[CVE-2007-5395] link-grammar is vulnerable

Thanks for getting this prepared. Since this is a user-assisted attack and Edgy and newer should be stack-overflow-protected, I'm giving this a low priority. I will get it uploaded shortly. Thanks!

Thanks for getting these prepared. I haven't been able to reproduce a crash with "just" a 62 character word. Have you seen any proof-of-concepts for this? I've uploaded the fixes to the security queue, they should be published shortly.

link-grammar (4.2.2-4ubuntu0.7.10.1) gutsy-security; urgency=low

  * SECURITY UPDATE: Stack-based buffer overflow in the separate_word function
    in tokenize.c in Link Grammar 4.1b and possibly other versions, as used in
    AbiWord Link Grammar 4.2.4, allows remote attackers to execute arbitrary code
    via a long word, as reachable through the separate_sentence function.
  * debian/patches/CVE-2007-5395: Added patch according to upstream.
    (See: https://bugzilla.redhat.com/attachment.cgi?id=255061)
    (LP: #162511)
  * References:
    CVE-2007-5395
    https://bugzilla.redhat.com/show_bug.cgi?id=371221

 -- Stephan Hermann <email address hidden> Tue, 13 Nov 2007 22:32:54 +0100

link-grammar (4.2.2-4ubuntu0.7.04.1) feisty-security; urgency=low

  * SECURITY UPDATE: Stack-based buffer overflow in the separate_word function
    in tokenize.c in Link Grammar 4.1b and possibly other versions, as used in
    AbiWord Link Grammar 4.2.4, allows remote attackers to execute arbitrary code
    via a long word, as reachable through the separate_sentence function.
  * debian/patches/CVE-2007-5395: Added patch according to upstream.
    (See: https://bugzilla.redhat.com/attachment.cgi?id=255061)
    (LP: #162511)
  * References:
    CVE-2007-5395
    https://bugzilla.redhat.com/show_bug.cgi?id=371221

 -- Stephan Hermann <email address hidden> Tue, 13 Nov 2007 22:38:50 +0100