Dear maintainer,
I've prepared an NMU for rpcbind (versioned as 0.2.3-0.6). The diff
is attached to this message.
Regards,
Salvatore
diff -Nru rpcbind-0.2.3/debian/changelog rpcbind-0.2.3/debian/changelog
--- rpcbind-0.2.3/debian/changelog 2016-06-17 17:54:27.000000000 +0200
+++ rpcbind-0.2.3/debian/changelog 2017-05-05 19:46:00.000000000 +0200
@@ -1,3 +1,14 @@
+rpcbind (0.2.3-0.6) unstable; urgency=high
+
+ * Non-maintainer upload.
+ * CVE-2017-8779: Memory leak when failing to parse XDR strings or bytearrays
+ (Closes: #861835)
+ * Bump runtime dependency on libtirpc1.
+ Bump Depends on libtirpc1 (>= 0.2.5-1.2~) to pull the fixes on libtirpc1
+ for CVE-2017-8779.
+
+ -- Salvatore Bonaccorso <car...@debian.org> Fri, 05 May 2017 19:46:00 +0200
+
rpcbind (0.2.3-0.5) unstable; urgency=medium
* Non-maintainer upload.
diff -Nru rpcbind-0.2.3/debian/control rpcbind-0.2.3/debian/control
--- rpcbind-0.2.3/debian/control 2016-05-30 17:59:16.000000000 +0200
+++ rpcbind-0.2.3/debian/control 2017-05-05 19:46:00.000000000 +0200
@@ -8,7 +8,7 @@
Package: rpcbind
Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, lsb-base (>= 4.1+Debian3), libtirpc1 (>= 0.2.4-2~)
+Depends: ${shlibs:Depends}, ${misc:Depends}, lsb-base (>= 4.1+Debian3), libtirpc1 (>= 0.2.5-1.2~)
Conflicts: portmap
Provides: portmap
Breaks: libc-bin (<< 2.16)
diff -Nru rpcbind-0.2.3/debian/patches/08-CVE-2017-8779.patch rpcbind-0.2.3/debian/patches/08-CVE-2017-8779.patch
--- rpcbind-0.2.3/debian/patches/08-CVE-2017-8779.patch 1970-01-01 01:00:00.000000000 +0100
+++ rpcbind-0.2.3/debian/patches/08-CVE-2017-8779.patch 2017-05-05 19:46:00.000000000 +0200
@@ -0,0 +1,29 @@
+Description: CVE-2017-8779: Memory leak when failing to parse XDR strings or bytearrays
+Origin: vendor
+Bug: https://bugs.debian.org/861835
+Forwarded: not-needed
+Author: Guido Vranken <guidovran...@gmail.com>
+Reviewed-by: Salvatore Bonaccorso <car...@debian.org>
+Last-Update: 2017-05-05
+
+diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c
+index 5862c26..e11f61b 100644
+--- a/src/rpcb_svc_com.c
++++ b/src/rpcb_svc_com.c
+@@ -48,6 +48,7 @@
+ #include <rpc/rpc.h>
+ #include <rpc/rpcb_prot.h>
+ #include <rpc/svc_dg.h>
++#include <rpc/rpc_com.h>
+ #include <netconfig.h>
+ #include <errno.h>
+ #include <syslog.h>
+@@ -432,7 +433,7 @@ rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp /*__unused*/,
+ static bool_t
+ xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
+ {
+- return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), ~0));
++ return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), RPC_MAXDATASIZE));
+ }
+
+ /*
diff -Nru rpcbind-0.2.3/debian/patches/series rpcbind-0.2.3/debian/patches/series
--- rpcbind-0.2.3/debian/patches/series 2015-11-10 13:01:01.000000000 +0100
+++ rpcbind-0.2.3/debian/patches/series 2017-05-05 19:46:00.000000000 +0200
@@ -4,3 +4,4 @@
run-migration
CVE-2015-7236.patch
07-Delete-the-unix-socket-only-if-we-have-created-it.patch
+08-CVE-2017-8779.patch
