Fedora 28: FEDORA-2019-3c1aed2aa9 Critical: Cfitsio Buffer Overflow

CFITSIO is a library of C and FORTRAN subroutines for reading and writing

data files in FITS (Flexible Image Transport System) data format. CFITSIO

simplifies the task of writing software that deals with FITS files by

providing an easy to use set of high-level routines that insulate the

programmer from the internal complexities of the FITS file format. At the

same time, CFITSIO provides many advanced features that have made it the

most widely used FITS file programming interface in the astronomical

community.

This update backports security fixes from cfitsio 3.440

* Mon Mar 4 2019 Sergio Pascual - 3.430-2

- Backport security fixes from 3.440 (rhbz #1570484)

[ 1 ] Bug #1570484 - Rebase cfitsio package to 3.44 upstream to resolve security issues.

https://bugzilla.redhat.com/show_bug.cgi?id=1570484

[ 2 ] Bug #1568189 - CVE-2018-3849 cfitsio: Stack-based buffer overflow in ffghtb() allows for potential code execution [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1568189

[ 3 ] Bug #1568184 - CVE-2018-3848 cfitsio: Stack-based buffer overflow in ffghbn() allows for potential code execution [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1568184

[ 4 ] Bug #1563915 - CVE-2018-3846 cfitsio: Unsafe use of sprintf() can allow a remote unauthenticated attacker to execute arbitrary code [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1563915

su -c ''dnf upgrade --advisory FEDORA-2019-3c1aed2aa9'' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/