CVE-2015-2675

Name	CVE-2015-2675
Description	The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	780101

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
librest (PTS)	bullseye	0.8.1-1.1	fixed
	bookworm, trixie	0.9.1-6	fixed
	forky, sid	0.10.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
librest	source	squeeze	(not affected)
librest	source	wheezy	(not affected)
librest	source	(unstable)	0.7.92-3	780101

Notes

[wheezy] - librest <not-affected> (rest_proxy_call_get_url not yet used)
[squeeze] - librest <not-affected> (rest_proxy_call_get_url not yet used)
Upstream bug: https://bugzilla.gnome.org/show_bug.cgi?id=742644
Commit: https://git.gnome.org/browse/librest/commit/?id=b50ace7738ea038
https://www.openwall.com/lists/oss-security/2015/03/04/6