Advisories » MGASA-2019-0205

Updated dosbox package fixes security vulnerabilities

Publication date: 10 Jul 2019
Modification date: 10 Jul 2019
Type: security
Affected Mageia releases : 6 , 7
CVE: CVE-2019-7165 , CVE-2019-12594

Description

Dosbox 0.74-3 is a security release:
* Fixed that a very long line inside a bat file would overflow the
  parsing buffer. (CVE-2019-7165 by Alexandre Bartel)
* Added a basic permission system so that a program running inside
  DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when
  / or /proc were (to be) mounted. (CVE-2019-12594 by Alexandre Bartel)

It also brings several other fixes for out of bounds access and buffer
overflows, and some fixes to the OpenGL rendering.

The game compatibility should be identical to 0.74 and 0.74-2.
It is recommended to use config -securemode when dealing with untrusted
files.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=25013
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7165
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12594

SRPMS

6/core

• dosbox-0.74.3-1.mga6

7/core

• dosbox-0.74.3-1.mga7