plib: CVE-2021-38714

Debian Bug report logs - #992973
plib: CVE-2021-38714

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: plib: CVE-2021-38714

Date: Wed, 25 Aug 2021 21:23:37 +0200

Source: plib
Version: 1.8.5-8
Severity: grave
Tags: security upstream
Justification: user security hole
Forwarded: https://sourceforge.net/p/plib/bugs/55/
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for plib.

CVE-2021-38714[0]:
| In Plib through 1.85, there is an integer overflow vulnerability that
| could result in arbitrary code execution. The vulnerability is found
| in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

The severity of the this bug is set op purpose higher as it is
probably warranted. There is the following reason for that: plib is
orphaned in Debian for a while, it is obsoleted and unmaintained
upstream as well. Ideally it get's removed from Debian from the next
release, but thee would be some revers dependencies issues to be
solved, making it imposssible for now to remove the package:

| Checking reverse dependencies...
| # Broken Depends:
| crrcsim: crrcsim [amd64 arm64 armhf i386 mips64el mipsel ppc64el s390x]
| flightgear: flightgear
| openuniverse: openuniverse
| stormbaancoureur: stormbaancoureur
| torcs: torcs
| 
| # Broken Build-Depends:
| crrcsim: libplib-dev
| flightgear: libplib-dev
| torcs: libplib-dev
| 
| Dependency problem found.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-38714
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38714
[1] https://sourceforge.net/p/plib/bugs/55/

Regards,
Salvatore

Send a report that this bug log contains spam.