Silent security fixes in virtuoso-opensource

[Florian Weimer <fweimer () redhat com>]

virtuoso-opensource is a database used by the KDE desktop search:

  <http://virtuoso.openlinksw.com/dataspace/doc/dav/wiki/Main>

A long time ago, we looked at the low-level data marshaling code in the
database server, and found quite a few memory safety issues.  We also
encountered server crashes and problems which looked like race
conditions, affecting server stability.

KDE uses a private UNIX domain socket to communicate with a
user-specific database server, but the database server can be accessed
over TCP as well.

Upstream did not release a security advisory, but alluded to the fixes
in release announcement:

<http://virtuoso.openlinksw.com/dataspace/doc/dav/wiki/Main/VOSNews#Client%20RPC>

And in commit messages:

<https://github.com/openlink/virtuoso-opensource/commits/develop/6/libsrc/Dk>

We have not assigned CVE identifiers because the number of different
crashes we saw was fairly large, and we could not completely understand
how the RPC implementation is pieced together.

I'm sorry that this message is not particularly helpful.

-- 
Florian Weimer / Red Hat Product Security