Your message dated Sun, 24 Aug 2008 21:47:07 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#491182: fixed in byacc 20070509-1.1
has caused the Debian Bug report #491182,
regarding byacc: CVE-2008-3196: out of bound access
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
491182: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=491182
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: byacc
Severity: grave
Tags: security, patch
Justification: user security hole
Hi
Quoting an email[0] from Jan Lieskovsky about CVE-2008-3196.
Description of problem:
=======================
Otto Moerbeck has reported the following potential out of bounds of the
allocated stack access in the yacc binary:
Fix an venerable bug: if we're reducing a rule that has an empty
right hand side and the yacc stackpointer is pointing at the very
end of the allocated stack, we end up accessing the stack out of
bounds by the implicit $$ = $1 action. Detected by my new malloc,
experienced by sturm@ on sparc64; ok deraadt@
Public mention of this issue:
=============================
http://marc.info/?l=openbsd-cvs&m=121553004431393&w=2
Proposed OpenBSD patch:
=======================
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/yacc/skeleton.c.diff?r1=1.28&r2=1.29
When you fix this issue, please mention the CVE id in your changelog and upload
with high urgency, so
the packages reach testing quickly.
Cheers
Steffen
[0]: http://www.openwall.com/lists/oss-security/2008/07/15/3
--- End Message ---
--- Begin Message ---
Source: byacc
Source-Version: 20070509-1.1
We believe that the bug you reported is fixed in the latest version of
byacc, which is due to be installed in the Debian FTP archive:
byacc_20070509-1.1.diff.gz
to pool/main/b/byacc/byacc_20070509-1.1.diff.gz
byacc_20070509-1.1.dsc
to pool/main/b/byacc/byacc_20070509-1.1.dsc
byacc_20070509-1.1_amd64.deb
to pool/main/b/byacc/byacc_20070509-1.1_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Viehmann <[EMAIL PROTECTED]> (supplier of updated byacc package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sun, 24 Aug 2008 23:13:07 +0200
Source: byacc
Binary: byacc
Architecture: source amd64
Version: 20070509-1.1
Distribution: unstable
Urgency: high
Maintainer: Dave Beckett <[EMAIL PROTECTED]>
Changed-By: Thomas Viehmann <[EMAIL PROTECTED]>
Description:
byacc - public domain Berkeley LALR Yacc parser generator
Closes: 491182
Changes:
byacc (20070509-1.1) unstable; urgency=high
.
* Non-maintainer upload.
* Fix stack overflow in skeleton.c with upstream patch.
Closes: #491182 aka CVE-2008-3196
Checksums-Sha1:
459724e1cef02e07933f609fe29b94b554345379 953 byacc_20070509-1.1.dsc
88784358d3fea0751b375d02c533382ed5dc75ea 4624 byacc_20070509-1.1.diff.gz
b8e9ed576564a774ff8c30cf2f8e150790fefd79 48438 byacc_20070509-1.1_amd64.deb
Checksums-Sha256:
f54d7e9a9a11b55f8ad173676afccf9abc2c64c2778febd33e845243208c0199 953
byacc_20070509-1.1.dsc
69fdfad4359f4ba169e87846cf61c271477c956de58e5dd5e6c65a0579f9e4fc 4624
byacc_20070509-1.1.diff.gz
75e35a6ef73b3a5fcef5a2e7a5c992d46d2379b961f2508c02e9bfea845d5a29 48438
byacc_20070509-1.1_amd64.deb
Files:
6917c6a40aa4cefea41246b60cf2f216 953 devel extra byacc_20070509-1.1.dsc
1c1e90d3ef2b5c79d7e30a5d97190cee 4624 devel extra byacc_20070509-1.1.diff.gz
fae089035dfbe69c478b40fbbfd5b6fd 48438 devel extra byacc_20070509-1.1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkix1J8ACgkQriZpaaIa1PnJegCcDGaAdCI4WP1CxRdbv8Wdiky4
SZAAoNWAlK9UokxbytxdSuehN3SrKs59
=34s4
-----END PGP SIGNATURE-----
--- End Message ---
