Bug#890548: Stack buffer overflows

2018-02-16 Thread Salvatore Bonaccorso
Control: retitle -1 leptonlib: CVE-2018-7186: Stack buffer overflows Control: tags -1 + patch Hi, On Thu, Feb 15, 2018 at 01:34:04PM -0800, Jeff Breidenbach wrote: > This is just about strings, right? So something like this will fix the > problem > and resolve this bug? Or am I missing

Processed: Re: Bug#890548: Stack buffer overflows

2018-02-16 Thread Debian Bug Tracking System
Processing control commands: > retitle -1 leptonlib: CVE-2018-7186: Stack buffer overflows Bug #890548 [src:leptonlib] Stack buffer overflows Changed Bug title to 'leptonlib: CVE-2018-7186: Stack buffer overflows' from 'Stack buffer overflows'. > tags -1 + patch Bug #890548 [src:leptonlib]

Bug#890548: Stack buffer overflows

2018-02-15 Thread Jeff Breidenbach
This is just about strings, right? So something like this will fix the problem and resolve this bug? Or am I missing something? char buf[L_BUF_SIZE]; - fscanf(fp, "Rootname: %s\n", buf); + fscanf(fp, "Rootname: %L_BUF_SIZE_MINUS_ONEs%\n", buf);

Bug#890548: Stack buffer overflows

2018-02-15 Thread Ben Hutchings
Source: leptonlib Version: 1.74.4-2 Severity: serious Tags: security upstream gplotRead() and ptaReadStream() read strings into stack buffers using fscanf() without a length limit. Ben. -- System Information: Debian Release: buster/sid APT prefers unstable-debug APT policy: (500,