[Bug 692483] Re: Buffer overflow

** Changed in: opensc (Debian) Status: Unknown => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/692483 Title: Buffer overflow -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubun

Re: [Bug 692483] Re: Buffer overflow

Thanks Jonathan! I caught the update today but missed the original bug. Sorry about that. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/692483 Title: Buffer overflow -- ubuntu-bugs mailing list ub

[Bug 692483] Re: Buffer overflow

For the record, this is CVE-2010-4523 and it's being tracked in Debian bug #607427 (#607732 was a duplicate) ** Bug watch added: Debian Bug tracker #607427 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607427 ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2010-4523 ** Cha

[Bug 692483] Re: Buffer overflow

** Branch linked: lp:ubuntu/maverick-security/opensc ** Branch linked: lp:ubuntu/karmic-security/opensc ** Branch linked: lp:ubuntu/lucid-security/opensc ** Branch linked: lp:ubuntu/hardy-security/opensc -- You received this bug notification because you are a member of Ubuntu Bugs, which is su

[Bug 692483] Re: Buffer overflow

This bug was fixed in the package opensc - 0.11.4-2ubuntu2.1 --- opensc (0.11.4-2ubuntu2.1) hardy-security; urgency=low * SECURITY UPDATE: specially crafted cards may be able to execute code. - Move MIN and MAX macros from muscle.c to internal.h - https://www.opensc-project.

[Bug 692483] Re: Buffer overflow

This bug was fixed in the package opensc - 0.11.8-1ubuntu2.1 --- opensc (0.11.8-1ubuntu2.1) karmic-security; urgency=low * SECURITY UPDATE: specially crafted cards may be able to execute code. - debian/patches/min-max.patch: Add MIN and MAX macros for last patch - debian/pat

[Bug 692483] Re: Buffer overflow

This bug was fixed in the package opensc - 0.11.12-1ubuntu3.2 --- opensc (0.11.12-1ubuntu3.2) lucid-security; urgency=low * SECURITY UPDATE: specially crafted cards may be able to execute code. - debian/patches/min-max.patch: Add MIN and MAX macros for last patch - debian/pa

[Bug 692483] Re: Buffer overflow

This bug was fixed in the package opensc - 0.11.13-1ubuntu2.1 --- opensc (0.11.13-1ubuntu2.1) maverick-security; urgency=low * SECURITY UPDATE: specially crafted cards may be able to execute code. - debian/patches/min-max.patch: Add MIN and MAX macros for last patch - debian

[Bug 692483] Re: Buffer overflow

Karmic also had the wrong version. In the future, please review https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging to make sure the debdiff is correct. Thanks again. :) ** Changed in: opensc (Ubuntu Hardy) Status: Confirmed => Fix Committed ** Changed in: opensc (Ubuntu Karmi

[Bug 692483] Re: Buffer overflow

We can use even short URLs in DEP3: instead https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483 I really preffer https://launchpad.net/bugs/692483 Regards and thanks for patch. MOTU SWAT -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed t

[Bug 692483] Re: Buffer overflow

Karmic also had the wrong version. In the future, please review https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Packaging to make sure the debdiff is correct. Thanks again. :) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. http

[Bug 692483] Re: Buffer overflow

** Also affects: opensc (Ubuntu Hardy) Importance: Undecided Status: New ** Also affects: opensc (Ubuntu Karmic) Importance: Undecided Status: New ** Changed in: opensc (Ubuntu Hardy) Status: New => Confirmed ** Changed in: opensc (Ubuntu Hardy) Importance: Undecide

[Bug 692483] Re: Buffer overflow

Also, the hardy debdiff has 'jaunty' instead of 'hardy-security' and uses the wrong version for hardy. It should be 0.11.4-2ubuntu2.1. I'll fix these up in the interest of time. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://b

[Bug 692483] Re: Buffer overflow

Torsten, thanks for the patches for the older releases. The karmic debdiff only has template text for the DEP-3 comments, and the hardy debdiff should have the DEP-3 info in the debian/changelog since there isn't a patch system. -- You received this bug notification because you are a member of Ub

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-hardy.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1772708/+files/opensc-hardy.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/69

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-karmic.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1772657/+files/opensc-karmic.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/

[Bug 692483] Re: Buffer overflow

** Branch linked: lp:ubuntu/opensc -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/692483 Title: Buffer overflow -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mai

[Bug 692483] Re: Buffer overflow

Used submittodebian to open http://bugs.debian.org/cgi- bin/bugreport.cgi?bug=607732. ** Bug watch added: Debian Bug tracker #607732 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607732 ** Also affects: opensc (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607732 Import

[Bug 692483] Re: Buffer overflow

Thanks for your patches! These look great and I have uploaded them to the security PPA. When they finish building, I will push them to the archive. Minor nit: with DEP-3 quilt patches you don't need the DEP-3 comments commented out with '##'. Eg, the following is preferred: Description: Fix buffe

[Bug 692483] Re: Buffer overflow

ACK ** Changed in: opensc (Ubuntu Lucid) Status: Confirmed => Fix Committed ** Changed in: opensc (Ubuntu Maverick) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchp

[Bug 692483] Re: Buffer overflow

This bug was fixed in the package opensc - 0.11.13-1ubuntu4 --- opensc (0.11.13-1ubuntu4) natty; urgency=low * SECURITY UPDATE: specially crafted cards may be able to execute code. - debian/patches/min-max.patch: Add MIN and MAX macros for last patch - debian/patches/buffer-

[Bug 692483] Re: Buffer overflow

** Also affects: opensc (Ubuntu Lucid) Importance: Undecided Status: New ** Also affects: opensc (Ubuntu Maverick) Importance: Undecided Status: New ** Also affects: opensc (Ubuntu Natty) Importance: Undecided Status: New ** Changed in: opensc (Ubuntu Lucid)

[Bug 692483] Re: Buffer overflow

** This bug has been flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/692483 Title: Buffer overflow -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https:

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-natty.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1772306/+files/opensc-natty.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/69

[Bug 692483] Re: Buffer overflow

** Patch removed: "opensc-natty.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771418/+files/opensc-natty.debdiff ** Patch removed: "opensc-lucid.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771517/+files/opensc-luc

[Bug 692483] Re: Buffer overflow

FWIW, I think the compiler flags[1] will reduce this vulnerability from being exploitable to only being a denial of service, but additional study would be needed. [1] https://wiki.ubuntu.com/CompilerFlags -- You received this bug notification because you are a member of Ubuntu Bugs, which is sub

[Bug 692483] Re: Buffer overflow

** Tags added: patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/692483 Title: Buffer overflow -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-maverick.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771518/+files/opensc-maverick.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/b

[Bug 692483] Re: Buffer overflow

** Patch removed: "opensc-lucid.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771515/+files/opensc-lucid.debdiff ** Patch removed: "opensc-maverick.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771516/+files/opensc-

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-maverick.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771516/+files/opensc-maverick.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/b

[Bug 692483] Re: Buffer overflow

** Patch removed: "opensc-lucid.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771441/+files/opensc-lucid.debdiff ** Patch removed: "opensc-maverick.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771455/+files/opensc-

[Bug 692483] Re: Buffer overflow

** Patch removed: "opensc-maverick.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771417/+files/opensc-maverick.debdiff ** Patch added: "opensc-maverick.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771455/+files/ope

[Bug 692483] Re: Buffer overflow

** Patch removed: "opensc-lucid.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771416/+files/opensc-lucid.debdiff ** Patch added: "opensc-lucid.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771441/+files/opensc-lucid

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-natty.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771418/+files/opensc-natty.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/69

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-maverick.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771417/+files/opensc-maverick.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/b

[Bug 692483] Re: Buffer overflow

** Patch removed: "opensc-natty.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771322/+files/opensc-natty.debdiff ** Patch removed: "opensc-lucid.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771323/+files/opensc-luc

[Bug 692483] Re: Buffer overflow

** Description changed: Binary package hint: opensc A potential security problem exists at least in Ubuntu 10.04 LTS and was fixed upstream in https://www.opensc-project.org/opensc/changeset/4913 . + + Testing: the package was tested on Lucid, no regression was obvious. -- You received

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-maverick.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771335/+files/opensc-maverick.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/b

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-lucid.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771323/+files/opensc-lucid.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/69

[Bug 692483] Re: Buffer overflow

** Patch added: "opensc-natty.debdiff" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771322/+files/opensc-natty.debdiff -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/69

[Bug 692483] Re: Buffer overflow

I've built a patched package for testing in https://launchpad.net/~tspindler/+archive/opensc-lvm A first test of the patched package on a smartcard enabled system was successful. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https:/

[Bug 692483] Re: Buffer overflow

** Patch added: "buffer-overflow.patch" https://bugs.launchpad.net/ubuntu/+source/opensc/+bug/692483/+attachment/1771278/+files/buffer-overflow.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/

[Bug 692483] Re: Buffer overflow

The problem seems to be also in the git repo from upstream Debian, git://git.debian.org/git/pkg-opensc/opensc.git . The attached patches are taken from opensc upstream (https://www.opensc- project.org/opensc/changeset/4912 and https://www.opensc- project.org/opensc/changeset/4913). ** Patch added: