http://bugzilla.opensuse.org/show_bug.cgi?id=1014107 Bug ID: 1014107 Summary: Tcsh: Out-of-bounds read in c_substitute() Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: mikhail.kasimov@gmail.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Reference: http://seclists.org/oss-sec/2016/q4/612 =================================================== Hello folks, We were made aware of an out-of-bounds read issue that was reported to Tcsh upstream and fixed. This issue could result in a crash after starting tcsh and hitting TAB on some systems. Right now, the issue is contained in Fedora/RHEL, because we're using glibc's sysmalloc (not the builtin malloc), which masks the issue. Fedora maintainer decided to fix this anyway just to be safe. As far as our systems are concerned we don't consider this a security issue for now. I am looking forward to hearing other opinions if anyone is interested. Bug report: http://mx.gw.com/pipermail/tcsh-bugs/2016-December/001103.html Upstream fix: https://github.com/tcsh-org/tcsh/commit/6a542dc4fb2ba26518a47e9b3a9bcd6a91b9... Best Regards, -- Andrej Nemec, Red Hat Product Security 3701 3214 E472 A9C3 EFBE 8A63 8904 44A1 D57B 6DDA =================================================== Please, take a look if it is actual for SuSE line. -- You are receiving this mail because: You are on the CC list for the bug.