Bug#876659: ledger: CVE-2017-2808: Ledger CLI Account Directive Use-After-Free Vulnerability
Hi Martin, On Sat, Jan 26, 2019 at 01:18:17PM -0300, Martin Michlmayr wrote: > * Salvatore Bonaccorso [2017-09-24 17:57]: > > the following vulnerability was published for ledger. > > > > CVE-2017-2808[0]: > > | An exploitable use-after-free vulnerability exists in the account > > This has been fixed upstream: > https://github.com/ledger/ledger/commit/f3bad93db256db07b6cb831d4d24f47543f57e4a > We're also working on releasing 3.1.2 with fixes for all 4 CVE items. Thanks for the update! > I consider this (and all the other CVE issues filed against ledger) > low impact. Salvatore/David, do you want to make a release for > stable? They were marked already no-dsa, so defintively to agree no DSA itself is needed. But if you think they are worh fixing in stable, then they can go via a upcoming point release. > Salvatore, can you tell me how to inform CVE/Mitre once 3.1.2 is out > that these CVEs have been addressed? You can request an update of the CVE entry adding details via the webform at https://cveform.mitre.org/ Hope this helps, Regards, Salvatore
Bug#876659: ledger: CVE-2017-2808: Ledger CLI Account Directive Use-After-Free Vulnerability
* Salvatore Bonaccorso [2017-09-24 17:57]: > the following vulnerability was published for ledger. > > CVE-2017-2808[0]: > | An exploitable use-after-free vulnerability exists in the account This has been fixed upstream: https://github.com/ledger/ledger/commit/f3bad93db256db07b6cb831d4d24f47543f57e4a We're also working on releasing 3.1.2 with fixes for all 4 CVE items. I consider this (and all the other CVE issues filed against ledger) low impact. Salvatore/David, do you want to make a release for stable? Salvatore, can you tell me how to inform CVE/Mitre once 3.1.2 is out that these CVEs have been addressed? -- Martin Michlmayr https://www.cyrius.com/
Bug#876659: ledger: CVE-2017-2808: Ledger CLI Account Directive Use-After-Free Vulnerability
Source: ledger Version: 3.1.2~pre1+g3a00e1c+dfsg1-1 Severity: important Tags: security upstream Hi, the following vulnerability was published for ledger. CVE-2017-2808[0]: | An exploitable use-after-free vulnerability exists in the account | parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger | file can cause a use-after-free vulnerability resulting in arbitrary | code execution. An attacker can convince a user to load a journal file | to trigger this vulnerability. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-2808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2808 [1] https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0304 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
