Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-14 Thread Anton Gladky
CVE-2021-43618 is assigned to this issue. Adrian Bunk schrieb am Sa., 13. Nov. 2021, 21:09: > On Fri, Sep 17, 2021 at 07:02:48AM +0200, Anton Gladky wrote: > > Thanks, Vincent, for the information. I would still wait for CVE, > > so we can apply a patch and track vulnerability for other > >

[SECURITY] [DLA 2818-1] ffmpeg security update

2021-11-14 Thread Anton Gladky
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian LTS Advisory DLA-2818-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Anton Gladky November 13, 2021

Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-14 Thread Anton Gladky
Thanks, Vincent, now I am able to reproduce the issue! I will request CVE. Regards Anton Am So., 14. Nov. 2021 um 15:44 Uhr schrieb Vincent Lefevre : > > On 2021-11-14 14:15:25 +0100, Anton Gladky wrote: > > well, I was thinking that upstream should request a CVE. Neverheless > > I could not

Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-14 Thread Vincent Lefevre
On 2021-11-14 14:15:25 +0100, Anton Gladky wrote: > well, I was thinking that upstream should request a CVE. Neverheless > I could not reproduce the issue with the modern GCC-versions. > Even on 32bit-systems. I can still reproduce the segmentation fault under Debian/unstable. Simplified

Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-14 Thread Anton Gladky
Hi Adrian, well, I was thinking that upstream should request a CVE. Neverheless I could not reproduce the issue with the modern GCC-versions. Even on 32bit-systems. Regards Anton Am Sa., 13. Nov. 2021 um 21:09 Uhr schrieb Adrian Bunk : > > On Fri, Sep 17, 2021 at 07:02:48AM +0200, Anton Gladky