Bug 377090 (CVE-2008-1679) - VUL-0: CVE-2008-1679: Integer overflow related to [CVE-2007-4965] in python imageop module
Summary: VUL-0: CVE-2008-1679: Integer overflow related to [CVE-2007-4965] in python i...
Status: RESOLVED FIXED
Alias: CVE-2008-1679
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Major
Target Milestone: ---
Deadline: 2008-05-05
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: patchinfos submitted CVSSv2:NVD:CVE-2...
Keywords:
Depends on:
Blocks:
 
Reported: 2008-04-04 07:41 UTC by Ludwig Nussel
Modified: 2023-11-27 13:39 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2008-04-04 07:41:08 UTC
Your friendly security team received the following report via vendor-sec.
Please respond ASAP.
The issue is public.

Date: Thu, 3 Apr 2008 14:39:17 -0700
From: David Remahl <dremahl@apple.com>
To: vendor-sec@lst.de, coley@mitre.org
Subject: [vendor-sec] Integer overflow related to [CVE-2007-4965] in python imageop module
CC: Guido van Rossum <guido@python.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Python distribution vendors,

http://bugs.python.org/issue1179

When making some test cases for the public bug above, I discovered  
that there were some remaining overflows not addressed by the  
attached, unapplied, patch. At the time, I didn't realize that several  
vendors (including Apple) had already delivered the incomplete patch.  
I posted a comment in the bug, listing two issues that remain to be  
fixed:

> import imageop; imageop.rgb82rgb('A'*(2**30), 32768, 32768)
> import imageop; imageop.grey2rgb('A'*(2**30), 32768, 32768)

Therefore, these semi-new integer overflows are now considered public.  
It is probably best to assign a separate CVE to these integer  
overflows, to distinguish them from the issues that have already been  
addressed in several distributions.

Steve Christey, please assign an ID if you agree.

Sorry for the inconvenience.

/ Regards, David
// Security Engineer
// Apple Product Security

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iQEVAwUBR/VOh8gAoqu4Rp5tAQJ56Af/cH8EE6Bduv5Db4nEFPRaBxi8Nq/R8GmD
WBlMYIlZxbKT14t3S5M0NTYQXXo9WB09oXWRfTkfkN72UJ1i15Xt56mOuRB23chD
0K8PsSCQM5RRvlwZKpFAjvXBlPL1uuEFlhxycr2vjjNlW/zjMXIIu4iup0b7kyUE
RtrgdRvjyaM4N6Ga130ao9h5TWWRyK++pkjA1/Qxi7sr0dY1/cSsIT7B69MPBGcT
6V2IKUu05VQwp/AcYdsxTbunD9pMzHJnqYW1RQC4BjzN1LT55krMteL9u8lQLe3R
CSO4bszF17DybbKPKxI4PpHifopyGcw9Qd4ofFzuTes+lxDCzB/7Ng==
=8mch
-----END PGP SIGNATURE-----

_______________________________________________
Vendor Security mailing list
Vendor Security@lst.de
https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
Comment 1 Ludwig Nussel 2008-04-04 07:41:32 UTC
Date: Thu, 3 Apr 2008 19:37:59 -0400 (EDT)
From: "Steven M. Christey" <coley@linus.mitre.org>
To: David Remahl <dremahl@apple.com>
Subject: [vendor-sec] Re: Integer overflow related to [CVE-2007-4965] in python imageop
 module

On Thu, 3 Apr 2008, David Remahl wrote:

> > import imageop; imageop.rgb82rgb('A'*(2**30), 32768, 32768)
> > import imageop; imageop.grey2rgb('A'*(2**30), 32768, 32768)

Use CVE-2008-1679 .  Since patches have already been released, we assign a
new CVE for an incomplete patch.

> Therefore, these semi-new integer overflows are now considered public.

They only talk about "bus errors" so I don't regard these as (yet)
specifically labeled as security-relevant, so the CVE is private for the
moment.

- Steve
_______________________________________________
Vendor Security mailing list
Vendor Security@lst.de
https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
Comment 2 Ludwig Nussel 2008-04-08 07:43:24 UTC
upstream bug now has a patch attached that is said to fix the issue
Comment 3 Jan Matejek 2008-04-09 14:47:57 UTC
i'm on it.

i assume we need patches for all the versions we patched before?
Comment 4 Jan Matejek 2008-04-09 17:12:42 UTC
submitted updates for SLES9, SLES10, 10.2 and 10.3
Comment 7 Thomas Biege 2008-07-31 08:01:39 UTC
CVE-2008-1679
Comment 8 Andrej Semen 2008-08-13 13:31:47 UTC
could you provide for qa maintenace reasons an test case or reproducer?
Comment 9 Thomas Biege 2008-08-14 08:57:42 UTC
none, sorry.
Comment 11 Thomas Biege 2008-08-15 12:38:07 UTC
packages approved