Your message dated Mon, 05 Jul 2010 23:02:13 +0000
with message-id <e1ovug1-0004lj...@franck.debian.org>
and subject line Bug#588090: fixed in bogofilter 1.2.1-3
has caused the Debian Bug report #588090,
regarding heap corruption overrun in bogofilter/bogolexer
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
588090: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=588090
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: bogofilter
Severity: grave
Tags: security
The following security issue was found in bogofilter:
bogofilter-SA-2010-01
Topic: heap corruption overrun in bogofilter/bogolexer
Announcement: bogofilter-SA-2010-01
Writer: Matthias Andree
Version: 0.1
CVE ID:
Announced:
Category: vulnerability
Type: array index underflow/out of bounds write through invalid input
Impact: heap corruption, application crash
Credits: Julius Plenz
Danger: medium
URL: http://bogofilter.sourceforge.net/security/bogofilter-SA-2010-01
Affected: bogofilter <= 1.2.1
SVN before 2010-07-03 08:40 UTC
Not affected: bogofilter 1.2.2 (to be released)
1. Background
=============
Bogofilter is a software package for classifying a message as spam or
non-spam. It uses a data base to store words and must be trained
which messages are spam and non-spam. It uses the probabilities of
individual words for classifying the message.
Note that the bogofilter project is issuing security announcements only
for current "stable" releases, and not necessarily for past "stable"
releases.
2. Problem description
======================
Bogofilter's/bogolexer's base64 could overwrite memory before its heap
buffer if the base64 input started with an equals sign, such as through
misdeclaration of quoted-printable as base64.
3. Impact
=========
Vulnerable bogofilter and bogolexer applications can corrupt their heap and
crash. The consequences are dependent on the local configuration, memory
layout and operating system features.
4. Solution
===========
Upgrade your bogofilter to version 1.2.2 (or a newer release).
bogofilter is available from SourceForge:
<https://sourceforge.net/project/showfiles.php?group_id=62265>
A. Copyright, License and Warranty
==================================
(C) Copyright 2010 by Matthias Andree, <matthias.and...@gmx.de>.
Some rights reserved.
This work is licenced under the Creative Commons
Attribution-NonCommercial-NoDerivs 3.0 Unported License. To view a copy
of this licence, visit http://creativecommons.org/licenses/by-nc-nd/3.0/
or send a letter to Creative Commons, 171 Second Street, Suite 300, San
Francisco, California 94105, USA.
THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.
END of bogofilter-SA-2010-01
-- System Information:
Debian Release: squeeze/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.32-5-686 (SMP w/1 CPU core)
Locale: LANG=C, lc_ctype=de_de.iso-8859...@euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash
Versions of packages bogofilter depends on:
pn bogofilter-bdb <none> (no description available)
bogofilter recommends no packages.
bogofilter suggests no packages.
--- End Message ---
--- Begin Message ---
Source: bogofilter
Source-Version: 1.2.1-3
We believe that the bug you reported is fixed in the latest version of
bogofilter, which is due to be installed in the Debian FTP archive:
bogofilter-bdb_1.2.1-3_i386.deb
to main/b/bogofilter/bogofilter-bdb_1.2.1-3_i386.deb
bogofilter-common_1.2.1-3_all.deb
to main/b/bogofilter/bogofilter-common_1.2.1-3_all.deb
bogofilter-sqlite_1.2.1-3_i386.deb
to main/b/bogofilter/bogofilter-sqlite_1.2.1-3_i386.deb
bogofilter-tokyocabinet_1.2.1-3_i386.deb
to main/b/bogofilter/bogofilter-tokyocabinet_1.2.1-3_i386.deb
bogofilter_1.2.1-3.debian.tar.gz
to main/b/bogofilter/bogofilter_1.2.1-3.debian.tar.gz
bogofilter_1.2.1-3.dsc
to main/b/bogofilter/bogofilter_1.2.1-3.dsc
bogofilter_1.2.1-3_i386.deb
to main/b/bogofilter/bogofilter_1.2.1-3_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 588...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Serafeim Zanikolas <s...@debian.org> (supplier of updated bogofilter package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Tue, 06 Jul 2010 00:21:16 +0200
Source: bogofilter
Binary: bogofilter bogofilter-bdb bogofilter-sqlite bogofilter-tokyocabinet
bogofilter-common
Architecture: source i386 all
Version: 1.2.1-3
Distribution: unstable
Urgency: high
Maintainer: Serafeim Zanikolas <s...@debian.org>
Changed-By: Serafeim Zanikolas <s...@debian.org>
Description:
bogofilter - a fast Bayesian spam filter (dummy package)
bogofilter-bdb - a fast Bayesian spam filter (Berkeley DB)
bogofilter-common - a fast Bayesian spam filter (common files)
bogofilter-sqlite - a fast Bayesian spam filter (sqlite)
bogofilter-tokyocabinet - a fast Bayesian spam filter (tokyocabinet)
Closes: 581995 582882 583311 588090
Changes:
bogofilter (1.2.1-3) unstable; urgency=high
.
* Apply patch from Julius Plenz <pl...@cis.fu-berlin.de> to prevent possible
heap corruption due to a bug in the base64_decode function (see
bogofilter-SA-2010-01). Setting urgency=high. closes: #588090.
* Do not hardwire the optimisation level for s390. closes: 582882.
* Apply patch from Loïc Minier <l...@dooz.org> to not build
bogofilter-tokyocabinet for Ubuntu (and Ubuntu-derived) distributions.
closes: #581995.
* Force autoconf to use bash. closes: #583311.
* debian/bogofilter-common.NEWS: fix debian-news-entry-without-blank-line
* debian/control:Maintainer: set to my debian email address.
* Bump Standards-Version to 3.9.0 (no changes).
Checksums-Sha1:
61a16d274cf4e000f311bd6d8973a935f39a1eb0 1792 bogofilter_1.2.1-3.dsc
4a2a6bdda2ff3458bd7c2e9e8b4f80353112d4ef 17344 bogofilter_1.2.1-3.debian.tar.gz
1a2d7f2dcacfd5d1a04b477468acb8f115d59aaf 964 bogofilter_1.2.1-3_i386.deb
98f54a25f9528c8d3442d8d13ad5b161c6e314d9 240976 bogofilter-bdb_1.2.1-3_i386.deb
608119f7ffb3f33de83504d910249ca2616364f1 205924
bogofilter-sqlite_1.2.1-3_i386.deb
daf53c63526be464de6fc03fa7aaaae5529e2a4b 199632
bogofilter-tokyocabinet_1.2.1-3_i386.deb
7162eb7d319dd2556df52ea96182aec6c656c4b1 188926
bogofilter-common_1.2.1-3_all.deb
Checksums-Sha256:
8665fb9077259aadc2be6111dbed1cf00e9f26c5ae6762fdab8bc926b590bcf3 1792
bogofilter_1.2.1-3.dsc
b327146eaaed744e5f287d305f275571d39e8806027e940f40092cb6286523a4 17344
bogofilter_1.2.1-3.debian.tar.gz
8132cc86697089875ea1294f7352f0f926f6744c7e3a95a409cb6110f7aae5f4 964
bogofilter_1.2.1-3_i386.deb
de82026426d4fa9458de36e98e0858ae8bea9c41fdb2e2f57a3b84633a47a238 240976
bogofilter-bdb_1.2.1-3_i386.deb
488f6b2a202c4e9b6760374da6e967234591923b0ea81ba136d4de166c4c63bc 205924
bogofilter-sqlite_1.2.1-3_i386.deb
182cea63d755ff8d866c4966e0b01c7dca58e8993b9720bca82e44d3166af5dd 199632
bogofilter-tokyocabinet_1.2.1-3_i386.deb
bf7dd160387b36d5cb88e5ca7fe86a99ad3679b4e67b084376024849564db7fb 188926
bogofilter-common_1.2.1-3_all.deb
Files:
4696c8296ed989db30e56acd91f7aed6 1792 mail optional bogofilter_1.2.1-3.dsc
b84ab8a795e4595a099a5ac2418e8dad 17344 mail optional
bogofilter_1.2.1-3.debian.tar.gz
8358628e8212b57b4a8555e3eba01737 964 mail optional bogofilter_1.2.1-3_i386.deb
15b570d4124ac1690d592087a7a4fdc2 240976 mail optional
bogofilter-bdb_1.2.1-3_i386.deb
1fdb8dce13ff0b77ea87aa3207f25112 205924 mail extra
bogofilter-sqlite_1.2.1-3_i386.deb
4cb99ae55581a697852e8207d0a9dfec 199632 mail extra
bogofilter-tokyocabinet_1.2.1-3_i386.deb
b62adee51c39d77ced278ddaeaf41aa5 188926 mail optional
bogofilter-common_1.2.1-3_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQIcBAEBCAAGBQJMMl/lAAoJEE+fbVUO1hIqnLQP/0KjiQAqr6tkFJfAHN6nrQMQ
f5vpszzxfCGYhM7H3evXqa/KeuOWS8sbI7PWvDCckPhh0ClGdvkY2Y2dF1OABCr3
8ZItWfc8uFhIhe8q1O8XsJARSG8h1h4fQ+VAryFdR5shLmD+HduOOGDUp8J8Zlo9
gmoWJGy0G+abb2Hp7ssordP6SygtLJDeIbfWkiE2e3a4UIikiqIaiISzLxpYsUKF
XOZSEd115Q6RjXwPHWncSshcOwvapj2TKNZb7EgUcnspf6a4PUJ4FtJPLVAFLyKX
gvbgUEaYKlj+9pKhutwbjuVtbPOEzZ8d2EAJrspCN4XrFa7PYKxt6x9cWD1A4AK3
dPx+7xgUN7m12eYA6H7Kn3VCXxi1zeBzXbIize0zzjFW7UVegZC3mhTmTK42NuaB
OYvIu1qyMF2v6378VgXWVOitrgvFvU3Srv76QuER+jta60hg32zPqIG0LwYNN/xj
z1iYA25UZGCJ90FO+tvr9xuWsmYqd0v023IbS6tJULDhUqyCDI5pTLIHsVUozDqR
55lqFI4jWEWgat6SYiPW1LJnpP00LTp0CpGwXS8M/1X9ri5Rb2oe9s9SS2SwlAmR
1RJnNwBfSjiEB2km/UOwEV4ggBVXmfdgYzWQ6xdivyysYG7Y3G6/QUUlvfdss/4L
j4oCTmQv2rStSppKd6Bc
=Ni1J
-----END PGP SIGNATURE-----
--- End Message ---
