Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108
Summary: CVE-NOID: Multiple stack/heap overflow vulnerabilities in adplug Product: Fedora Extras Version: fc5 Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: adplug AssignedTo: triad@df.lth.se ReportedBy: ville.skytta@iki.fi QAContact: extras-qa@fedoraproject.org CC: extras-qa@fedoraproject.org,fedora-security- list@redhat.com
Adplug <= 2.0 and CVS <= 2006-07-04 is reportedly affected by various heap and stack overflow vulnerabilities. No CVE id Yet.
http://seclists.org/lists/bugtraq/2006/Jul/0071.html
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108
ville.skytta@iki.fi changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-NOID: Multiple |CVE-2006-3581, CVE-2006- |stack/heap overflow |3582: Multiple stack/heap |vulnerabilities in adplug |overflow vulnerabilities in | |adplug
------- Additional Comments From ville.skytta@iki.fi 2006-07-14 15:04 EST ------- http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-3581 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-3582
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108
triad@df.lth.se changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution| |NEXTRELEASE
------- Additional Comments From triad@df.lth.se 2006-07-25 16:35 EST ------- Solved by upgrading to the new upstream version. Thanks for bringing this to attention, Ville! I hope not too many systems were compromised by rouge AdLib songs ;-)
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108
------- Additional Comments From ville.skytta@iki.fi 2006-07-26 16:47 EST ------- Thanks for the fix, but please be careful with shared library sonames in the future. Packages built against the old one and depending on it are likely to prevent the new fixed library package from being installed.
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108
------- Additional Comments From triad@df.lth.se 2006-07-26 17:02 EST ------- Yeah, sorry I know, in this case I happened to maintain all affected packages so just rebuilt them.
However, a first timer the question arise: how do I properly retire an .so file with security vulnerabilities? (Cannot find a good idea in any guidelines.)
Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report.
Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108
------- Additional Comments From ville.skytta@iki.fi 2006-07-28 12:17 EST ------- (In reply to comment #4)
Yeah, sorry I know, in this case I happened to maintain all affected packages
Yes, but only in FE. 3rd party repositories and local packages which use the libs are affected too.
However, a first timer the question arise: how do I properly retire an .so file with security vulnerabilities? (Cannot find a good idea in any guidelines.)
If doable and feasible, backporting only the security fixes and avoiding the soname change would be one way of handling it smoothly.
An incompatible upgrade policy and instructions are slowly in the works, but so far there is no consensus except that the very least one should do is to send a mail to fedora-maintainers, notifying about the issue, beforehand if at all possible so others (including non-FC/FE packagers) can prepare.
Here's one example which IMO is being handled well. https://www.redhat.com/archives/fedora-maintainers/2006-July/msg00397.html https://www.redhat.com/archives/fedora-maintainers/2006-July/msg00398.html
security@lists.fedoraproject.org