REDHAT-BUG-529342: Low severity aria aria2 vulnerability
Aria upstream has released 1.6.2 version fixing one security issue. From aria2-1.6.2 Release Notes: --------------------------
This release fixes segmentation fault error if URI to download contains printf format string and logging is enabled.
Fixed the bug that causes segmentation fault if req->getCurrentUrl() contains printf format string such as %d. The statement that causes this bug is useless and removed.
References: ---------- http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586
Upstream patch: --------------- http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/src/AbstractCommand.cc?r1=1539&r2=1572
CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/10/16/6
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-529342?
The severity of REDHAT-BUG-529342 is related to a segmentation fault that can occur under specific conditions.
How do I fix REDHAT-BUG-529342?
To fix REDHAT-BUG-529342, upgrade to aria2 version 1.6.2 or later.
What vulnerability is addressed in REDHAT-BUG-529342?
REDHAT-BUG-529342 addresses a segmentation fault caused by improper handling of printf format strings in URIs.
What versions of aria2 are affected by REDHAT-BUG-529342?
Versions prior to aria2 1.6.2 are affected by the vulnerability described in REDHAT-BUG-529342.
Is logging enabled a factor in REDHAT-BUG-529342?
Yes, logging must be enabled for the segmentation fault vulnerability in REDHAT-BUG-529342 to trigger.