gobby: CVE-2020-35450

Debian Bug report logs - #978446
gobby: CVE-2020-35450

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: gobby: CVE-2020-35450

Date: Sun, 27 Dec 2020 17:10:21 +0100

Source: gobby
Version: 0.6.0~20170204~e5c2d1-3
Severity: important
Tags: security upstream
Forwarded: https://github.com/gobby/gobby/issues/183
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for gobby.

CVE-2020-35450[0]:
| Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler
| for certain set_language calls.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-35450
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35450
[1] https://github.com/gobby/gobby/issues/183
[2] https://github.com/gobby/gobby/pull/184
[3] https://github.com/gobby/gobby/commit/6f34307bff645eb2935d82deee0119ec89866118

Regards,
Salvatore

Message #10 received at 978446-done@bugs.debian.org (full text, mbox, reply):

From: Philipp Kern <pkern@debian.org>

To: 978446-done@bugs.debian.org

Subject: Re: Bug#978446: gobby: CVE-2020-35450

Date: Sun, 27 Dec 2020 19:00:58 +0100

Version: 0.6.0~20201227~b98f4d2-1

This bug is fixed in the 0.6.0~20201227~b98f4d2-1 snapshot. The crash is
local only and requires access to the dbus session bus.

Send a report that this bug log contains spam.