aboutsummaryrefslogtreecommitdiff
Fix CVE-2008-2149: buffer overflows by limiting the length of the string in sprintf
format string
Closes: #481186 (CVE-2008-2149)
Please note: The WordNet code contains several other occurences of potentially
exploitable functions like strcpy()/strcat()/...  and so even if there are no
known exploits the code needs a full security audit.

--- a/src/wn.c
+++ b/src/wn.c
@@ -206,7 +206,8 @@ static int searchwn(int ac, char *av[])
 		    outsenses += do_search(av[1], optptr->pos, optptr->search,
 					    whichsense, optptr->label);
 	    } else {
-		sprintf(tmpbuf, "wn: invalid search option: %s\n", av[j]);
+		/* Fix CVE-2008-2149: buffer overflows Andreas Tille <tille@debian.org> */
+		sprintf(tmpbuf, "wn: invalid search option: %.200s\n", av[j]);
 		display_message(tmpbuf);
 		errcount++;
 	    }
packages/mercury.scm?id=4b4fa892cb0fbb98af4606c7a1d55aa09d3eb715'>gnu: mercury-minimal: Update to 20.06.1....* gnu/packages/mercury.scm (mercury-minimal): Update to 20.06.1. Brett Gilio 2020-09-30gnu: Fix package references....* gnu/packages/algebra.scm (iml)[inputs]: Correctly refer to package inputs. * gnu/packages/astronomy.scm (xplanet), * gnu/packages/audio.scm (redkite, libaudec, lv2lint, lv2toweb), * gnu/packages/bioconductor.scm (r-cummerbund), * gnu/packages/chicken.scm (chicken), * gnu/packages/conky.scm (conky), * gnu/packages/cran.scm (r-latex2exp), * gnu/packages/crates-io.scm (rust-rgb), * gnu/packages/databases.scm (mariadb), * gnu/packages/diffoscope.scm (reprotest), * gnu/packages/file-systems.scm (glusterfs), * gnu/packages/finance.scm (electron-cash), * gnu/packages/games.scm (rinutils, ksudoku, kdiamond, kigo), * gnu/packages/geo.scm (grass), * gnu/packages/gnome.scm (libmediaart, gnome-contacts, geoclue), * gnu/packages/gnucash.scm (aqbanking), * gnu/packages/image.scm (mtpaint), * gnu/packages/kde-internet.scm (kopete, ktorrent), * gnu/packages/kde-utils.scm (kmousetool, kmouth, kronometer), * gnu/packages/linphone.scm (liblinphone), * gnu/packages/maths.scm (ppl), * gnu/packages/mercury.scm (mercury-minimal), * gnu/packages/music.scm (bjumblr, bschaffl, lsp-plugins, spectacle-analyzer, helm, tap-lv2, wolf-shaper, shiru-lv2), * gnu/packages/networking.scm (restinio), * gnu/packages/prolog.scm (swi-prolog), * gnu/packages/python-web.scm (gunicorn), * gnu/packages/python-xyz.scm (python-docusign-esign), * gnu/packages/ruby.scm (ruby-cucumber, ruby_version, ruby-addressable), * gnu/packages/sagemath.scm (python-cypari2), * gnu/packages/skarnet.scm (s6-linux-init), * gnu/packages/vpn.scm (sshuttle), * gnu/packages/web.scm (libcyaml), * gnu/packages/xdisorg.scm (kbdd), * gnu/packages/xorg.scm (xpra): Same. Efraim Flashner 2020-07-23gnu: Add mercury....* gnu/local.mk (GNU_SYSTEM_MODULES): Add mercury.scm. * gnu/packages/mercury.scm: New file. Brett Gilio