Bug 963970 (CVE-2016-2090)

Summary:	VUL-1: CVE-2016-2090: libbsd: heap buffer overflow in fgetwln function
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Johannes Segitz <jsegitz>
Component:	Incidents	Assignee:	Cristian Rodríguez <crrodriguez>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P4 - Low	CC:	smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	openSUSE 42.1
URL:	https://smash.suse.de/issue/161384/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Johannes Segitz 2016-01-28 12:15:28 UTC

rh#1302622

libbsd 0.8.1 and earlier contains a buffer overflow in the function
fgetwln(). An if checks if it is necessary to reallocate memory in the
target buffer. However this check is off by one, therefore an out of
bounds write happens.

Original bug report

https://bugs.freedesktop.org/show_bug.cgi?id=93881

Upstream fix:

http://cgit.freedesktop.org/libbsd/commit/?id=c8f0723d2b4520bdd6b9eb7c3e7976de726d7ff7

External reference:

https://blog.fuzzing-project.org/36-Heap-buffer-overflow-in-fgetwln-function-of-libbsd.html

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1302622
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2090
http://seclists.org/oss-sec/2016/q1/234

Comment 1 Johannes Segitz 2016-01-28 12:15:43 UTC

Factory only

Comment 2 Swamp Workflow Management 2016-01-28 23:03:11 UTC

bugbot adjusting priority

Comment 3 Johannes Segitz 2017-08-15 11:55:49 UTC

fixed