freetds: CVE-2019-13508: Heap overflow in FreeTDS if UDT type is used with protocol 5.0

Debian Bug report logs - #944012
freetds: CVE-2019-13508: Heap overflow in FreeTDS if UDT type is used with protocol 5.0

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: freetds: CVE-2019-13508: Heap overflow in FreeTDS if UDT type is used with protocol 5.0

Date: Sat, 02 Nov 2019 20:59:25 +0100

Source: freetds
Version: 1.1.6-1
Severity: important
Tags: security upstream fixed-upstream
Control: found -1 1.00.104-1

Hi,

The following vulnerability was published for freetds.

CVE-2019-13508[0]:
| FreeTDS through 1.1.11 has a Buffer Overflow.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-13508
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13508
[1] https://github.com/FreeTDS/freetds/commit/0df4eb82a0e3ff844e373d7c9f9c6c813925e2ac
[2] https://bugs.launchpad.net/bugs/1835896
[3] https://bugzilla.redhat.com/show_bug.cgi?id=1736255
[4] https://bugzilla.novell.com/show_bug.cgi?id=1141132

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 944012@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 944012@bugs.debian.org

Subject: Re: Bug#944012: freetds: CVE-2019-13508: Heap overflow in FreeTDS if UDT type is used with protocol 5.0

Date: Wed, 6 Nov 2019 10:10:23 -0800

[Message part 1 (text/plain, inline)]

Hello,

On Sat, Nov 02, 2019 at 08:59:25PM +0100, Salvatore Bonaccorso wrote:
> Source: freetds
> Version: 1.1.6-1
> Severity: important
> Tags: security upstream fixed-upstream
> Control: found -1 1.00.104-1

> The following vulnerability was published for freetds.

> CVE-2019-13508[0]:
> | FreeTDS through 1.1.11 has a Buffer Overflow.

Where does this "1.1.11" number come from?  I do not see any releases newer
than 1.1.6 upstream.

> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2019-13508
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13508
> [1] https://github.com/FreeTDS/freetds/commit/0df4eb82a0e3ff844e373d7c9f9c6c813925e2ac
> [2] https://bugs.launchpad.net/bugs/1835896
> [3] https://bugzilla.redhat.com/show_bug.cgi?id=1736255
> [4] https://bugzilla.novell.com/show_bug.cgi?id=1141132
> 
> Please adjust the affected versions in the BTS as needed.
> 
> Regards,
> Salvatore
> 

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                   https://www.debian.org/
slangasek@ubuntu.com                                     vorlon@debian.org

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 944012@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Steve Langasek <vorlon@debian.org>, 944012@bugs.debian.org

Subject: Re: Bug#944012: freetds: CVE-2019-13508: Heap overflow in FreeTDS if UDT type is used with protocol 5.0

Date: Thu, 7 Nov 2019 07:02:55 +0100

Hi Steve,

On Wed, Nov 06, 2019 at 10:10:23AM -0800, Steve Langasek wrote:
> Hello,
> 
> On Sat, Nov 02, 2019 at 08:59:25PM +0100, Salvatore Bonaccorso wrote:
> > Source: freetds
> > Version: 1.1.6-1
> > Severity: important
> > Tags: security upstream fixed-upstream
> > Control: found -1 1.00.104-1
> 
> > The following vulnerability was published for freetds.
> 
> > CVE-2019-13508[0]:
> > | FreeTDS through 1.1.11 has a Buffer Overflow.
> 
> Where does this "1.1.11" number come from?  I do not see any releases newer
> than 1.1.6 upstream.

The CVE assignment was acknowledged by upstream in the launchpad bug
1835896. MITRE descriptions in any case should not be trusted 1-1 and
in this case it even was very mimimalistic. In any case the fix is the
upstream commit 0df4eb82a0e3ff844e373d7c9f9c6c813925e2ac in the git
repository on github. But I notice on
https://www.freetds.org/software.html that the current stable version
should be 1.1.20 and the respective commits there while they are on
the master branch the releases seem not tagged.

Does this helps?

Regards,
Salvatore

Send a report that this bug log contains spam.