Your message dated Tue, 23 Feb 2010 22:17:51 +0000
with message-id <e1nk34h-00028a...@ries.debian.org>
and subject line Bug#560950: fixed in xotcl 1.6.5-1.2
has caused the Debian Bug report #560950,
regarding CVE-2009-3560 and CVE-2009-3720 denial-of-services
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
560950: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560950
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
package: xotcl
severity: serious
tags: security
Hi,
The following CVE (Common Vulnerabilities & Exposures) ids were
published for expat. I have determined that this package embeds a
vulnerable copy of xmlparse.c and xmltok_impl.c. However, since this is
a mass bug filing (due to so many packages embedding expat), I have
not had time to determine whether the vulnerable code is actually
present in any of the binary packages derived from this source package.
Please determine whether this is the case. If the binary packages are
not affected, please feel free to close the bug with a message
containing the details of what you did to check.
CVE-2009-3560[0]:
| The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
| as used in the XML-Twig module for Perl, allows context-dependent
| attackers to cause a denial of service (application crash) via an XML
| document with malformed UTF-8 sequences that trigger a buffer
| over-read, related to the doProlog function in lib/xmlparse.c, a
| different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVE-2009-3720[1]:
| The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
| 2.0.1, as used in Python, PyXML, w3c-libwww, and other software,
| allows context-dependent attackers to cause a denial of service
| (application crash) via an XML document with crafted UTF-8 sequences
| that trigger a buffer over-read, a different vulnerability than
| CVE-2009-2625.
These issues also affect old versions of expat, so this package in etch
and lenny is very likely affected. This is a low-severity security
issue, so DSAs will not be issued to correct these problems. However,
you can optionally submit a proposed-update to the release team for
inclusion in the next stable point releases. If you plan to do this,
please open new bugs and include the security tag so we are aware that
you are working on that.
For further information see [0],[1],[2],[3]. In particular, [2] and [3]
are links to the patches for CVE-2009-3560 and CVE-2009-3720
respectively. Note that the ideal solution would be to make use of the
system expat so only one package will need to be updated for future
security issues. Preferably in your update to unstable, alter your
package to make use of the system expat.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560
http://security-tracker.debian.org/tracker/CVE-2009-3560
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720
http://security-tracker.debian.org/tracker/CVE-2009-3720
[2]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
[3]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
--- End Message ---
--- Begin Message ---
Source: xotcl
Source-Version: 1.6.5-1.2
We believe that the bug you reported is fixed in the latest version of
xotcl, which is due to be installed in the Debian FTP archive:
aolserver4-xotcl_1.6.5-1.2_all.deb
to main/x/xotcl/aolserver4-xotcl_1.6.5-1.2_all.deb
xotcl-dev_1.6.5-1.2_i386.deb
to main/x/xotcl/xotcl-dev_1.6.5-1.2_i386.deb
xotcl-doc_1.6.5-1.2_all.deb
to main/x/xotcl/xotcl-doc_1.6.5-1.2_all.deb
xotcl-shells_1.6.5-1.2_i386.deb
to main/x/xotcl/xotcl-shells_1.6.5-1.2_i386.deb
xotcl_1.6.5-1.2.diff.gz
to main/x/xotcl/xotcl_1.6.5-1.2.diff.gz
xotcl_1.6.5-1.2.dsc
to main/x/xotcl/xotcl_1.6.5-1.2.dsc
xotcl_1.6.5-1.2_i386.deb
to main/x/xotcl/xotcl_1.6.5-1.2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 560...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Moritz Muehlenhoff <j...@debian.org> (supplier of updated xotcl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Tue, 23 Feb 2010 21:51:50 +0100
Source: xotcl
Binary: xotcl xotcl-shells xotcl-doc xotcl-dev aolserver4-xotcl
Architecture: source all i386
Version: 1.6.5-1.2
Distribution: unstable
Urgency: high
Maintainer: Tcl/Tk Debian Packagers <pkg-tcltk-de...@lists.alioth.debian.org>
Changed-By: Moritz Muehlenhoff <j...@debian.org>
Description:
aolserver4-xotcl - Extended Object Tcl (XOTcl): Object orientation for
AOLServer - m
xotcl - Extended Object Tcl (XOTcl): Object orientation for Tcl - shared
xotcl-dev - Extended Object Tcl (XOTcl): Object orientation for Tcl - develop
xotcl-doc - Extended Object Tcl (XOTcl): Object orientation for Tcl - manual
xotcl-shells - Extended Object Tcl (XOTcl): Object orientation for Tcl - shells
Closes: 560950
Changes:
xotcl (1.6.5-1.2) unstable; urgency=high
.
* Non-maintainer upload by the Security Team
* Fix CVE-2009-3720 in embedded Expat copy. xotcl isn't affected by
CVE-2009-3560 (Closes: #560950)
Checksums-Sha1:
804b05d7076435be44f3e8f819de1bf6caaad094 1308 xotcl_1.6.5-1.2.dsc
ec84cf62cbb3d73b18195b68cc6250624609243e 6677 xotcl_1.6.5-1.2.diff.gz
c5a09786150c27e59be216761189ee3de22ea9a9 1117410 xotcl-doc_1.6.5-1.2_all.deb
08317d8c118bbf6dc85486f01c02418519d30dc7 50848
aolserver4-xotcl_1.6.5-1.2_all.deb
b6f5d8c21e5eda0fb819af8646a051d25355dae5 309256 xotcl_1.6.5-1.2_i386.deb
314be22aabac7c50c444d1cd5e6b559b380ffdc8 214258 xotcl-shells_1.6.5-1.2_i386.deb
456a7f6d469dc9f6463eba2dffeb766b1fcca748 63440 xotcl-dev_1.6.5-1.2_i386.deb
Checksums-Sha256:
8880a2e74e46b00d8eeae3fb22d5fbb3d6769644ca0fec82ec20229cc5e00756 1308
xotcl_1.6.5-1.2.dsc
363451995d0ea34cf7564d091d8cd407f0cdc38b80c880a7ab1f4ae625f583ae 6677
xotcl_1.6.5-1.2.diff.gz
66068abeeee53e1253877c187c9b4d372056140bc21668b7281a8e16c5338790 1117410
xotcl-doc_1.6.5-1.2_all.deb
bc4455ace7d5bc2a3a161e251b43c67f3270523c8ee9d8fed61cfe932c6f519d 50848
aolserver4-xotcl_1.6.5-1.2_all.deb
dca9c4ab829587a3c67282afb9fd4598770ede6a149a787d1a97ba31d8eacb85 309256
xotcl_1.6.5-1.2_i386.deb
4e1007f9c321f2e38bea39468e885044f6f05218971a68ec1e4c6fb5538917a1 214258
xotcl-shells_1.6.5-1.2_i386.deb
22f469d55f2a9554da45f82990393a8abdf55e22b9781d7ce369b4d9fb2a976f 63440
xotcl-dev_1.6.5-1.2_i386.deb
Files:
170622f677603812962ec38f643bb880 1308 libs optional xotcl_1.6.5-1.2.dsc
4d2d6c324fef0b9703a2ee16fdef82f7 6677 libs optional xotcl_1.6.5-1.2.diff.gz
bb91ab466684661da5a5997c709d4ac5 1117410 doc optional
xotcl-doc_1.6.5-1.2_all.deb
043ac7e5bd77750dbe8ed819c74ef3e2 50848 httpd optional
aolserver4-xotcl_1.6.5-1.2_all.deb
6beae88c46381f568cbb6fa79fd469da 309256 libs optional xotcl_1.6.5-1.2_i386.deb
b241039a14e5749a2285747de370e4a2 214258 utils optional
xotcl-shells_1.6.5-1.2_i386.deb
264edcf9e0f739bc6ce54549cbf41a81 63440 libdevel optional
xotcl-dev_1.6.5-1.2_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAkuEQIgACgkQXm3vHE4uylpREQCfSVSzpUKYkwxSLSfa1fDDP76H
FeUAoJ5USvIJEfUCNDIs5VH5hPfrZCps
=IArB
-----END PGP SIGNATURE-----
--- End Message ---
