Bugzilla – Bug 965806
VUL-0: CVE-2016-1522: graphite2: An exploitable out-of-bounds access vulnerability exists in thebidirectional font handling function...
Last modified: 2016-06-02 14:24:05 UTC
CVE-2016-1522 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1522 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1522.html
bugbot adjusting priority
This is connected to first part of 'Denial of Service' in http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html ? At least https://github.com/silnrsi/graphite/commit/a94bbf1a651b13ecfaf9a774a841d36964c25929 seems, that yes. This and only this commit is relevant? There is another commit in the ubuntu bug, but I am not sure it is related to this bug. More info welcome. Thank you
To me, both commits seem to need to be applied. What they name as "various fuzztest bugs" is IOW a crash like all the other stuff that they are fixing.
1.3.1 in sle12 already contains the fix.
This is an autogenerated message for OBS integration: This bug (965806) was mentioned in https://build.opensuse.org/request/show/367416 13.2 / graphite2
Packages submitted.
openSUSE-SU-2016:0791-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 965803,965806,965807,965810 CVE References: CVE-2016-1521,CVE-2016-1522,CVE-2016-1523,CVE-2016-1526 Sources used: openSUSE 13.2 (src): graphite2-1.2.4-2.4.1
released
For SLES 12 this bug was fixed with the update to graphite 1.3.1, where it was not seperately listed.