mruby: CVE-2018-14337

Debian Bug report logs - #903985
mruby: CVE-2018-14337

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: mruby: CVE-2018-14337

Date: Tue, 17 Jul 2018 21:16:10 +0200

Source: mruby
Version: 1.4.1+20180622+git640fca32-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/mruby/mruby/issues/4062

Hi,

The following vulnerability was published for mruby.

CVE-2018-14337[0]:
| The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1
| contains a signed integer overflow, possibly leading to out-of-bounds
| memory access because the mrb_str_resize function in string.c does not
| check for a negative length.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-14337
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14337
[1] https://github.com/mruby/mruby/issues/4062

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #16 received at 903985-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 903985-submitter@bugs.debian.org

Subject: closing 903985

Date: Sat, 05 Jan 2019 08:59:08 +0100

close 903985 2.0.0-1
thanks

Send a report that this bug log contains spam.