oss-sec mailing list archives

Re: CVE request: Stack overflow in redcarpet's header_anchor

From: cve-assign () mitre org
Date: Tue, 30 Jun 2015 12:13:21 -0400 (EDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

https://github.com/vmg/redcarpet/commit/2cee777c1e5babe8a1e2683d31ea75cc4afe55fb

https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md

Version 3.3.2
Fix a potential security issue in the HTML renderer (Thanks to Giancarlo Canales for the heads up)

header_anchor uses variable length arrays (VLA) without any range checking.

This is conducive to a stack overflow, followed by the potential for arbitrary code execution.


Use CVE-2015-5147.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVkr+UAAoJEKllVAevmvmsKc4H/jUqANIqSni+uQgMUWROh0+5
csi/VXwpj+lGpXEBbzQkKlRgjRXJtVB47H2+cghcNL24Zgs/oW1ffNAqMxjqziOB
Rp9w76dhEecf+54lncJFvygM+ulvcbYw/cMIPHEzJ/mV+NS2/VVJrWcJqO8PcVug
isTP/ue2HToUf2JUQdbLuccjQBkfRRw7Hb2KJ2VquYM0edrQhQsGsilb4hYGpVRF
vxY8eVdrS7bObImNMK58EBGJJBBU9xm+fC9utbAnTYOCYtC6JxQr6XnJsm4s7rMH
VdQBpoz0dobQ+KewE18dTLZ6dXc88MQOZlaBJRXh5YNzfaqA/9d4u5Vtkk7o2S4=
=/17B
-----END PGP SIGNATURE-----

Current thread:

Possible CVE Request: Multiple stack overflows in squashfs-tools and sasquatch Giancarlo Canales (Jun 17)
- Re: Possible CVE Request: Multiple stack overflows in squashfs-tools and sasquatch cve-assign (Jun 18)
  - Re: Re: Possible CVE Request: Multiple stack overflows in squashfs-tools and sasquatch Giancarlo Canales (Jun 18)
    - Re: Possible CVE Request: Multiple stack overflows in squashfs-tools and sasquatch cve-assign (Jun 18)
- CVE request: Stack overflow in redcarpet's header_anchor Giancarlo Canales (Jun 29)
  - Re: CVE request: Stack overflow in redcarpet's header_anchor cve-assign (Jun 30)