Subject: bug#47729: closed (Fixed: CVE-2021-30184 Arbitrary code execution in GNU Chess [security])

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 10 May 2021 19:50:02 +0000

Your bug report

#47729: CVE-2021-30184 Arbitrary code execution in GNU Chess [security]

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
47729: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=47729
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Fixed: CVE-2021-30184 Arbitrary code execution in GNU Chess [security]
From: Maxime Devos <[email-masked]>
To: [email-masked]
Date: Mon, 10 May 2021 21:48:55 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Fixed with https://git.savannah.gnu.org/cgit/guix.git/commit/?id=9a11f2380ff49756ace2f33bc96a88cdb6af5453.

Subject: CVE-2021-30184 Arbitrary code execution in GNU Chess [security]
From: Maxime Devos <[email-masked]>
To: [email-masked]
Date: Mon, 12 Apr 2021 17:44:24 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

From https://nvd.nist.gov/vuln/detail/CVE-2021-30184:

GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN
(Portable Game Notation) data. This is related to a buffer overflow in the use
of a .tmp.epd temporary file in the cmd_pgnload and cmd_pgnreplay functions in
frontend/cmd.cc.

Upstream bug report and patch:
https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00000.html

Upstream is aware of this issue and patch.  The patch is being reviewed upstream:

Response by Antonio Ceballos (<https://lists.gnu.org/archive/html/bug-gnu-chess/2021-04/msg00001.html>)
‘We will review it all in detail for a future release fixing the problem.’

I believe we should simply wait for upstream to make a release.