mingw December 2013

mingw@lists.fedoraproject.org

5 participants
71 discussions

[Bug 1037975] CVE-2013-6425 pixman: integer underflow when handling trapezoids
by Red Hat Bugzilla 17 Dec '13

17 Dec '13

https://bugzilla.redhat.com/show_bug.cgi?id=1037975 Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=important,public=201 |0716,reported=20131204,sour |30716,reported=20131204,sou |ce=osssec,cvss2=5.0/AV:N/AC |rce=osssec,cvss2=6.8/AV:N/A |:L/Au:N/C:N/I:N/A:P,fedora- |C:M/Au:N/C:P/I:P/A:P,fedora |all/pixman=affected,fedora- |-all/pixman=affected,fedora |all/mingw-pixman=affected,e |-all/mingw-pixman=affected, |pel-5/mingw32-pixman=affect |epel-5/mingw32-pixman=affec |ed,rhel-5/pixman=affected,r |ted,rhel-5/pixman=affected, |hel-6/pixman=affected,rhel- |rhel-6/pixman=affected,rhel |7/pixman=affected |-7/pixman=affected --- Comment #6 from Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> --- After closer investigation of this issue, it seems that arbitrary code execution via user controlled data may be possible in this particular flaw. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AiJnRWnJfH&a=cc_unsubscribe

1 0

[Bug 1037975] CVE-2013-6425 pixman: integer underflow when handling trapezoids
by Red Hat Bugzilla 16 Dec '13

16 Dec '13

https://bugzilla.redhat.com/show_bug.cgi?id=1037975 Adam Jackson <ajax(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(ajax(a)redhat.com) | --- Comment #5 from Adam Jackson <ajax(a)redhat.com> --- (In reply to Huzaifa S. Sidhpurwala from comment #4) > This leads me to conclude that there could be a possible of arbitrary > user-controlled code execution. (which means i need to raise the impact to > important etc). Was wondering if you could take a look and let me know if > you think otherwise? I'm not especially familiar with this part of pixman, but I can't rule this out from a quick read. I'd play it safe and raise the impact. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Zwx0rlnf99&a=cc_unsubscribe

1 0

[Bug 1037975] CVE-2013-6425 pixman: integer underflow when handling trapezoids
by Red Hat Bugzilla 16 Dec '13

16 Dec '13

https://bugzilla.redhat.com/show_bug.cgi?id=1037975 Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2013 |impact=moderate,public=2013 |0716,reported=20131204,sour |0716,reported=20131204,sour |ce=osssec,cvss2=5.0/AV:N/AC |ce=osssec,cvss2=5.0/AV:N/AC |:L/Au:N/C:N/I:N/A:P,fedora- |:L/Au:N/C:N/I:N/A:P,fedora- |all/pixman=new,fedora-all/m |all/pixman=affected,fedora- |ingw-pixman=new,epel-5/ming |all/mingw-pixman=affected,e |w32-pixman=new,rhel-5/pixma |pel-5/mingw32-pixman=affect |n=affected,rhel-6/pixman=ne |ed,rhel-5/pixman=affected,r |w,rhel-7/pixman=new |hel-6/pixman=affected,rhel- | |7/pixman=affected Flags| |needinfo?(ajax(a)redhat.com) --- Comment #4 from Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> --- Adam, If you look at the valgrind output from the above reproducer, there is an invalid read and an invalid write on the heap, which really seems to be user controllable. Looking at the code the issue is in pixman/pixman-edge.c: 210 WRITE (image, ap + lxi, 211 clip255 (READ (image, ap + lxi) + rxs - lxs)); This leads me to conclude that there could be a possible of arbitrary user-controlled code execution. (which means i need to raise the impact to important etc). Was wondering if you could take a look and let me know if you think otherwise? -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IDhKtTklET&a=cc_unsubscribe

1 0

Broken dependencies: mingw32-libpng
by Fedora Koji Build System 15 Dec '13

15 Dec '13

mingw32-libpng has broken dependencies in the epel-6 tree: On ppc64: mingw32-libpng-1.2.37-3.el6.noarch requires mingw32-runtime mingw32-libpng-1.2.37-3.el6.noarch requires mingw32-filesystem >= 0:63 mingw32-libpng-1.2.37-3.el6.noarch requires mingw32(zlib1.dll) mingw32-libpng-1.2.37-3.el6.noarch requires mingw32(msvcrt.dll) mingw32-libpng-1.2.37-3.el6.noarch requires mingw32(kernel32.dll) Please resolve this as soon as possible.

1 0

Broken dependencies: mingw32-libpng
by Fedora Koji Build System 15 Dec '13

15 Dec '13

1 0

[Bug 851680] Review Request: mingw-libidl - MinGW Windows IDL Parsing Library.
by Red Hat Bugzilla 14 Dec '13

14 Dec '13

https://bugzilla.redhat.com/show_bug.cgi?id=851680 --- Comment #2 from greg.hellings(a)gmail.com --- Updated spec file: http://dl.thehellings.com/mingw32/libidl/mingw-libidl.spec New SRPM: http://dl.thehellings.com/mingw32/libidl/mingw-libIDL-0.8.14-2.fc19.src.rpm Personally I'd rather not maintain a patch just for the installation of the .def files, if it's not necessary. The rest of the items are addressed. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=x3jvYjS2c3&a=cc_unsubscribe

1 0

[Bug 851810] New: Review Request: mingw-mpfr - MinGW C library for multiple-precision floating-point computations
by Red Hat Bugzilla 14 Dec '13

14 Dec '13

https://bugzilla.redhat.com/show_bug.cgi?id=851810 Bug ID: 851810 QA Contact: extras-qa(a)fedoraproject.org Severity: unspecified Version: rawhide Priority: unspecified CC: fedora-mingw(a)lists.fedoraproject.org, notting(a)redhat.com, package-review(a)lists.fedoraproject.org Assignee: nobody(a)fedoraproject.org Summary: Review Request: mingw-mpfr - MinGW C library for multiple-precision floating-point computations Regression: --- Story Points: --- Classification: Fedora OS: Unspecified Reporter: t.sailer(a)alumni.ethz.ch Type: Bug Documentation: --- Hardware: Unspecified Mount Type: --- Status: NEW Component: Package Review Product: Fedora Spec URL: http://sailer.fedorapeople.org/mingw-mpfr.spec SRPM URL: http://sailer.fedorapeople.org/mingw-mpfr-3.1.1-1.fc17.src.rpm Description: MinGW C library for multiple-precision floating-point computations Approved MinGW packaging guidelines are here: http://fedoraproject.org/wiki/Packaging/MinGW -- You are receiving this mail because: You are on the CC list for the bug.

1 30

[Bug 1031749] CVE-2013-6630 libjpeg: information leak (read of uninitialized memory)
by Red Hat Bugzilla 09 Dec '13

09 Dec '13

https://bugzilla.redhat.com/show_bug.cgi?id=1031749 --- Comment #13 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:1803 https://rhn.redhat.com/errata/RHSA-2013-1803.html -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=RElSpfOYzQ&a=cc_unsubscribe

1 0

[Bug 1031734] CVE-2013-6629 libjpeg: information leak (read of uninitialized memory)
by Red Hat Bugzilla 09 Dec '13

09 Dec '13

https://bugzilla.redhat.com/show_bug.cgi?id=1031734 --- Comment #10 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2013:1803 https://rhn.redhat.com/errata/RHSA-2013-1803.html -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AtIwgQaooj&a=cc_unsubscribe

1 0

[Bug 1031734] CVE-2013-6629 libjpeg: information leak (read of uninitialized memory)
by Red Hat Bugzilla 09 Dec '13

09 Dec '13

https://bugzilla.redhat.com/show_bug.cgi?id=1031734 --- Comment #9 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2013:1804 https://rhn.redhat.com/errata/RHSA-2013-1804.html -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=BLKyrhTS6B&a=cc_unsubscribe

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

mingw December 2013