[Secure-testing-team] Bug#876660: ledger: CVE-2017-2807: Ledger CLI Tags Parsing Code Execution Vulnerability

[Salvatore Bonaccorso]

Source: ledger
Version: 3.1.2~pre1+g3a00e1c+dfsg1-1
Severity: important
Tags: upstream security

Hi,

the following vulnerability was published for ledger.

CVE-2017-2807[0]:
| An exploitable buffer overflow vulnerability exists in the tag parsing
| functionality of Ledger-CLI 3.1.1. A specially crafted journal file
| can cause an integer underflow resulting in code execution. An
| attacker can construct a malicious journal file to trigger this
| vulnerability.

There is a provided poc.dat to verify the issue/fix:

2003/12/20 Organic Co-op
  Expenses:Food:Groceries             $ 37.50  ; ] [=2004/01/01]

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-2807
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2807
[1] https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0303

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore