Your message dated Wed, 05 Jul 2017 13:47:08 +0000 with message-id <e1dske4-000f9g...@fasolo.debian.org> and subject line Bug#865461: fixed in unrar-nonfree 1:5.3.2-1+deb9u1 has caused the Debian Bug report #865461, regarding unrar-nonfree: CVE-2012-6706: VMSF_DELTA filter in unrar allows arbitrary memory write to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 865461: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=865461 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: unrar Version: 1:4.1.4-1+deb7u1 Severity: grave Tags: security Justification: user security hole The VMSF_DELTA filter in unrar allows arbitrary memory write. See the Google Project Zero report: https://bugs.chromium.org/p/project-zero/issues/detail?id=1286&desc=6 This affects all Debian releases (verified with the provided test case on i386). Felix
--- End Message ---
--- Begin Message ---Source: unrar-nonfree Source-Version: 1:5.3.2-1+deb9u1 We believe that the bug you reported is fixed in the latest version of unrar-nonfree, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 865...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Felix Geyer <fge...@debian.org> (supplier of updated unrar-nonfree package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 28 Jun 2017 00:10:20 +0200 Source: unrar-nonfree Binary: unrar Architecture: source amd64 Version: 1:5.3.2-1+deb9u1 Distribution: stretch Urgency: medium Maintainer: Martin Meredith <m...@debian.org> Changed-By: Felix Geyer <fge...@debian.org> Description: unrar - Unarchiver for .rar files (non-free version) Closes: 865461 Changes: unrar-nonfree (1:5.3.2-1+deb9u1) stretch; urgency=medium . * Add bound checks for VMSF_DELTA, VMSF_RGB and VMSF_AUDIO paramters. - Backported from 5.5.5 - CVE-2012-6706 - Closes: #865461 Checksums-Sha1: c16a754b1884a670d6e83cee3f9644b0e033206a 1803 unrar-nonfree_5.3.2-1+deb9u1.dsc 86b859adbe6d3d219444bebaa26adb25624e04fe 6384 unrar-nonfree_5.3.2-1+deb9u1.debian.tar.xz 6644fb35f30edddf1fc70158f745f56506dc3b7b 5447 unrar-nonfree_5.3.2-1+deb9u1_amd64.buildinfo 5df55c25e20101db9c255ec491574a76a885014e 127492 unrar_5.3.2-1+deb9u1_amd64.deb Checksums-Sha256: 923649c56e99d2df862ce48aa3b4cf6c6e6c5cc0de5ca3a3e0c4e8e2903041ab 1803 unrar-nonfree_5.3.2-1+deb9u1.dsc 660ee41aa40809ec8cee28c54df349ca12ec123f962b2060a2b38572249a9764 6384 unrar-nonfree_5.3.2-1+deb9u1.debian.tar.xz 52239dd30f92cfbaaf6b03f4600ad77238813adaa42c7cb1ca6617b7ddb06ab5 5447 unrar-nonfree_5.3.2-1+deb9u1_amd64.buildinfo 72f4f62b830b6b05ea99ff284d58bc33fca87c4b4e97848334a00856188c97bc 127492 unrar_5.3.2-1+deb9u1_amd64.deb Files: cb5dfd7904a1a9bf65c0ab130c9dc7d3 1803 non-free/utils optional unrar-nonfree_5.3.2-1+deb9u1.dsc ca44c9baafc5a37810ee1058dac6a9d8 6384 non-free/utils optional unrar-nonfree_5.3.2-1+deb9u1.debian.tar.xz 1afab593ca03f6ed55434535f104ce0c 5447 non-free/utils optional unrar-nonfree_5.3.2-1+deb9u1_amd64.buildinfo 0818789cd8e0d9087f2ebe3bdf391a10 127492 non-free/utils optional unrar_5.3.2-1+deb9u1_amd64.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEFkxwUS95KUdnZKtW/iLG/YMTXUUFAllb/boACgkQ/iLG/YMT XUXh1w//XuKAWSvvqTLKk6W13NfT7k/F0e5gIl4tkBiy5xtsE/dngDW0XWSXNgRQ DjPGaSJtNlqybOpcDUjIegbf3gvHLV34pzc6jGPaW1GjR5G7GuqHok4PhodZRlxN BhApfcEqUK9WwOWjfkx5sR1xMqoNPKxdslVU0fhCEUeQ8hjq/LI4vQ+Y+DcNlU64 qvbI9U1fNh12ycV247DrRyqCxQ/RfLq0tGg0QAAs/9E5hnGyv7b9puo+YjvSshSM 1C9Dj0MswsnbA64MJt787Py/w39OKXjG2id/uct9tPc2/ujSY152YBNtSLwsY5mU eLPIYc0b6LZ1uaz7LD0k7uD5o131uDoULwy3xu0LKw5swdMIgbR0HffIjw23Qnbe LLtyPvP8Z1QsCYbBvHwPjNhEdwMdQq8ODx4pJ33x2gzYSpx7zTziQER3nt51OINu KMnP1gY3LJnqiWWA6oZ3JoJdb5sT18zblkZDFOAROd13Izj0En+FO4Pw8UiQKOY7 VEsB5kzxnSmvaLTZWIun9ezwvw3ti0YXdoRyz40p7pim++CRH7NU/GpG5Ytz8JpQ xlECm1CEieP9WHbzY6y1x38zJu/bGTUtXHcTavrrNL6tHkuWPIUhPrnwsj5b68i8 fFA3M7GNdCgU2JDunPYB6J9I7KwZAxSchQOXEolLSa8opYPzPbE= =o2Ry -----END PGP SIGNATURE-----
--- End Message ---
