Mailing-List: contact dev-help@apr.apache.org; run by ezmlm
Precedence: bulk
Date: Wed, 1 Nov 2017 12:22:50 +0100
From: Stefan Sperling <stsp@apache.org>
To: William A Rowe Jr <wrowe@rowe-clan.net>
Cc: APR Developer List <dev@apr.apache.org>
Subject: Re: [Announce] Apache Portable Runtime APR 1.6.3, APR-util 1.6.1 and
 APR-iconv 1.2.2 Released
Message-ID: <20171101112249.GB79732@jim.stsp.name>
References: <CACsi252POs4toeJJciwg09_eu2cO3XFg=UqsPjXsfjDoeC3-UQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CACsi252POs4toeJJciwg09_eu2cO3XFg=UqsPjXsfjDoeC3-UQ@mail.gmail.com>
User-Agent: Mutt/1.9.1 (2017-09-22)
archived-at: Wed, 01 Nov 2017 11:22:55 -0000

On Mon, Oct 23, 2017 at 01:27:59PM -0500, William A Rowe Jr wrote:
>   CVE-2017-12618; Out-of-bounds access in corrupted SDBM database.
> 
>   APR-util 1.6.0 and prior failed to validate the integrity of SDBM
>   database files used by apr_sdbm*() functions, resulting in a
>   possible out of bound read access. A local user with write access
>   to the database can make a program or process using these functions
>   crash, and cause a denial of service.

I am looking for the patch which fixed the above issue.

Where can I find it?

Was it r1809394? All of it? Some of it?

Rationale: APR-util 1.6.3 added a shared library symbol:

No dynamic export changes
PLT added:
        apr_xml_parser_done

I want to figure out a way to patch this security issue in
OpenBSD 6.2-stable, without changing unrelated library symbols.

Thanks,
Stefan