source=cv |reported=20171221,source=cv |e,cvss3=4.0/CVSS:3.0/AV:L/A |e,cvss3=4.0/CVSS:3.0/AV:L/A |C:L/PR:N/UI:N/S:U/C:N/I:N/A |C:L/PR:N/UI:N/S:U/C:N/I:N/A |:L,cwe=CWE-20,fedora-all/na |:L,cwe=CWE-20,fedora-all/na |sm=affected,rhel-5/nasm=won |sm=affected,rhel-5/nasm=won |tifx,rhel-6/nasm=wontifx,rh |tfix,rhel-6/nasm=wontfix,rh |el-7/nasm=wontifx |el-7/nasm=wontfix
java-sig-commits@lists.fedoraproject.org