[Bug 227791] New: CVE-2007-160: centericq buffer overflow

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.




https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227791

           Summary: CVE-2007-160: centericq buffer overflow
           Product: Fedora Extras
           Version: devel
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: normal
         Component: centericq
        AssignedTo: andreas.bierfert(a)lowlatency.de
        ReportedBy: kevin(a)tummy.com
         QAContact: extras-qa(a)fedoraproject.org
                CC: fedora-security-list(a)redhat.com


Description of problem:

centericq is vulnerable to a buffer overflow in it's livejournal support. 

See: 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0160

All fedora extras versions seem to be vulnerable. 

More info, and a patch that debian is using is at: 
http://mailman.linuxpl.org/pipermail/cicq/2007-January/004866.html

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 227791] CVE-2007-160: centericq buffer overflow

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2007-160: centericq buffer overflow


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227791





------- Additional Comments From andy(a)smile.org.ua  2007-02-08 01:33 EST -------
The patches are not allowed. Received error like following: "Can not connect 
to host www2.speedblue.org".

I think the patches would be attached here directly.

P.S. Just my 2 cents.

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 227791] CVE-2007-160: centericq buffer overflow

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2007-160: centericq buffer overflow


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227791


andreas.bierfert(a)lowlatency.de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Severity|normal                      |high




------- Additional Comments From andreas.bierfert(a)lowlatency.de  2007-02-08 04:40 EST
-------
Will look into the issue and try the debian patches asap.

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 227791] CVE-2007-160: centericq buffer overflow

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2007-160: centericq buffer overflow


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227791





------- Additional Comments From kevin(a)tummy.com  2007-02-08 11:13 EST -------
In reply to comment #1: 

yeah, those links look dead. ;( 
Hopefully the patches can be fetched via the debian package?

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 227791] CVE-2007-160: centericq buffer overflow

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2007-160: centericq buffer overflow


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227791





------- Additional Comments From andreas.bierfert(a)lowlatency.de  2007-02-08 11:21 EST
-------
Thats not a problem... I am just waiting to get home to grep them and make a
test build +)

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 227791] CVE-2007-160: centericq buffer overflow

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2007-160: centericq buffer overflow


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227791


ville.skytta(a)iki.fi changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |Security




-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 227791] CVE-2007-160: centericq buffer overflow

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2007-160: centericq buffer overflow


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=227791


andreas.bierfert(a)lowlatency.de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |CLOSED
         Resolution|                            |NEXTRELEASE




------- Additional Comments From andreas.bierfert(a)lowlatency.de  2007-02-10 02:20 EST
-------
Builds for fc{5,6} and devel have been queued. Thanks for reporting.

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.