Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit70f2e3e

Browse files
committed
Last-minute updates for release notes.
Revise description ofCVE-2015-3166, in line with scaled-back patch.Change release date.Security:CVE-2015-3166
1 parent1334127 commit70f2e3e

File tree

4 files changed

+64
-40
lines changed

4 files changed

+64
-40
lines changed

‎doc/src/sgml/release-9.0.sgml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<note>
88
<title>Release Date</title>
9-
<simpara>2015-05-21</simpara>
9+
<simpara>2015-05-22</simpara>
1010
</note>
1111

1212
<para>
@@ -58,18 +58,24 @@
5858

5959
<listitem>
6060
<para>
61-
Consistently check for failure of the <function>*printf()</> family of
62-
functions (Noah Misch)
61+
Improve detection of system-call failures (Noah Misch)
6362
</para>
6463

6564
<para>
66-
Most calls of these functions did not consider the possibility that
67-
the functions could fail with, eg, out-of-memory conditions. The usual
68-
result would just be missing output, but crashes or exposure of
69-
unintended information are also possible. To protect against such
70-
risks uniformly, create wrappers around these functions that throw an
71-
error on failure. Also add missing error checks to a few
72-
security-relevant calls of other system functions.
65+
Our replacement implementation of <function>snprintf()</> failed to
66+
check for errors reported by the underlying system library calls;
67+
the main case that might be missed is out-of-memory situations.
68+
In the worst case this might lead to information exposure, due to our
69+
code assuming that a buffer had been overwritten when it hadn't been.
70+
Also, there were a few places in which security-relevant calls of other
71+
system library functions did not check for failure.
72+
</para>
73+
74+
<para>
75+
It remains possible that some calls of the <function>*printf()</>
76+
family of functions are vulnerable to information disclosure if an
77+
out-of-memory error occurs at just the wrong time. We judge the risk
78+
to not be large, but will continue analysis in this area.
7379
(CVE-2015-3166)
7480
</para>
7581
</listitem>

‎doc/src/sgml/release-9.1.sgml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<note>
88
<title>Release Date</title>
9-
<simpara>2015-05-21</simpara>
9+
<simpara>2015-05-22</simpara>
1010
</note>
1111

1212
<para>
@@ -58,18 +58,24 @@
5858

5959
<listitem>
6060
<para>
61-
Consistently check for failure of the <function>*printf()</> family of
62-
functions (Noah Misch)
61+
Improve detection of system-call failures (Noah Misch)
6362
</para>
6463

6564
<para>
66-
Most calls of these functions did not consider the possibility that
67-
the functions could fail with, eg, out-of-memory conditions. The usual
68-
result would just be missing output, but crashes or exposure of
69-
unintended information are also possible. To protect against such
70-
risks uniformly, create wrappers around these functions that throw an
71-
error on failure. Also add missing error checks to a few
72-
security-relevant calls of other system functions.
65+
Our replacement implementation of <function>snprintf()</> failed to
66+
check for errors reported by the underlying system library calls;
67+
the main case that might be missed is out-of-memory situations.
68+
In the worst case this might lead to information exposure, due to our
69+
code assuming that a buffer had been overwritten when it hadn't been.
70+
Also, there were a few places in which security-relevant calls of other
71+
system library functions did not check for failure.
72+
</para>
73+
74+
<para>
75+
It remains possible that some calls of the <function>*printf()</>
76+
family of functions are vulnerable to information disclosure if an
77+
out-of-memory error occurs at just the wrong time. We judge the risk
78+
to not be large, but will continue analysis in this area.
7379
(CVE-2015-3166)
7480
</para>
7581
</listitem>

‎doc/src/sgml/release-9.2.sgml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<note>
88
<title>Release Date</title>
9-
<simpara>2015-05-21</simpara>
9+
<simpara>2015-05-22</simpara>
1010
</note>
1111

1212
<para>
@@ -58,18 +58,24 @@
5858

5959
<listitem>
6060
<para>
61-
Consistently check for failure of the <function>*printf()</> family of
62-
functions (Noah Misch)
61+
Improve detection of system-call failures (Noah Misch)
6362
</para>
6463

6564
<para>
66-
Most calls of these functions did not consider the possibility that
67-
the functions could fail with, eg, out-of-memory conditions. The usual
68-
result would just be missing output, but crashes or exposure of
69-
unintended information are also possible. To protect against such
70-
risks uniformly, create wrappers around these functions that throw an
71-
error on failure. Also add missing error checks to a few
72-
security-relevant calls of other system functions.
65+
Our replacement implementation of <function>snprintf()</> failed to
66+
check for errors reported by the underlying system library calls;
67+
the main case that might be missed is out-of-memory situations.
68+
In the worst case this might lead to information exposure, due to our
69+
code assuming that a buffer had been overwritten when it hadn't been.
70+
Also, there were a few places in which security-relevant calls of other
71+
system library functions did not check for failure.
72+
</para>
73+
74+
<para>
75+
It remains possible that some calls of the <function>*printf()</>
76+
family of functions are vulnerable to information disclosure if an
77+
out-of-memory error occurs at just the wrong time. We judge the risk
78+
to not be large, but will continue analysis in this area.
7379
(CVE-2015-3166)
7480
</para>
7581
</listitem>

‎doc/src/sgml/release-9.3.sgml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<note>
88
<title>Release Date</title>
9-
<simpara>2015-05-21</simpara>
9+
<simpara>2015-05-22</simpara>
1010
</note>
1111

1212
<para>
@@ -58,18 +58,24 @@
5858

5959
<listitem>
6060
<para>
61-
Consistently check for failure of the <function>*printf()</> family of
62-
functions (Noah Misch)
61+
Improve detection of system-call failures (Noah Misch)
6362
</para>
6463

6564
<para>
66-
Most calls of these functions did not consider the possibility that
67-
the functions could fail with, eg, out-of-memory conditions. The usual
68-
result would just be missing output, but crashes or exposure of
69-
unintended information are also possible. To protect against such
70-
risks uniformly, create wrappers around these functions that throw an
71-
error on failure. Also add missing error checks to a few
72-
security-relevant calls of other system functions.
65+
Our replacement implementation of <function>snprintf()</> failed to
66+
check for errors reported by the underlying system library calls;
67+
the main case that might be missed is out-of-memory situations.
68+
In the worst case this might lead to information exposure, due to our
69+
code assuming that a buffer had been overwritten when it hadn't been.
70+
Also, there were a few places in which security-relevant calls of other
71+
system library functions did not check for failure.
72+
</para>
73+
74+
<para>
75+
It remains possible that some calls of the <function>*printf()</>
76+
family of functions are vulnerable to information disclosure if an
77+
out-of-memory error occurs at just the wrong time. We judge the risk
78+
to not be large, but will continue analysis in this area.
7379
(CVE-2015-3166)
7480
</para>
7581
</listitem>

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp