Bug 914984 (CVE-2015-1353) - VUL-0: CVE-2015-1353: php5: integer overflow in the conversion of dates to "Julian Day Count" function
Summary: VUL-0: CVE-2015-1353: php5: integer overflow in the conversion of dates to "J...
Status: RESOLVED INVALID
Alias: CVE-2015-1353
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Petr Gajdos
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/113181/
Whiteboard: CVSSv2:NVD:CVE-2015-1353:7.5:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-27 16:56 UTC by Victor Pereira
Modified: 2020-04-01 22:12 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Swamp Workflow Management 2015-01-27 23:00:58 UTC
bugbot adjusting priority
Comment 2 Petr Gajdos 2015-01-28 08:46:26 UTC
One of the offended function looks like:

long int JulianToSdn(
                                                int inputYear,
                                                int inputMonth,
                                                int inputDay)
{
        int year;
        int month;

        /* check for invalid dates */
        if (inputYear == 0 || inputYear < -4713 ||
                inputMonth <= 0 || inputMonth > 12 ||
                inputDay <= 0 || inputDay > 31) {
                return (0);
        }
        /* check for dates before SDN 1 (Jan 2, 4713 B.C.) */
        if (inputYear == -4713) {
                if (inputMonth == 1 && inputDay == 1) {
                        return (0);
                }
        }
        /* Make year always a positive number. */
        if (inputYear < 0) {
                year = inputYear + 4801;
        } else {
                year = inputYear + 4800;
        }

        /* Adjust the start of the year. */
        if (inputMonth > 2) {
                month = inputMonth - 3;
        } else {
                month = inputMonth + 9;
                year--;
        }

        return ((year * DAYS_PER_4_YEARS) / 4
                        + (month * DAYS_PER_5_MONTHS + 2) / 5
                        + inputDay
                        - JULIAN_SDN_OFFSET);
}

So this looks like pure function [int,int,int] -> [long int] without any side efects. No security threat follow from it even when integer overflow happens I think. For GregorianToSdn() similar argument holds.

Until you prove otherwise, closing as invalid.