January 2017 - i18n-bugs - Fedora Mailing-Lists

[Fedora-i18n-bugs] [Bug 1399685] New: CVE-2016-9430 w3m: Segmentation fault with malformed input tag

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1399685 Bug ID: 1399685 Summary: CVE-2016-9430 w3m: Segmentation fault with malformed input tag Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eng-i18n-bugs(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com A segmentation fault will occur in w3m while parsing maliciously crafted input. Upstream bug: https://github.com/tats/w3m/issues/7 Upstream fix: https://github.com/tats/w3m/commit/59b91cd8e30c86f23476fa81ae005cabff49ebb6 References: http://seclists.org/oss-sec/2016/q4/321 -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
5
0 / 0

[Fedora-i18n-bugs] [Bug 1399682] New: CVE-2016-9430 w3m: Global-buffer-overflow write in formUpdateBuffer

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1399682 Bug ID: 1399682 Summary: CVE-2016-9430 w3m: Global-buffer-overflow write in formUpdateBuffer Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eng-i18n-bugs(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com A global-buffer-overflow write will occur in w3m while parsing maliciously crafted input. Upstream bug: https://github.com/tats/w3m/issues/29 Upstream fix: https://github.com/tats/w3m/commit/d01de738f599441740437c6600dd5b1ae7155d27 References: http://seclists.org/oss-sec/2016/q4/321 -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
6
0 / 0

[Fedora-i18n-bugs] [Bug 1399668] New: CVE-2016-9426 w3m: Heap corruption due to integer overflow in renderTable()

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1399668 Bug ID: 1399668 Summary: CVE-2016-9426 w3m: Heap corruption due to integer overflow in renderTable() Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eng-i18n-bugs(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com A heap corruption due to integer overflow will occur in w3m while parsing maliciously crafted input. Upstream bug: https://github.com/tats/w3m/issues/25 Upstream fix: https://github.com/tats/w3m/commit/b910f0966d9efea93ea8cef491000a83ffb49c5e References: http://seclists.org/oss-sec/2016/q4/321 -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
5
0 / 0

[Fedora-i18n-bugs] [Bug 1399667] New: CVE-2016-9428 w3m: Out-of-bounds write in addMultirowsForm()

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1399667 Bug ID: 1399667 Summary: CVE-2016-9428 w3m: Out-of-bounds write in addMultirowsForm() Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eng-i18n-bugs(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com An out of bounds heap write will occur while parsing malicously crafted input, crashing the application or having other unspecified impact. Upstream bug: https://github.com/tats/w3m/issues/26 Upstream fix: https://github.com/tats/w3m/commit/4e464819dd360ffd3d58fa2a89216fe413cfcc74 References: http://seclists.org/oss-sec/2016/q4/321 -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
5
0 / 0

[Fedora-i18n-bugs] [Bug 1399666] New: CVE-2016-9425 w3m: Segmentation fault due to write to lineBuf[-1] in addMultirowsForm

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1399666 Bug ID: 1399666 Summary: CVE-2016-9425 w3m: Segmentation fault due to write to lineBuf[-1] in addMultirowsForm Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eng-i18n-bugs(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com An out of bounds heap write will occur while parsing malicously crafted input, crashing the application or having other unspecified impact. Upstream bug: https://github.com/tats/w3m/issues/21 Upstream fix: https://github.com/tats/w3m/commit/4e464819dd360ffd3d58fa2a89216fe413cfcc74 References: http://seclists.org/oss-sec/2016/q4/321 -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
5
0 / 0

[Fedora-i18n-bugs] [Bug 1399665] New: CVE-2016-9424 w3m: Out-of-bounds heap write due to negative array index

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1399665 Bug ID: 1399665 Summary: CVE-2016-9424 w3m: Out-of-bounds heap write due to negative array index Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eng-i18n-bugs(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com An out of bounds heap write will occur while parsing malicously crafted input, crashing the application or having other unspecified impact. Upstream bug: https://github.com/tats/w3m/issues/12 Upstream fix: https://github.com/tats/w3m/commit/a25fd09f74fb83499396935a96d63bb7cb8e2c58 References: http://seclists.org/oss-sec/2016/q4/321 -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
7
0 / 0

[Fedora-i18n-bugs] [Bug 1399664] New: CVE-2016-9423 w3m: Malformed html tag heap-buffer overflow

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1399664 Bug ID: 1399664 Summary: CVE-2016-9423 w3m: Malformed html tag heap-buffer overflow Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eng-i18n-bugs(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com It is possible in specific circumstances to smash the stack using maliciously crafted input. Upstream bug: https://github.com/tats/w3m/issues/9 Upstream fix: https://github.com/tats/w3m/commit/9f0bdcfdf061db3520bd1f112bdc5e83acdec4be References: http://seclists.org/oss-sec/2016/q4/321 -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
6
0 / 0

[Fedora-i18n-bugs] [Bug 1399662] New: CVE-2016-9422 w3m: Stack smashed with large image inside table

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1399662 Bug ID: 1399662 Summary: CVE-2016-9422 w3m: Stack smashed with large image inside table Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eng-i18n-bugs(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com It is possible in specific circumstances to smash the stack using maliciously crafted input. Upstream bugs: https://github.com/tats/w3m/issues/8 https://github.com/tats/w3m/pull/19 Upstream fix: https://github.com/tats/w3m/commit/67a3db378f5ee3047c158eae4342f7e3245a2ab1 References: http://seclists.org/oss-sec/2016/q4/321 -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
7
0 / 0

[Fedora-i18n-bugs] [Bug 1416691] New: gettext-0.19.8.1-3.fc25 FTBFS when building without git

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1416691 Bug ID: 1416691 Summary: gettext-0.19.8.1-3.fc25 FTBFS when building without git Product: Fedora Version: 25 Component: gettext Assignee: praiskup(a)redhat.com Reporter: mmathesi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dueno(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org, petersen(a)redhat.com, praiskup(a)redhat.com, psabata(a)redhat.com, sgallagh(a)redhat.com Blocks: 1400162 (BaseRuntimeFTBFS) Description of problem: When attempting to rebuild portions of the frozen package set of Fedora 25 for the Base Runtime effort, we discovered that gettext has an undesirable hard runtime requirement upon git. When making a test build without git, it was also found that the package fails to build due to %autosetup's use of git. Version-Release number of selected component (if applicable): gettext-0.19.8.1-3.fc25 How reproducible: Every time Steps to Reproduce (rawhide): 1. fedpkg clone gettext && cd gettext 2. fedpkg switch-branch master 3. fedpkg srpm 4. mock --root=fedora-25-x86_64 --without=git gettext-0.19.8.1-6.fc26.src.rpm Actual results: Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.42u1jg + umask 022 + cd /builddir/build/BUILD + cd /builddir/build/BUILD + rm -rf gettext-0.19.8.1 + /usr/bin/tar -xof - + /usr/bin/xz -dc /builddir/build/SOURCES/gettext-0.19.8.1.tar.xz + STATUS=0 + '[' 0 -ne 0 ']' + cd gettext-0.19.8.1 + /usr/bin/chmod -Rf a+rX,u+w,g-w,o-w . + /usr/bin/git init -q /var/tmp/rpm-tmp.42u1jg: line 42: /usr/bin/git: No such file or directory Expected results: Successful build of the package. Additional info: Attached is a patch that corrects the error when building without git. The patch also fixes the default "with git" case so the gettext-devel subpackage only Recommends: git rather than the strict Requires to avoid at unnecessary mandatory dependency upon git. This is needed for the Base Runtime Project. Please apply the patch or respond with a reason it should not be applied within two weeks. After that time, a provenpackager will go ahead and apply it. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1400162 [Bug 1400162] Base Runtime FTBFS tracker -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
9
0 / 0

[Fedora-i18n-bugs] [Bug 1349567] New: avoid using special purpose fonts such as apx-fonts

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1349567 Bug ID: 1349567 Summary: avoid using special purpose fonts such as apx-fonts Product: Fedora Version: 23 Component: fontconfig Assignee: tagoh(a)redhat.com Reporter: htl10(a)users.sourceforge.net QA Contact: extras-qa(a)fedoraproject.org CC: fonts-bugs(a)lists.fedoraproject.org, i18n-bugs(a)lists.fedoraproject.org, pnemade(a)redhat.com, tagoh(a)redhat.com Description of problem: I started noticing many web pages on firefox, icecat, etc using a rather undesirable choice of fonts a while ago, and finally tracked it down with gnome-font-viewer to see which font is that. It is apx-fonts . /usr/share/fonts/apx/04b03.ttf . The problem is that its name starts with "04b03", and therefore comes first in a fair number of font matches (don't know the exact criteria, but often enough)... Version-Release number of selected component (if applicable): apx-fonts-0.1-3.fc23.noarch fontconfig-2.11.94-4.fc23.x86_64 fontconfig-2.11.94-4.fc23.i686 How reproducible: Always, since installing it (I installed a whole lot of fonts a while ago, basically just did "dnf install -y *fonts"). Steps to Reproduce: 1. installing apx-fonts 2. go to some web sites 3. Actual results: undesirable font choice. Expected results: pick something more suitable. Additional info: I know I can configure it myself in ~/.config/fontconfig, but fedora should help in avoiding these in the first place; since "dnf install -y *fonts" is probably common enough action. -- You are receiving this mail because: You are on the CC list for the bug.

7 years, 1 month

2
24
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

i18n-bugs January 2017