rhythmbox crashed with SIGSEGV in g_cclosure_marshal_VOID__STRING()

[Kees Cook]

Binary package hint: rhythmbox

CVE-2008-7185

Hardy: http://packetstormsecurity.org/0806-advisories/rhythmbox-dos.txt
Intrepid, Jaunty, Karmic are not affected.

Likely the same as bug 270139.

Seems to be executing heap (!!) after calling playlist_load_ended_cb().

$ mkdir /tmp/i
$ cd /tmp/i
$ apport-unpack /tmp/_usr_bin_rhythmbox.1000.crash .
$ python /usr/share/apport/general-hooks/parse_segv.py Registers Disassembly ProcMaps
executing writable VMA [heap]
reading unknown VMA

Segfault happened at: 0x8461c5e: sbb (%eax),%cl
PC (0x08461c5e) in non-executable VMA region: 0x080dc000-0x08c39000 rw-p [heap]
source "(%eax)" (0x40082ee1) not located in a known VMA region (needed readable region)!
destination "%cl" ok

ProblemType: Crash
Architecture: i386
Date: Thu Sep 10 15:42:22 2009
DistroRelease: Ubuntu 8.04
ExecutablePath: /usr/bin/rhythmbox
Package: rhythmbox 0.11.5-0ubuntu8
PackageArchitecture: i386
ProcCmdline: rhythmbox
ProcEnviron:
 SHELL=/bin/bash
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
Signal: 11
SourcePackage: rhythmbox
StacktraceTop:
 ?? ()
 ?? ()
 g_cclosure_marshal_VOID__STRING ()
 g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
 ?? () from /usr/lib/libgobject-2.0.so.0
Title: rhythmbox crashed with SIGSEGV in g_cclosure_marshal_VOID__STRING()
Uname: Linux 2.6.24-24-generic i686
UserGroups: adm admin audio cdrom dialout dip floppy plugdev scanner video

[Kees Cook (kees)]

http://git.gnome.org/cgit/rhythmbox/commit/?id=5d8c34c60b6d89c209da2afc3fd2bc62211785e6

[Kees Cook (kees)]

Looks to be static heap location, unmarking as security for now.

[Rolf Leggewie (r0lf)]

Hardy has seen the end of its life and is no longer receiving any updates. Marking the Hardy task for this ticket as "Won't Fix".