Your message dated Fri, 11 Nov 2005 14:32:09 -0800
with message-id <[EMAIL PROTECTED]>
and subject line Bug#337972: fixed in libungif4 4.1.3-4
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 7 Nov 2005 16:52:25 +0000
>From [EMAIL PROTECTED] Mon Nov 07 08:52:25 2005
Return-path: <[EMAIL PROTECTED]>
Received: from box79162.elkhouse.de [213.9.79.162]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1EZAEK-0004jh-00; Mon, 07 Nov 2005 08:52:25 -0800
Received: from localhost.localdomain (unknown [66.103.220.155])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "Martin Pitt (iBook)", Issuer "piware CA" (verified OK))
by box79162.elkhouse.de (Postfix) with ESMTP id C03BC26CA93;
Mon, 7 Nov 2005 17:51:53 +0100 (CET)
Received: by localhost.localdomain (Postfix, from userid 1000)
id 514EFF59; Mon, 7 Nov 2005 11:51:51 -0500 (EST)
Date: Mon, 7 Nov 2005 11:51:50 -0500
From: Martin Pitt <[EMAIL PROTECTED]>
To: Debian BTS Submit <[EMAIL PROTECTED]>
Cc: [EMAIL PROTECTED]
Subject: libungif4g: buffer overflows and NULL dereference
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="5vNYLRcllDrimb99"
Content-Disposition: inline
User-Agent: Mutt/1.5.9i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
--5vNYLRcllDrimb99
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: libungif4g
Version: 4.1.3-2
Severity: critical
Tags: security patch
Hi!
Chris Evans discovered several buffer overflows (CVE-2005-3350) and a
NULL dereference (CVE-2005-2974), which were fixed upstream in 4.1.4.
Here is the Ubuntu patch which only contains the security relevant
bits:
http://patches.ubuntu.com/patches/libungif4.CVE-2005-2974_3350.diff
Thanks,
Martin
--=20
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntu.com
Debian Developer http://www.debian.org
--5vNYLRcllDrimb99
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDb4YmDecnbV4Fd/IRAjfZAJ99qfhOAwwJBjPJXa+3xsWTWHfcJwCdGceM
rvyMD8NyiN4AO/Ay2Po+fZM=
=WL4H
-----END PGP SIGNATURE-----
--5vNYLRcllDrimb99--
---------------------------------------
Received: (at 337972-close) by bugs.debian.org; 11 Nov 2005 22:35:09 +0000
>From [EMAIL PROTECTED] Fri Nov 11 14:35:09 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 4.50)
id 1EahRJ-0004Xf-3T; Fri, 11 Nov 2005 14:32:09 -0800
From: Michael Fedrowitz <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.56 $
Subject: Bug#337972: fixed in libungif4 4.1.3-4
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Fri, 11 Nov 2005 14:32:09 -0800
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Source: libungif4
Source-Version: 4.1.3-4
We believe that the bug you reported is fixed in the latest version of
libungif4, which is due to be installed in the Debian FTP archive:
libungif-bin_4.1.3-4_i386.deb
to pool/main/libu/libungif4/libungif-bin_4.1.3-4_i386.deb
libungif4-dev_4.1.3-4_i386.deb
to pool/main/libu/libungif4/libungif4-dev_4.1.3-4_i386.deb
libungif4_4.1.3-4.diff.gz
to pool/main/libu/libungif4/libungif4_4.1.3-4.diff.gz
libungif4_4.1.3-4.dsc
to pool/main/libu/libungif4/libungif4_4.1.3-4.dsc
libungif4g_4.1.3-4_i386.deb
to pool/main/libu/libungif4/libungif4g_4.1.3-4_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Fedrowitz <[EMAIL PROTECTED]> (supplier of updated libungif4 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Fri, 11 Nov 2005 23:07:09 +0100
Source: libungif4
Binary: libungif4-dev libungif4g libungif-bin
Architecture: source i386
Version: 4.1.3-4
Distribution: unstable
Urgency: low
Maintainer: Michael Fedrowitz <[EMAIL PROTECTED]>
Changed-By: Michael Fedrowitz <[EMAIL PROTECTED]>
Description:
libungif-bin - programs to convert GIF images
libungif4-dev - shared library for GIF images (development files)
libungif4g - shared library for GIF images (runtime lib)
Closes: 337972
Changes:
libungif4 (4.1.3-4) unstable; urgency=low
.
* Applied security patch from Ubuntu (thanks to Martin Pitt):
* SECURITY UPDATE: Arbitrary code execution with crafted GIF files.
* lib/dgif_lib.c:
- Fix NULL dereference crash with crafted LZW termination blocks.
- CVE-2005-2974
* lib/dgif_lib.c, lib/egif_lib.c, lib/gifalloc.c:
- Fix multiple buffer overflows with crafted GIF files, possibly
exploitable:
- CVE-2005-3350
(closes: #337972)
Files:
415b19d64f48bb3edad0412aa3bef069 622 graphics optional libungif4_4.1.3-4.dsc
b50ae9fe3259b890f5bfc324073f5680 136502 graphics optional
libungif4_4.1.3-4.diff.gz
0350ffa29949f033596eb3dda1969790 55744 libs optional
libungif4g_4.1.3-4_i386.deb
336385f55c184d44a6b5309ed1b228ee 39004 libdevel optional
libungif4-dev_4.1.3-4_i386.deb
6bfd070ebd300ade002069da8250db6f 187996 graphics optional
libungif-bin_4.1.3-4_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDdRcivpyGjQRgTrgRAh1YAJ9coi5QMtDxelH8/P0Uz1xhSxYimACgkFZn
SCGJKkiEsqzi9nvG8iYqW5s=
=cq+k
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
