Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-14 Thread Anton Gladky
CVE-2021-43618 is assigned to this issue. Adrian Bunk schrieb am Sa., 13. Nov. 2021, 21:09: > On Fri, Sep 17, 2021 at 07:02:48AM +0200, Anton Gladky wrote: > > Thanks, Vincent, for the information. I would still wait for CVE, > > so we can apply a patch and track vulnerability for other > >

Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-14 Thread Anton Gladky
Thanks, Vincent, now I am able to reproduce the issue! I will request CVE. Regards Anton Am So., 14. Nov. 2021 um 15:44 Uhr schrieb Vincent Lefevre : > > On 2021-11-14 14:15:25 +0100, Anton Gladky wrote: > > well, I was thinking that upstream should request a CVE. Neverheless > > I could not

Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-14 Thread Vincent Lefevre
On 2021-11-14 14:15:25 +0100, Anton Gladky wrote: > well, I was thinking that upstream should request a CVE. Neverheless > I could not reproduce the issue with the modern GCC-versions. > Even on 32bit-systems. I can still reproduce the segmentation fault under Debian/unstable. Simplified

Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-14 Thread Anton Gladky
Hi Adrian, well, I was thinking that upstream should request a CVE. Neverheless I could not reproduce the issue with the modern GCC-versions. Even on 32bit-systems. Regards Anton Am Sa., 13. Nov. 2021 um 21:09 Uhr schrieb Adrian Bunk : > > On Fri, Sep 17, 2021 at 07:02:48AM +0200, Anton Gladky

Re: Bug#994405: libgmp10:i386: buffer overflow due to integer overflow in mpz/inp_raw.c on 32-bit machines

2021-11-13 Thread Adrian Bunk
On Fri, Sep 17, 2021 at 07:02:48AM +0200, Anton Gladky wrote: > Thanks, Vincent, for the information. I would still wait for CVE, > so we can apply a patch and track vulnerability for other > Debian versions (stable/oldstable/o-o-stable etc.). Hi Anton, did you manage to get a CVE assigned for