Subject: bug#30415: closed (Re: bug#30415: Unzip CVE-2018-1000031 and others)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 13 Feb 2018 14:52:01 +0000

Your bug report

#30415: Unzip CVE-2018-1000031 and others

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
30415: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=30415
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#30415: Unzip CVE-2018-1000031 and others
From: Leo Famulari <[email-masked]>
To: Ricardo Wurmus <[email-masked]>
Cc: [email-masked]
Date: Tue, 13 Feb 2018 09:51:35 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

On Tue, Feb 13, 2018 at 09:01:44AM +0100, Ricardo Wurmus wrote:
> 
> Hi Leo,
> 
> > The researcher's advisory recommends building UnZip with FORTIFY_SOURCE
> > to reduce the impact of the bug. The attached patch does that.
> […]
> > +                 ;; Mitigate CVE-2018-1000035, an exploitable buffer overflow.
> > +                 ;; This environment variable is recommended in 'unix/Makefile'
> > +                 ;; for passing flags to the C compiler.
> > +                 (setenv "LOCAL_UNZIP" "-D_FORTIFY_SOURCE=1")
> > +                 #t))))))))
> 
> This looks good to me.  Thank you!

Thanks, pushed as 77737e035491112a1e9c7d9a0e6f1e0397a4f930

Subject: Unzip CVE-2018-1000031 and others
From: Leo Famulari <[email-masked]>
To: [email-masked]
Date: Sat, 10 Feb 2018 13:57:28 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

We need to fix CVE-2018-1000031, CVE-2018-1000032, CVE-2018-1000033,
CVE-2018-1000034, CVE-2018-1000035 in UnZip:

http://seclists.org/oss-sec/2018/q1/134
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000031 and etc