Your message dated Sun, 13 Dec 2009 12:47:11 +0000
with message-id <e1njnqx-0000nm...@ries.debian.org>
and subject line Bug#560924: fixed in ayttm 0.6.1-2
has caused the Debian Bug report #560924,
regarding CVE-2009-3560 and CVE-2009-3720 denial-of-services
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
560924: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560924
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
package: ayttm
severity: serious
tags: security
Hi,
The following CVE (Common Vulnerabilities & Exposures) ids were
published for expat. I have determined that this package embeds a
vulnerable copy of xmlparse.c and xmltok_impl.c. However, since this is
a mass bug filing (due to so many packages embedding expat), I have
not had time to determine whether the vulnerable code is actually
present in any of the binary packages derived from this source package.
Please determine whether this is the case. If the binary packages are
not affected, please feel free to close the bug with a message
containing the details of what you did to check.
CVE-2009-3560[0]:
| The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
| as used in the XML-Twig module for Perl, allows context-dependent
| attackers to cause a denial of service (application crash) via an XML
| document with malformed UTF-8 sequences that trigger a buffer
| over-read, related to the doProlog function in lib/xmlparse.c, a
| different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVE-2009-3720[1]:
| The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
| 2.0.1, as used in Python, PyXML, w3c-libwww, and other software,
| allows context-dependent attackers to cause a denial of service
| (application crash) via an XML document with crafted UTF-8 sequences
| that trigger a buffer over-read, a different vulnerability than
| CVE-2009-2625.
These issues also affect old versions of expat, so this package in etch
and lenny is very likely affected. This is a low-severity security
issue, so DSAs will not be issued to correct these problems. However,
you can optionally submit a proposed-update to the release team for
inclusion in the next stable point releases. If you plan to do this,
please open new bugs and include the security tag so we are aware that
you are working on that.
For further information see [0],[1],[2],[3]. In particular, [2] and [3]
are links to the patches for CVE-2009-3560 and CVE-2009-3720
respectively. Note that the ideal solution would be to make use of the
system expat so only one package will need to be updated for future
security issues. Preferably in your update to unstable, alter your
package to make use of the system expat.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560
http://security-tracker.debian.org/tracker/CVE-2009-3560
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720
http://security-tracker.debian.org/tracker/CVE-2009-3720
[2]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
[3]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
--- End Message ---
--- Begin Message ---
Source: ayttm
Source-Version: 0.6.1-2
We believe that the bug you reported is fixed in the latest version of
ayttm, which is due to be installed in the Debian FTP archive:
ayttm_0.6.1-2.debian.tar.gz
to main/a/ayttm/ayttm_0.6.1-2.debian.tar.gz
ayttm_0.6.1-2.dsc
to main/a/ayttm/ayttm_0.6.1-2.dsc
ayttm_0.6.1-2_amd64.deb
to main/a/ayttm/ayttm_0.6.1-2_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 560...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Kartik Mistry <kar...@debian.org> (supplier of updated ayttm package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sun, 13 Dec 2009 14:57:55 +0530
Source: ayttm
Binary: ayttm
Architecture: source amd64
Version: 0.6.1-2
Distribution: unstable
Urgency: high
Maintainer: Kartik Mistry <kar...@debian.org>
Changed-By: Kartik Mistry <kar...@debian.org>
Description:
ayttm - Universal instant messaging client
Closes: 560924
Changes:
ayttm (0.6.1-2) unstable; urgency=high
.
* debian/patches/expat_security_fix.diff:
+ Added patch to fix expat security bug, CVE-2009-3560 and
CVE-2009-3720 (Closes: #560924)
* Setting urgency high for security bug
* Converted package to 3.0 (quilt) source format
Checksums-Sha1:
9fd9ac1876c35fb971ded155ec2fc3fde4af5278 1200 ayttm_0.6.1-2.dsc
ba38111f17086b24978862da5f9460ac88fb08c6 10491 ayttm_0.6.1-2.debian.tar.gz
ab2d6229d54a8ca6bf2e68fe90bf7fc132b0e698 1016100 ayttm_0.6.1-2_amd64.deb
Checksums-Sha256:
3d473425a5b39ffdeb0b2986dda598cb224ebe239a0b809c31b34e6c44139216 1200
ayttm_0.6.1-2.dsc
69402a22823e74a6b2bd5add9d02ab3e95964e52edd4deef20c655b398833246 10491
ayttm_0.6.1-2.debian.tar.gz
71a38e5b2c2e62c11edf7679c2f44a3cc18ffccc1d8eb9f2ceb6c25e4744a1c0 1016100
ayttm_0.6.1-2_amd64.deb
Files:
8e9d318e491df10cbeee78e440d286df 1200 net optional ayttm_0.6.1-2.dsc
db633c5f63dae9f1ec6d58d99fcc5f45 10491 net optional ayttm_0.6.1-2.debian.tar.gz
31d0b0cd66039a926dc721f172b6e606 1016100 net optional ayttm_0.6.1-2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAksk4GoACgkQoRg/jtECjI2dgQCcDWbumbjazeUArpDaySgKSQRb
ED4AoIlYRslbsNJ+vPLj6UWj2kzdE27X
=sLZp
-----END PGP SIGNATURE-----
--- End Message ---
