Attachment 229256 Details for Bug 259534 – security/vuxml: add entry for archivers/advancecomp

[patch] security/vuxml: add entry for archivers/advancecomp

0001-security-vuxml-add-entry-for-archivers-advancecomp.patch (text/plain), 1.79 KB, created by Robert Clausecker on 2021-11-03 23:45:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Robert Clausecker

Created: 2021-11-03 23:45:17 UTC

Size: 1.79 KB

patch

obsolete

>From 255a210ca27ab70943b66aa1974742f48c246986 Mon Sep 17 00:00:00 2001
>From: Robert Clausecker <fuz@fuz.su>
>Date: Thu, 4 Nov 2021 00:44:08 +0100
>Subject: [PATCH] security/vuxml: add entry for archivers/advancecomp
>
>---
> security/vuxml/vuln-2021.xml | 34 ++++++++++++++++++++++++++++++++++
> 1 file changed, 34 insertions(+)
>
>diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml
>index b6e8d83c08ad..704748cdee6d 100644
>--- a/security/vuxml/vuln-2021.xml
>+++ b/security/vuxml/vuln-2021.xml
>@@ -1,3 +1,37 @@
>+ <vuln vid="0bf816f6-3cfe-11ec-86cd-dca632b19f10">
>+ <topic>advancecomp -- multiple vulnerabilities</topic>
>+ <affects>
>+ <package>
>+	<name>advancecomp</name>
>+	<range><lt>2.2.*</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	Joonun Jang reports:
>+	<blockquote cite="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889270">
>+	 heap buffer overflow running advzip with "-l poc" option
>+
>+	 Running 'advzip -l poc' with the attached file raises heap buffer overflow
>+	 which may allow a remote attacker to cause unspecified impact including denial-of-service attack.
>+	 I expected the program to terminate without segfault, but the program crashes as follow. [...]
>+	 
>+	</blockquote>
>+	and other vulnerabilities.
>+ </body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2018-1056</cvename>
>+ <cvename>CVE-2019-8379</cvename>
>+ <cvename>CVE-2019-8383</cvename>
>+ <cvename>CVE-2019-9210</cvename>
>+ </references>
>+ <dates>
>+ <discovery>2018-07-29</discovery>
>+ <entry>2021-11-04</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="33557582-3958-11ec-90ba-001b217b3468">
> <topic>Gitlab -- Multiple Vulnerabilities</topic>
> <affects>
>-- 
>2.32.0
>

Flags:

fuz: maintainer-approval+

Actions: View | Diff

Attachments on bug 259534: 229127 | 229256 | 229289