Your message dated Fri, 18 Dec 2009 10:20:36 +0000
with message-id <e1nlzwq-0000e7...@ries.debian.org>
and subject line Bug#560922: fixed in udunits 2.1.8-4
has caused the Debian Bug report #560922,
regarding CVE-2009-3560 and CVE-2009-3720 denial-of-services
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
560922: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560922
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
package: udunits
severity: serious
tags: security
Hi,
The following CVE (Common Vulnerabilities & Exposures) ids were
published for expat. I have determined that this package embeds a
vulnerable copy of xmlparse.c and xmltok_impl.c. However, since this is
a mass bug filing (due to so many packages embedding expat), I have
not had time to determine whether the vulnerable code is actually
present in any of the binary packages derived from this source package.
Please determine whether this is the case. If the binary packages are
not affected, please feel free to close the bug with a message
containing the details of what you did to check.
CVE-2009-3560[0]:
| The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
| as used in the XML-Twig module for Perl, allows context-dependent
| attackers to cause a denial of service (application crash) via an XML
| document with malformed UTF-8 sequences that trigger a buffer
| over-read, related to the doProlog function in lib/xmlparse.c, a
| different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVE-2009-3720[1]:
| The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
| 2.0.1, as used in Python, PyXML, w3c-libwww, and other software,
| allows context-dependent attackers to cause a denial of service
| (application crash) via an XML document with crafted UTF-8 sequences
| that trigger a buffer over-read, a different vulnerability than
| CVE-2009-2625.
These issues also affect old versions of expat, so this package in etch
and lenny is very likely affected. This is a low-severity security
issue, so DSAs will not be issued to correct these problems. However,
you can optionally submit a proposed-update to the release team for
inclusion in the next stable point releases. If you plan to do this,
please open new bugs and include the security tag so we are aware that
you are working on that.
For further information see [0],[1],[2],[3]. In particular, [2] and [3]
are links to the patches for CVE-2009-3560 and CVE-2009-3720
respectively. Note that the ideal solution would be to make use of the
system expat so only one package will need to be updated for future
security issues. Preferably in your update to unstable, alter your
package to make use of the system expat.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560
http://security-tracker.debian.org/tracker/CVE-2009-3560
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720
http://security-tracker.debian.org/tracker/CVE-2009-3720
[2]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
[3]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
--- End Message ---
--- Begin Message ---
Source: udunits
Source-Version: 2.1.8-4
We believe that the bug you reported is fixed in the latest version of
udunits, which is due to be installed in the Debian FTP archive:
libudunits2-0_2.1.8-4_i386.deb
to main/u/udunits/libudunits2-0_2.1.8-4_i386.deb
libudunits2-dev_2.1.8-4_i386.deb
to main/u/udunits/libudunits2-dev_2.1.8-4_i386.deb
udunits-bin_2.1.8-4_i386.deb
to main/u/udunits/udunits-bin_2.1.8-4_i386.deb
udunits_2.1.8-4.debian.tar.gz
to main/u/udunits/udunits_2.1.8-4.debian.tar.gz
udunits_2.1.8-4.dsc
to main/u/udunits/udunits_2.1.8-4.dsc
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 560...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Alastair McKinstry <mckins...@debian.org> (supplier of updated udunits package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 17 Dec 2009 21:52:22 +0000
Source: udunits
Binary: libudunits2-0 libudunits2-dev udunits-bin
Architecture: source i386
Version: 2.1.8-4
Distribution: unstable
Urgency: low
Maintainer: Alastair McKinstry <mckins...@debian.org>
Changed-By: Alastair McKinstry <mckins...@debian.org>
Description:
libudunits2-0 - Library for handling of units of physical quantities
libudunits2-dev - Development files for the libunits physical units package
udunits-bin - Utility for handling units of physical quantities
Closes: 560922
Changes:
udunits (2.1.8-4) unstable; urgency=low
.
* Move to source format 3.0
* Remove built-in expat, instead use Debian library version. Closes: #560922.
Checksums-Sha1:
402da48097c44cb9be0e5c8fb281b44566e2c9a8 1184 udunits_2.1.8-4.dsc
55e75308d1a9b3faefbee6c141427ee7a117948e 487560 udunits_2.1.8-4.debian.tar.gz
c6c1a79899645f0c0ad6f4df4d8a24cc22da7627 162814 libudunits2-0_2.1.8-4_i386.deb
778de0815a75f27c777847e0237cbd1375fac7bb 277052
libudunits2-dev_2.1.8-4_i386.deb
99c4ddb359f0a9eb381d1ba5143df2323c2d502e 74066 udunits-bin_2.1.8-4_i386.deb
Checksums-Sha256:
269a15e302169564929dbacb6e916cd9757d56f47827d0ea123a9727cbfafe31 1184
udunits_2.1.8-4.dsc
02f984b16602cf8f8de75a201a7e62f85ba6150859875a79ec7e007c8673d56c 487560
udunits_2.1.8-4.debian.tar.gz
3b1c52b2d813ebb8a8753f0f93a4f050ebcaa462c535c023430737a7ffec9bc3 162814
libudunits2-0_2.1.8-4_i386.deb
d5a925f658e756dabf14cb57a6583c116061e844e3846a41f49d84a3ff7a7faa 277052
libudunits2-dev_2.1.8-4_i386.deb
8f20829e66a0b80a7ff0829b26fa2889c7b851939c1dc5eff9af0761a821c4e6 74066
udunits-bin_2.1.8-4_i386.deb
Files:
3fe1acff7c90741e80f7be8aabe5f50e 1184 utils optional udunits_2.1.8-4.dsc
881a836248a194f84bd8546ae42e8148 487560 utils optional
udunits_2.1.8-4.debian.tar.gz
36b02934ff53583c0bc9b381aedc547f 162814 libs optional
libudunits2-0_2.1.8-4_i386.deb
cf38a7bbda24275ccc45860cbd0f5ec4 277052 libdevel optional
libudunits2-dev_2.1.8-4_i386.deb
53ee4493932049097504bff02f096e09 74066 utils optional
udunits-bin_2.1.8-4_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iD8DBQFLKt0sQTK/kCo4XFcRAoXzAJ9vgBzRClVAm0WNHi9AX7qyzPBckgCdEWzG
oFaCggSpgfSU0avWThAiUeo=
=InpM
-----END PGP SIGNATURE-----
--- End Message ---
