Your message dated Sun, 04 Jun 2006 14:34:42 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#368202: fixed in dia 0.95.0-4
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: dia
Version: 0.95.0-3
Severity: normal
Tags: security patch
CVE-2006-2480: "Format string vulnerability in Dia 0.94 allows
user-complicit attackers to cause a denial of service (crash) and
possibly execute arbitrary code via format string specifiers in a .bmp
filename. NOTE: since the exploit occurs through a command line
argument, it is possible that this is not a vulnerability, unless there
exist typical mechanisms under which the filename is automatically
provided to Dia via another product, such as a browser."
This is GNOME Bugzilla #342111 [1]; there is a proposed patch [2]
attached to that entry. Although the CVE mentions only version 0.94,
Debian's 0.95.0-3 is vulnerable, and I am able to reproduce the issue
with the instructions in Bugzilla. With the patch applied, Dia no
longer crashes but gives a "can't open" message.
Please mention the CVE number in your changelog.
Thanks,
Alec
[1] http://bugzilla.gnome.org/show_bug.cgi?id=342111
[2] http://bugzilla.gnome.org/attachment.cgi?id=65665&action=view
--- End Message ---
--- Begin Message ---
Source: dia
Source-Version: 0.95.0-4
We believe that the bug you reported is fixed in the latest version of
dia, which is due to be installed in the Debian FTP archive:
dia-common_0.95.0-4_all.deb
to pool/main/d/dia/dia-common_0.95.0-4_all.deb
dia-gnome_0.95.0-4_i386.deb
to pool/main/d/dia/dia-gnome_0.95.0-4_i386.deb
dia-libs_0.95.0-4_i386.deb
to pool/main/d/dia/dia-libs_0.95.0-4_i386.deb
dia_0.95.0-4.diff.gz
to pool/main/d/dia/dia_0.95.0-4.diff.gz
dia_0.95.0-4.dsc
to pool/main/d/dia/dia_0.95.0-4.dsc
dia_0.95.0-4_i386.deb
to pool/main/d/dia/dia_0.95.0-4_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Roland Stigge <[EMAIL PROTECTED]> (supplier of updated dia package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 4 Jun 2006 15:29:05 +0200
Source: dia
Binary: dia-libs dia-common dia-gnome dia
Architecture: source i386 all
Version: 0.95.0-4
Distribution: unstable
Urgency: low
Maintainer: Debian Dia Team <[EMAIL PROTECTED]>
Changed-By: Roland Stigge <[EMAIL PROTECTED]>
Description:
dia - Diagram editor
dia-common - Diagram editor (common files)
dia-gnome - Diagram editor (GNOME version)
dia-libs - Diagram editor (library files)
Closes: 368202
Changes:
dia (0.95.0-4) unstable; urgency=low
.
* Applied upstream format string fixes: CVE-2006-2453 and CVE-2006-2480
(Closes: #368202)
Files:
9613e065cb511db1931a163735ea1bd8 931 graphics optional dia_0.95.0-4.dsc
1d2dcb6fd6ca6fe49bd751aa112c880b 20448 graphics optional dia_0.95.0-4.diff.gz
be9ed262671f1d3ecf489b58d0051542 3903338 graphics optional
dia-common_0.95.0-4_all.deb
39cc94cd61e9f1652f95f51819e80433 654096 graphics optional
dia-libs_0.95.0-4_i386.deb
1ea5dd3564d5cabb5ec0fe389e5c7b26 191668 graphics optional dia_0.95.0-4_i386.deb
244c4ee66698c05bc4222ebf372b2fa5 194084 gnome optional
dia-gnome_0.95.0-4_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
iD8DBQFEguiUcaH/YBv43g8RAjbSAJ9FqR3Z/vNGPZV8Ra1rpKVPacYwwACeK7Tl
PVO95MnD0dclOTll+3aNsVw=
=+J9X
-----END PGP SIGNATURE-----
--- End Message ---
