Debian Bug report logs - #778408
newlib: CVE-2015-2305: Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Luciano Bello <luciano@debian.org>

To: submit@bugs.debian.org

Subject: Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability

Date: Sat, 14 Feb 2015 15:34:50 +0100

Package: newlib
Severity: important
Tags: security patch

The security team received a report from the CERT Coordination Center that the 
Henry Spencer regular expressions (regex) library contains a heap overflow 
vulnerability. It looks like this package includes the affected code at that's 
the reason of this bug report.

The patch is available here:
http://gitweb.dragonflybsd.org/dragonfly.git/blobdiff/4d133046c59a851141519d03553a70e903b3eefc..2841837793bd095a82f477e9c370cfe6cfb3862c:/lib/libc/regex/regcomp.c

Please, can you confirm if the binary packages are affected? Are stable and 
testing affected?

More information, here:
http://www.kb.cert.org/vuls/id/695940
https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/

A CVE id has been requested already and the report will be updated with it 
eventually.

Cheers, luciano

Message #10 received at 778408@bugs.debian.org (full text, mbox, reply):

From: Agustin Henze <tin@sluc.org.ar>

To: Luciano Bello <luciano@debian.org>, 778408@bugs.debian.org

Subject: Re: Bug#778408: Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability

Date: Fri, 27 Feb 2015 08:45:59 -0300

[Message part 1 (text/plain, inline)]

Control: found -1 1.18.0-6.2

Hi luciano!

On 02/14/2015 11:34 AM, Luciano Bello wrote:
> Package: newlib
> Severity: important
> Tags: security patch
> 
> The security team received a report from the CERT Coordination Center that the 
> Henry Spencer regular expressions (regex) library contains a heap overflow 
> vulnerability. It looks like this package includes the affected code at that's 
> the reason of this bug report.
> 
> The patch is available here:
> http://gitweb.dragonflybsd.org/dragonfly.git/blobdiff/4d133046c59a851141519d03553a70e903b3eefc..2841837793bd095a82f477e9c370cfe6cfb3862c:/lib/libc/regex/regcomp.c
> 
> Please, can you confirm if the binary packages are affected? Are stable and 
> testing affected?

I confirm that stable is the only affected. That's because when I adopted this
package I removed libnewlib0 (binary built for i386 architecture) and newlib
only has regex implementation for posix. Right now on testing and unstable the
binaries built are only for arm architectures so we are ok here.

Also I have checked reverse dependencies and there is no any I remember now
that removing these binaries was too easy. I c&p dak's output below.
About the patch, I tried apply it on the version affected and it applied
smoothly and also built ok. I just modified (attached) the path to regcomp.c,
seems the exactly same implementation.
This is my first security bug so be patient with me :). How do we follow from here?


dak's output
============================================================
$ ssh mirror.ftp-master.debian.org "dak rm -s stable -Rnb libnewlib0"


Will remove the following packages from stable:





libnewlib0 | 1.18.0-6.2 | i386





Maintainer: Arthur Loiret <aloiret@debian.org>





------------------- Reason -------------------





----------------------------------------------





Checking reverse dependencies...


# Broken Depends:


newlib: libnewlib-dev [i386]





Dependency problem found.





$ ssh mirror.ftp-master.debian.org "dak rm -s stable -Rnb libnewlib-dev"


Will remove the following packages from stable:





libnewlib-dev | 1.18.0-6.2 | i386, powerpc





Maintainer: Arthur Loiret <aloiret@debian.org>





------------------- Reason -------------------





----------------------------------------------





Checking reverse dependencies...
No dependency problem found.
============================================================

Cheers,

-- 
TiN

[66_regcomp_security_fix.patch (text/x-patch, attachment)]

Message #23 received at 778408-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 778408-submitter@bugs.debian.org

Subject: closing 778408

Date: Sat, 26 Feb 2022 11:11:02 +0100

close 778408 2.0.0-1
thanks

Send a report that this bug log contains spam.