[Secure-testing-team] Bug#858057: chicken: CVE-2017-6949

[Salvatore Bonaccorso]

Source: chicken
Version: 4.9.0.1-1
Severity: important
Tags: upstream patch security

Hi,

the following vulnerability was published for chicken.

CVE-2017-6949[0]:
| An issue was discovered in CHICKEN Scheme through 4.12.0. When using a
| nonstandard CHICKEN-specific extension to allocate an SRFI-4 vector in
| unmanaged memory, the vector size would be used in unsanitised form as
| an argument to malloc(). With an unexpected size, the impact may have
| been a segfault or buffer overflow.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-6949
[1] http://lists.gnu.org/archive/html/chicken-announce/2017-03/msg00000.html

Regards,
Salvatore