Your message dated Tue, 23 Feb 2010 22:00:25 +0100
with message-id <20100223210025.ga21...@galadriel.inutil.org>
and subject line Re: ghostscript: CVE-2008-3520 and CVE-2008-3522
has caused the Debian Bug report #559778,
regarding ghostscript: CVE-2008-3520 and CVE-2008-3522
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
559778: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559778
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: ghostscript
Version: 8.62.dfsg.1-3.2lenny1
Severity: serious
Tags: security
Hi,
the following CVE (Common Vulnerabilities & Exposures) ids were
published for jasper. Ghostscript embeds jasper in lenny embeds
jasper, and statically links to jasper in unstable (so it needs to be
rebuilt).
CVE-2008-3520[0]:
| Multiple integer overflows in JasPer 1.900.1 might allow
| context-dependent attackers to have an unknown impact via a crafted
| image file, related to integer multiplication for memory allocation.
CVE-2008-3522[1]:
| Buffer overflow in the jas_stream_printf function in
| libjasper/base/jas_stream.c in JasPer 1.900.1 might allow
| context-dependent attackers to have an unknown impact via vectors
| related to the mif_hdr_put function and use of vsprintf.
If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3520
http://security-tracker.debian.org/tracker/CVE-2008-3520
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3522
http://security-tracker.debian.org/tracker/CVE-2008-3522
--- End Message ---
--- Begin Message ---
Version: 8.64~dfsg-2
On Sun, Dec 06, 2009 at 09:15:56PM -0500, Michael Gilbert wrote:
> Package: ghostscript
> Version: 8.62.dfsg.1-3.2lenny1
> Severity: serious
> Tags: security
>
> Hi,
> the following CVE (Common Vulnerabilities & Exposures) ids were
> published for jasper. Ghostscript embeds jasper in lenny embeds
> jasper, and statically links to jasper in unstable (so it needs to be
> rebuilt).
Closing in unstable due to dynamic linking.
Cheers,
Moritz
--- End Message ---
