Bug#768485: dpkg: format string vulnerability

2014-11-11 Thread Jakub Wilk
* Guillem Jover , 2014-11-11, 02:23: BTW Jakub, did you find this in parallel, or simply relied the bug filed in Launchpad? The latter; all credit goes to Joshua. -- Jakub Wilk -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Con

Bug#768485: dpkg: format string vulnerability

2014-11-10 Thread Guillem Jover
Hi! On Mon, 2014-11-10 at 01:00:56 +1100, Joshua Rogers wrote: > On 08/11/14 06:47, Guillem Jover wrote: > > Nicely spotted! And thanks for the report, I've fixed it now locally > > and it will be included in the next 1.17.x release. I'll be preparing > > fixed packages for stable too. > Could y

Bug#768485: dpkg: format string vulnerability

2014-11-09 Thread Joshua Rogers
On 08/11/14 06:47, Guillem Jover wrote: > Nicely spotted! And thanks for the report, I've fixed it now locally > and it will be included in the next 1.17.x release. I'll be preparing > fixed packages for stable too. Hi Guillem, Could you provide a patch for this bug via email? Thanks -- -- Jo

Bug#768485: dpkg: format string vulnerability

2014-11-07 Thread Guillem Jover
Control: found -1 1.16.2 Hi! On Fri, 2014-11-07 at 19:42:29 +0100, Jakub Wilk wrote: > Package: dpkg > Version: 1.17.21 > Tags: security > # dpkg --dry-run -i printfvuln.deb > dpkg: warning: parsing file '/tmp/dpkg.bgGIF3/control' near line 3 package > 'printfvuln': > '%42$d' is not a valid ar

Bug#768485: dpkg: format string vulnerability

2014-11-07 Thread Jakub Wilk
Package: dpkg Version: 1.17.21 Tags: security # dpkg --dry-run -i printfvuln.deb dpkg: warning: parsing file '/tmp/dpkg.bgGIF3/control' near line 3 package 'printfvuln': '%42$d' is not a valid architecture name: must start with an alphanumeric *** invalid %N$ use detected *** Aborted This was