wine opens the system to null pointer dereference security bugs (vm.mmap_min_addr)

Binary package hint: wine

The wine package installs this file:

  /etc/sysctl.d/wine.sysctl.conf

with the following contents:

  # Wine needs to access the bottom 64k of memory in order to launch
  # 16 bit programs.
  vm.mmap_min_addr = 0

This is a problem because it makes the system vulnerable to kernel null pointer dereference exploits.

I guess that the package does this to offer a "works out of the box" experience. Unfortunately it also make the system "unsecure by default". My preference would be "secure by default". The "does not work out of the box" problem is IMHO minor because:

 - it only concerns Win16 binaries and not Win32 binaries
(see http://wiki.debian.org/mmap_min_addr )
 - wine could display a clear error message to the rare users who want to run Win16 binaries

ProblemType: Bug
Architecture: i386
Date: Thu Nov 5 16:55:19 2009
DistroRelease: Ubuntu 9.10
Package: wine 1.0.1-0ubuntu8
ProcVersionSignature: Ubuntu 2.6.31-14.48-generic-pae
SourcePackage: wine
Uname: Linux 2.6.31-14-generic-pae i686
XsessionErrors:
 (polkit-gnome-authentication-agent-1:4006): GLib-CRITICAL **: g_once_init_leave: assertion `initialization_value != 0' failed
 (gnome-settings-daemon:4036): GLib-CRITICAL **: g_propagate_error: assertion `src != NULL' failed