April 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1030606] Restart of sddm only works after killing sddm process / sddm service does not show as running
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1030606 http://bugzilla.suse.com/show_bug.cgi?id=1030606#c1 Fabian Vogt <fabian(a)ritter-vogt.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fabian(a)ritter-vogt.de, | |okurz(a)suse.com Flags| |needinfo?(okurz(a)suse.com) --- Comment #1 from Fabian Vogt <fabian(a)ritter-vogt.de> --- Tried it on 42.3 alpha here, works fine. Did you try it on tty1 only? Currently the service file has a "Conflicts=getty(a)tty1.service" entry, which does not coincide with the default config. Does it work if you do it from tty2? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1029999] When pairing a bluetooth mouse while wlan is activated plasma segfaults and takes all active users with it.
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1029999 http://bugzilla.suse.com/show_bug.cgi?id=1029999#c6 Fabian Vogt <fabian(a)ritter-vogt.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fabian(a)ritter-vogt.de, | |stakanov(a)freenet.de Flags| |needinfo?(stakanov@freenet. | |de) --- Comment #6 from Fabian Vogt <fabian(a)ritter-vogt.de> --- > If A is active and has WLAN activated and linked to a AP > If B logged in all ok > If C logged in: in the moment you activate the BT and move the mouse, this will segfault (no matter while with sddm or lightdm) the whole system. That means an event somehow gets relayed to all sessions and all three ksmservers crash, or the stack below (X, kernel) screws up. Please try to get all system logs when it happens (save_y2logs might be suitable here) (In reply to Stakanov Schufter from comment #5) > Created attachment 718014 [details] > KSM server crash realted to the present bug > > Last bit of info: > although you can work without crashes during apparently an unlimited time, > WLAN crashes again when you choose to disconnect the BT mouse. > I was noting a KSM server crash and saved the backtrace (see attachment). It > maz be related or not, but I had the impression it was. The crash during > disconnecting does not terminate the session as the connecting event but you > have the KSM server crash. That ksmserver crash happens during shutdown of the session, so it can't be related. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1030194] CPU fan runs in very high speed blowing cold air after resuming from suspend
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1030194 http://bugzilla.suse.com/show_bug.cgi?id=1030194#c7 --- Comment #7 from H. Zeng <zhx(a)cnzhx.net> --- After more digging, I found this problem is caused by tpacpi-bat from <https://github.com/teleshoes/tpacpi-bat>. The problem disappeared after removing tpacpi-bat. Now I use TLP, which I believe is using tpacpi-bat somewhat. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017461] btrfs balance renders system unresponsive and eventually even kills WiFi when quota is enabled
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1017461 http://bugzilla.suse.com/show_bug.cgi?id=1017461#c60 --- Comment #60 from Jan Ritzerfeld <suse(a)bugs.jan.ritzerfeld.org> --- (In reply to Richard Weinberger from comment #59) > So, this issue should now be fixed by the following upstream commit? > [...] 1. The time and CPU power needed for a simple "btrfs balance" is still ridiculously high, and 2. the performance stall is still there, even if less frequently. I updated the kernel and re-enabled quotas (not that easy). And even meta data balancing still 1. takes 15 minutes while completely hogging 1 CPU using a laptop on battery (recipe for a disaster), and 2. frequently delays starting shell commands, causes severe WiFi packet loss, and locks up the system for several seconds. Unfortunately, this issue is not fixed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1032022] New: VUL-1: CVE-2017-7383: podofo: four null pointer dereference
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1032022 Bug ID: 1032022 Summary: VUL-1: CVE-2017-7383: podofo: four null pointer dereference Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q2/2 ============================================ # podofotxtextract $FILE ==26727==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f4c23dd5e41 bp 0x7ffd6ce24bd0 sp 0x7ffd6ce24b20 T0) ==26727==The signal is caused by a READ memory access. ==26727==Hint: address points to the zero page. #0 0x7f4c23dd5e40 in PoDoFo::PdfFontFactory::CreateFont(FT_LibraryRec_**, PoDoFo::PdfObject*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfFontFactory.cpp:195:62 #1 0x7f4c23daa28d in PoDoFo::PdfFontCache::GetFont(PoDoFo::PdfObject*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfFontCache.cpp:362:22 #2 0x51debb in TextExtractor::ExtractText(PoDoFo::PdfMemDocument*, PoDoFo::PdfPage*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/TextExtractor.cpp:104:43 #3 0x51d021 in TextExtractor::Init(char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/TextExtractor.cpp:48:15 #4 0x539f6d in main /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/podofotxtextract.cpp:52:17 #5 0x7f4c220346ff in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #6 0x420d48 in _start (/usr/bin/podofotxtextract+0x420d48) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfFontFactory.cpp:195:62 in PoDoFo::PdfFontFactory::CreateFont(FT_LibraryRec_**, PoDoFo::PdfObject*) Reproducer: https://github.com/asarubbo/poc/blob/master/00252-podofo-nullptr4 CVE: CVE-2017-7383 ============================================ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1031996] New: libglx.so alternative changed on every update of xorg-x11-server
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1031996 Bug ID: 1031996 Summary: libglx.so alternative changed on every update of xorg-x11-server Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: xorg-maintainer-bugs(a)forge.provo.novell.com Reporter: jmader2(a)gmu.edu QA Contact: xorg-maintainer-bugs(a)forge.provo.novell.com Found By: --- Blocker: --- every update for xorg-x11-server wipes out the /usr/lib64/xorg/modules/extensions/libglx.so and /etc/alternatives/libglx.so that points to the nvidia provided libglx. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1032021] New: VUL-1: CVE-2017-7382: podofo: four null pointer dereference
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1032021 Bug ID: 1032021 Summary: VUL-1: CVE-2017-7382: podofo: four null pointer dereference Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q2/2 ========================================== # podofotxtextract $FILE ==20388==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f08c6a3c3de bp 0x7ffd52235bd0 sp 0x7ffd52235b20 T0) ==20388==The signal is caused by a READ memory access. ==20388==Hint: address points to the zero page. #0 0x7f08c6a3c3dd in PoDoFo::PdfFontFactory::CreateFont(FT_LibraryRec_**, PoDoFo::PdfObject*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfFontFactory.cpp:200:88 #1 0x7f08c6a1028d in PoDoFo::PdfFontCache::GetFont(PoDoFo::PdfObject*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfFontCache.cpp:362:22 #2 0x51debb in TextExtractor::ExtractText(PoDoFo::PdfMemDocument*, PoDoFo::PdfPage*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/TextExtractor.cpp:104:43 #3 0x51d021 in TextExtractor::Init(char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/TextExtractor.cpp:48:15 #4 0x539f6d in main /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/podofotxtextract.cpp:52:17 #5 0x7f08c4c9a6ff in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #6 0x420d48 in _start (/usr/bin/podofotxtextract+0x420d48) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfFontFactory.cpp:200:88 in PoDoFo::PdfFontFactory::CreateFont(FT_LibraryRec_**, PoDoFo::PdfObject*) Reproducer: https://github.com/asarubbo/poc/blob/master/00251-podofo-nullptr3 CVE: CVE-2017-7382 ========================================== -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1032020] New: VUL-1: CVE-2017-7381: podofo: four null pointer dereference
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1032020 Bug ID: 1032020 Summary: VUL-1: CVE-2017-7381: podofo: four null pointer dereference Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q2/2 ============================================ # podofotxtextract $FILE ==23885==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f44177e97b7 bp 0x7ffe130bed10 sp 0x7ffe130beca0 T0) ==23885==The signal is caused by a READ memory access. ==23885==Hint: address points to the zero page. #0 0x7f44177e97b6 in PoDoFo::PdfPage::GetFromResources(PoDoFo::PdfName const&, PoDoFo::PdfName const&) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPage.cpp:609:23 #1 0x51dda3 in TextExtractor::ExtractText(PoDoFo::PdfMemDocument*, PoDoFo::PdfPage*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/TextExtractor.cpp:98:47 #2 0x51d021 in TextExtractor::Init(char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/TextExtractor.cpp:48:15 #3 0x539f6d in main /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/podofotxtextract.cpp:52:17 #4 0x7f441585f6ff in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #5 0x420d48 in _start (/usr/bin/podofotxtextract+0x420d48) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPage.cpp:609:23 in PoDoFo::PdfPage::GetFromResources(PoDoFo::PdfName const&, PoDoFo::PdfName const&) Reproducer: https://github.com/asarubbo/poc/blob/master/00251-podofo-nullptr2 CVE: CVE-2017-7381 ============================================ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1032019] New: VUL-1: CVE-2017-7380: podofo: four null pointer dereference
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1032019 Bug ID: 1032019 Summary: VUL-1: CVE-2017-7380: podofo: four null pointer dereference Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q2/2 ============================================= Description: podofo is a C++ library to work with the PDF file format. A fuzz on it through the podofotxtextract command line tool reavealed some NULL dereferences. This post will be forwarded on the upstream mailing list. The complete ASan output: # podofotxtextract $FILE ==21905==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f2e6fad8bd8 bp 0x7ffee4f96d10 sp 0x7ffee4f96ca0 T0) ==21905==The signal is caused by a READ memory access. ==21905==Hint: address points to the zero page. #0 0x7f2e6fad8bd7 in PoDoFo::PdfPage::GetFromResources(PoDoFo::PdfName const&, PoDoFo::PdfName const&) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPage.cpp:614:20 #1 0x51dda3 in TextExtractor::ExtractText(PoDoFo::PdfMemDocument*, PoDoFo::PdfPage*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/TextExtractor.cpp:98:47 #2 0x51d021 in TextExtractor::Init(char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/TextExtractor.cpp:48:15 #3 0x539f6d in main /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxtextract/podofotxtextract.cpp:52:17 #4 0x7f2e6db4e6ff in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #5 0x420d48 in _start (/usr/bin/podofotxtextract+0x420d48) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPage.cpp:614:20 in PoDoFo::PdfPage::GetFromResources(PoDoFo::PdfName const&, PoDoFo::PdfName const&) Reproducer: https://github.com/asarubbo/poc/blob/master/00250-podofo-nullptr1 CVE: CVE-2017-7380 ============================================= -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1032018] New: VUL-1: CVE-2017-7379: podofo: heap-based buffer overflow in PoDoFo::PdfSimpleEncoding::ConvertToEncoding (PdfEncoding.cpp)
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1032018 Bug ID: 1032018 Summary: VUL-1: CVE-2017-7379: podofo: heap-based buffer overflow in PoDoFo::PdfSimpleEncoding::ConvertToEncoding (PdfEncoding.cpp) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q2/1 ============================================ Description: podofo is a C++ library to work with the PDF file format. A fuzz on it through the podofotxt2pdf command line tool reavealed an heap overflow. This post will be forwarded on the upstream mailing list. The complete ASan output: # podofotxt2pdf $FILE out.pdf ==12895==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310000c47ff at pc 0x7f7434e576ea bp 0x7ffde7868b70 sp 0x7ffde7868b68 READ of size 1 at 0x6310000c47ff thread T0 #0 0x7f7434e576e9 in PoDoFo::PdfSimpleEncoding::ConvertToEncoding(PoDoFo::PdfString const&, PoDoFo::PdfFont const*) const /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfEncoding.cpp:484:21 #1 0x7f7435337c7f in PoDoFo::PdfFont::WriteStringToStream(PoDoFo::PdfString const&, PoDoFo::PdfStream*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfFont.cpp:144:47 #2 0x7f74356a5374 in PoDoFo::PdfPainter::DrawText(double, double, PoDoFo::PdfString const&, long) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPainter.cpp:824:14 #3 0x519755 in draw(char*, PoDoFo::PdfDocument*, bool, char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:94:25 #4 0x51aa52 in init(char const*, char const*, bool, char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:165:5 #5 0x51c253 in main /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:212:7 #6 0x7f743363f78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #7 0x41ccb8 in _start (/usr/bin/podofotxt2pdf+0x41ccb8) 0x6310000c47ff is located 0 bytes to the right of 65535-byte region [0x6310000b4800,0x6310000c47ff) allocated by thread T0 here: #0 0x4dc585 in calloc /tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.0/work/compiler-rt-4.0.0.src/lib/asan/asan_malloc_linux.cc:74 #1 0x7f7434f9f978 in PoDoFo::podofo_calloc(unsigned long, unsigned long) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfMemoryManagement.cpp:136:9 #2 0x7f7434e51913 in PoDoFo::PdfSimpleEncoding::InitEncodingTable() /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfEncoding.cpp:370:47 #3 0x7f7434e55af1 in PoDoFo::PdfSimpleEncoding::ConvertToEncoding(PoDoFo::PdfString const&, PoDoFo::PdfFont const*) const /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfEncoding.cpp:459:51 #4 0x7f7435337c7f in PoDoFo::PdfFont::WriteStringToStream(PoDoFo::PdfString const&, PoDoFo::PdfStream*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfFont.cpp:144:47 #5 0x7f74356a5374 in PoDoFo::PdfPainter::DrawText(double, double, PoDoFo::PdfString const&, long) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPainter.cpp:824:14 #6 0x519755 in draw(char*, PoDoFo::PdfDocument*, bool, char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:94:25 #7 0x51aa52 in init(char const*, char const*, bool, char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:165:5 #8 0x51c253 in main /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:212:7 #9 0x7f743363f78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfEncoding.cpp:484:21 in PoDoFo::PdfSimpleEncoding::ConvertToEncoding(PoDoFo::PdfString const&, PoDoFo::PdfFont const*) const Shadow bytes around the buggy address: 0x0c62800108a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c62800108b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c62800108c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c62800108d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c62800108e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c62800108f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[07] 0x0c6280010900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c6280010910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c6280010920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c6280010930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c6280010940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==12895==ABORTING Affected version: 0.9.5 Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: CVE-2017-7379 Reproducer: https://github.com/asarubbo/poc/blob/master/00249-podofo-heapoverflow-PdfEn… Timeline: 2017-03-31: bug discovered and reported to upstream 2017-03-31: blog post about the issue 2017-03-31: CVE assigned Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/03/31/podofo-heap-based-buffer-overflow-i… -- Agostino Sarubbo Gentoo Linux Developer ============================================ -- You are receiving this mail because: You are on the CC list for the bug.

1 1