Groups > linux.debian.bugs.dist > #771760

Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp

From	László Böszörményi (GCS) <gcs@debian.org>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp
Date	2016-10-04 23:10 +0200
Message-ID	<soF8l-81O-7@gated-at.bofh.it> (permalink)
References	<skCsp-6Lq-3@gated-at.bofh.it> <sn4DU-1im-39@gated-at.bofh.it> <snD8B-7O3-3@gated-at.bofh.it> <soaHf-4Vc-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon, Oct 3, 2016 at 2:37 PM, Salvatore Bonaccorso <carnil@debian.org> wrote:
> On Sat, Oct 01, 2016 at 08:45:20PM -0400, Roberto C. Sánchez wrote:
>> I tried for quite some time to reproduce this based on the original PHP
>> bug report, but I was unable.  I have annotated the security tracker
>> with my (lack of) findings so far.
 That doesn't mean it's not vulnerable as Salvatore already noted.

> Laszlo, do you know more already? Other distributions seem in the same
> boat, like Red Hat in
> https://bugzilla.redhat.com/show_bug.cgi?id=1377361#c3
 Sorry, I was on a trip and just arrived back on Sunday evening. Did
an other security upload and then killed my machine. Minus one
keyboard (a special one) and a monitor. Only now could boot the
remaining hardware.
I don't know more about this issue - upstream keep such bugreports
secret, if any. I don't have a good connection with them (yet), but
will try to know more about this.

Regards,
Laszlo/GCS

Thread

Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Roberto C. Sánchez <roberto@connexer.com> - 2016-09-30 14:00 +0200
  Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Roberto C. Sánchez <roberto@connexer.com> - 2016-10-02 02:50 +0200
    Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Salvatore Bonaccorso <carnil@debian.org> - 2016-10-03 14:40 +0200
      Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Roberto C. Sánchez <roberto@connexer.com> - 2016-10-03 16:00 +0200
      Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp László Böszörményi (GCS) <gcs@debian.org> - 2016-10-04 23:10 +0200
        Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Salvatore Bonaccorso <carnil@debian.org> - 2016-10-05 07:20 +0200
        Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Roberto C. Sánchez <roberto@connexer.com> - 2016-10-25 17:50 +0200

csiph-web