Groups > linux.debian.bugs.dist > #771331

Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp
Date	2016-10-03 14:40 +0200
Message-ID	<soaHf-4Vc-3@gated-at.bofh.it> (permalink)
References	<skCsp-6Lq-3@gated-at.bofh.it> <sn4DU-1im-39@gated-at.bofh.it> <snD8B-7O3-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi 

On Sat, Oct 01, 2016 at 08:45:20PM -0400, Roberto C. Sánchez wrote:
> On Fri, Sep 30, 2016 at 07:45:33AM -0400, Roberto C. Sánchez wrote:
> > 
> > I am currently preparing an LTS upload for this vulnerability.
> > 
> I tried for quite some time to reproduce this based on the original PHP
> bug report, but I was unable.  I have annotated the security tracker
> with my (lack of) findings so far.

That's okay. Just please remember that lack of reproducibility for an
issue does not mean it's not present. In my initial mail I asked
Laszlo if he can forward this to upstream and/if this is already know
to upstream (which I hope in meanwhile it is). But I have not found an
upstream ticket on this issue yet.

Laszlo, do you know more already? Other distributions seem in the same
boat, like Red Hat in
https://bugzilla.redhat.com/show_bug.cgi?id=1377361#c3 

Regards,
Salvatore

Thread

Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Roberto C. Sánchez <roberto@connexer.com> - 2016-09-30 14:00 +0200
  Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Roberto C. Sánchez <roberto@connexer.com> - 2016-10-02 02:50 +0200
    Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Salvatore Bonaccorso <carnil@debian.org> - 2016-10-03 14:40 +0200
      Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Roberto C. Sánchez <roberto@connexer.com> - 2016-10-03 16:00 +0200
      Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp László Böszörményi (GCS) <gcs@debian.org> - 2016-10-04 23:10 +0200
        Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Salvatore Bonaccorso <carnil@debian.org> - 2016-10-05 07:20 +0200
        Bug#838694: icu: CVE-2016-7415: Stack based buffer overflow in locid.cpp Roberto C. Sánchez <roberto@connexer.com> - 2016-10-25 17:50 +0200

csiph-web