Your message dated Tue, 23 Jun 2020 08:10:16 +0000
with message-id <[email protected]>
and subject line Bug#942255: fixed in libmatio 1.5.17-4
has caused the Debian Bug report #942255,
regarding libmatio: CVE-2019-17533
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
942255: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942255
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libmatio
Version: 1.5.17-3
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for libmatio.
CVE-2019-17533[0]:
| Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0'
| character, leading to a heap-based buffer over-read in strdup_vprintf
| when uninitialized memory is accessed.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2019-17533
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17533
[1] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16856
[2]
https://github.com/tbeu/matio/commit/651a8e28099edb5fbb9e4e1d4d3238848f446c9a
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libmatio
Source-Version: 1.5.17-4
Done: =?utf-8?q?S=C3=A9bastien_Villemot?= <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libmatio, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sébastien Villemot <[email protected]> (supplier of updated libmatio package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 13 Jun 2020 09:50:35 +0200
Source: libmatio
Binary: libmatio-dev libmatio-doc libmatio9 libmatio9-dbgsym matio-tools
matio-tools-dbgsym
Architecture: source amd64 all
Version: 1.5.17-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Team
<[email protected]>
Changed-By: Sébastien Villemot <[email protected]>
Description:
libmatio-dev - MATLAB MAT File I/O Library - development files
libmatio-doc - MATLAB MAT File I/O Library - documentation files
libmatio9 - MATLAB MAT File I/O Library - shared library
matio-tools - MATLAB MAT File I/O Library - command-line tools
Closes: 942255
Changes:
libmatio (1.5.17-4) unstable; urgency=medium
.
* Ship HTML version of manual
* d/rules: simplify using debhelper 12.8’s execute_after_* rules
* Ship matdump utility in a new matio-tools package
* Bump to debhelper 13
* Use secure URL for Homepage
* Bump to S-V 4.5.0
* CVE-2019-17533.patch: new patch, fixes CVE-2019-17533 (Closes: #942255)
Checksums-Sha1:
9fbfbf5eb695d886e04648885b8a62187fdf39ce 2180 libmatio_1.5.17-4.dsc
ddbc5f1fc88f72fcc3e1688a75cce97cedcf25a0 9260 libmatio_1.5.17-4.debian.tar.xz
4c8ce71cb891fe089694886670b1ff4cb2f08c94 103216 libmatio-dev_1.5.17-4_amd64.deb
3d62d2bbc0eb76d0722569808ee6eb63418d7055 218140 libmatio-doc_1.5.17-4_all.deb
75e876cbed6cc621ccc93b40ce692f4f4476d756 331444
libmatio9-dbgsym_1.5.17-4_amd64.deb
d9ed4e5573f043f257ae0456b764e2b1392b25f1 95996 libmatio9_1.5.17-4_amd64.deb
6df8d7c94cdeec4ac07bddd2a3106878289952e8 8903 libmatio_1.5.17-4_amd64.buildinfo
5c0194a96e347c4a619bdad5f7c3fe20546a8fa7 24868
matio-tools-dbgsym_1.5.17-4_amd64.deb
452168fd25143f5163780d1369e3d801f16fb154 17640 matio-tools_1.5.17-4_amd64.deb
Checksums-Sha256:
41000a56ea64f8c5686e22cce6ec9744b8bbd27f224c259fb282065cdfc5b852 2180
libmatio_1.5.17-4.dsc
b671cb791442364b72f93fdeed00d700d247b5b3761b4ce7b747b046a123cf6b 9260
libmatio_1.5.17-4.debian.tar.xz
8dffafd89df234e9d8a0b927bffad73c796d9b837e291df4ed4a0c727b04c346 103216
libmatio-dev_1.5.17-4_amd64.deb
816978cc7f18534d16cb2264addfd2af83ec1fb7a3fa6166d2b77881240bda88 218140
libmatio-doc_1.5.17-4_all.deb
08543464576f878928608bfc724d53a8800eb4e52991ef4f76a9ffda9a7ffd4d 331444
libmatio9-dbgsym_1.5.17-4_amd64.deb
f05a223a0191ca798621aa9a0a2df6cf5afa5cf1391e7e26b480f1d4219bd17a 95996
libmatio9_1.5.17-4_amd64.deb
d1fb72ea2da948b00e41c452de858ae9fbf44f0f226316676d4fd35035e900ed 8903
libmatio_1.5.17-4_amd64.buildinfo
58398e8dce78d1b0db55884230e7f12b4e276de5a5d518632654c9293830f96b 24868
matio-tools-dbgsym_1.5.17-4_amd64.deb
20bccc8ab6753d49b2712f480b072c0d5edd02a0390775ec022c443aa788d203 17640
matio-tools_1.5.17-4_amd64.deb
Files:
f3b9e48189b479d59e0279a44d5428c2 2180 libs optional libmatio_1.5.17-4.dsc
359337b0da6c84e4deb5c0d8d2571430 9260 libs optional
libmatio_1.5.17-4.debian.tar.xz
a7f8f088f213d475edf22fb524828e7d 103216 libdevel optional
libmatio-dev_1.5.17-4_amd64.deb
9765f990b7d7a3d5eb958a8c6e09513d 218140 doc optional
libmatio-doc_1.5.17-4_all.deb
e0d7eb59319f6bf89fed4db3fa169a92 331444 debug optional
libmatio9-dbgsym_1.5.17-4_amd64.deb
c5dfb02cddf14f4403b8cb57bb800fd5 95996 libs optional
libmatio9_1.5.17-4_amd64.deb
ffcf11063668748c045423a6c7f22daf 8903 libs optional
libmatio_1.5.17-4_amd64.buildinfo
250c6af9105fef47eaf555336d0ee169 24868 debug optional
matio-tools-dbgsym_1.5.17-4_amd64.deb
5fb69b5ca95f1487c32ea97f66ff96e4 17640 math optional
matio-tools_1.5.17-4_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEU5UdlScuDFuCvoxKLOzpNQ7OvkoFAl7kh7wACgkQLOzpNQ7O
vkoTug/9FKmgxYDcrcdf/bbDpm+K3J0AbizZCkvEFpPUh4syumbDA8TGglEhtfzt
fW4oUHJ2/6dz5I64qDUupCVILFxpPFKehguwO6/PgZmtZsFSG6P2DJ5hIBzcL/Jm
iEPN8agXF72NnZPbF/xEdQPfFQ8n8BBCu+wvIMtTUVVGiGgBgdA4xYHuKgeBMKx/
VKnNaITR+/ScrIV9lV5v7Rr4tVYTwLpnoRHDcTr3qjVO/9nHuEduzPCHe1lUD99s
EPfGitjYjUc69adlykaKJ6OxZLfG1bb4wL4lMmZk+7WN0++wAdxJm8+OlP8QAGLN
re/SDNwpNdoRkHunduupxJrzP/oBjcU1Z3PqC6lVnR2t1QFmVhoXnMfbfhyB68Sy
Hs66DuHdZJjBEy+TzGDsqzbH3MeHUu4c/6hUUEKZccbS9E2usWGJpbXEFn/qj6Ao
C+ElLaQBtuYzl4023OhKP0EiH7yvzLCLC2PDLFaMFIMeygYZxOPEOUL38aZvJxyx
Ulk66GWLIUvtRaAHwzK9rAny6guICiz6dZHKJcGQO0uqYsr8CDD9gyvt+PZwjiaG
aaAwxtW1kMOvULy1LPtKLvdOBHZRzNWrAR3CrSd7ERVx1K20Z5frONqHRt0pddEj
ShTY2TnXNlCUYJUF/HJ5OiNFX/GLSAr+SUlOJW0jJ6F2DBhljiE=
=OAK1
-----END PGP SIGNATURE-----
--- End Message ---
--
debian-science-maintainers mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-science-maintainers
