oss-sec mailing list archives
Re: CVE Request - aria2 - 1.6.2
From: Josh Bressers <bressers () redhat com>
Date: Fri, 16 Oct 2009 15:15:08 -0400 (EDT)
Please use CVE-2009-3617 for this. Thanks. -- JB ----- "Jan Lieskovsky" <jlieskov () redhat com> wrote:
Hello Steve, vendors, aria2 upstream has released latest 1.6.2 release, fixing one DoS issue. From 1.6.2 Release Note: This release fixes segmentation fault error if URI to download contains printf format string and logging is enabled * Fixed the bug that causes segmentation fault if req->getCurrentUrl() contains printf format string such as %d. The statement that causes this bug is useless and removed. References: ----------- http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586 https://bugzilla.redhat.com/show_bug.cgi?id=529342 Upstream patch: --------------- http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/src/AbstractCommand.cc?r1=1539&r2=1572 Affected versions: ------------------ aria2-1.5.x && aria2-1.6.x (aria2-1.3.x is not vulnerable) Could you allocate a CVE identifier? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- CVE Request - aria2 - 1.6.2 Jan Lieskovsky (Oct 16)
- Re: CVE Request - aria2 - 1.6.2 Josh Bressers (Oct 16)