Here's the diff for my nmu.
Cheers, Moritz
diff -u lam-7.1.2/debian/changelog lam-7.1.2/debian/changelog --- lam-7.1.2/debian/changelog +++ lam-7.1.2/debian/changelog @@ -1,3 +1,10 @@ +lam (7.1.2-1.6) unstable; urgency=medium + + * Non-maintainer upload. + * Fix CVE-2009-3726 in the internal ltdl copy (Closes: #559835) + + -- Moritz Muehlenhoff <j...@debian.org> Tue, 27 Jul 2010 22:29:03 -0400 + lam (7.1.2-1.5) unstable; urgency=medium * Non-maintainer upload. only in patch2: unchanged: --- lam-7.1.2.orig/share/libltdl/ltdl.c +++ lam-7.1.2/share/libltdl/ltdl.c @@ -2183,7 +2183,8 @@ static int try_dlopen LT_PARAMS((lt_dlhandle *handle, const char *filename)); static int tryall_dlopen LT_PARAMS((lt_dlhandle *handle, - const char *filename)); + const char *filename, + const char * useloader)); static int unload_deplibs LT_PARAMS((lt_dlhandle handle)); static int lt_argz_insert LT_PARAMS((char **pargz, size_t *pargz_len, @@ -2369,9 +2370,10 @@ } static int -tryall_dlopen (handle, filename) +tryall_dlopen (handle, filename, useloader) lt_dlhandle *handle; const char *filename; + const char *useloader; { lt_dlhandle cur; lt_dlloader *loader; @@ -2438,6 +2440,11 @@ while (loader) { + if (useloader && strcmp(loader->loader_name, useloader)) + { + loader = loader->next; + continue; + } lt_user_data data = loader->dlloader_data; cur->module = loader->module_open (data, filename); @@ -2507,7 +2514,7 @@ error += tryall_dlopen_module (handle, (const char *) 0, prefix, filename); } - else if (tryall_dlopen (handle, filename) != 0) + else if (tryall_dlopen (handle, filename, NULL) != 0) { ++error; } @@ -2528,7 +2535,7 @@ /* Try to open the old library first; if it was dlpreopened, we want the preopened version of it, even if a dlopenable module is available. */ - if (old_name && tryall_dlopen (handle, old_name) == 0) + if (old_name && tryall_dlopen (handle, old_name, "dlpreload") == 0) { return 0; } @@ -2792,7 +2799,7 @@ /* Try to dlopen the file, but do not continue searching in any case. */ - if (tryall_dlopen (handle, filename) != 0) + if (tryall_dlopen (handle, filename,NULL) != 0) *handle = 0; return 1; @@ -3081,7 +3088,7 @@ /* lt_dlclose()ing yourself is very bad! Disallow it. */ LT_DLSET_FLAG (*phandle, LT_DLRESIDENT_FLAG); - if (tryall_dlopen (&newhandle, 0) != 0) + if (tryall_dlopen (&newhandle, 0, NULL) != 0) { LT_DLFREE (*phandle); return 1; @@ -3203,7 +3210,7 @@ } #endif } - if (!file) + else { file = fopen (filename, LT_READTEXT_MODE); } @@ -3387,7 +3394,7 @@ #endif ))) { - if (tryall_dlopen (&newhandle, filename) != 0) + if (tryall_dlopen (&newhandle, filename, NULL) != 0) { newhandle = NULL; }