Bug#340842: marked as done (unalz: buffer overflow when extracting archives)
Your message dated Sat, 17 Jun 2006 11:43:39 +0200 with message-id <[EMAIL PROTECTED]> and subject line Bug#340842 acknowledged by developer (Re: unalz: buffer overflow when extracting archives) has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) --- Begin Message --- Subject: unalz: buffer overflow when extracting archives Package: unalz Version: 0.52-1 Severity: grave Justification: user security hole Tags: security patch sarge etch sid Hello, I have found a buffer overflow security vulnerability in unalz. It occurs when it extracts malicious ALZ archives. I have attached the archives oflow333.alz (for sarge) and oflow1621.alz (for testing and unstable), as well as the program alzgen.pl that generated them and a patch that corrects this issue. It is also possible to upgrade to the latest upstream version 0.53, which also corrects it. // Ulf Härnhammar, Debian Security Audit Project -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.12-1-686 Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) Versions of packages unalz depends on: ii libc6 2.3.5-8GNU C Library: Shared libraries an ii libgcc1 1:4.0.2-2 GCC support library ii libstdc++64.0.2-2The GNU Standard C++ Library v3 unalz recommends no packages. -- no debconf information oflow333.alz Description: Binary data oflow1621.alz Description: Binary data #!/usr/bin/perl -- # alzgen # by Ulf Harnhammar in 2005 # I hereby place this program in the public domain. die "usage: $0 \n" unless @ARGV == 2; $len = shift; $lenhi = int($len / 256); $lenlo = $len - ($lenhi * 256); $file = shift; open(OUT, ">$file") or die "can't open file!\n"; print OUT "\x42\x4c\x5a\x01" .# SIG_LOCAL_FILE_HEADER chr($lenlo) . chr($lenhi) . # filename length "\x00" x 7 . 'U' x $len; close OUT or die "can't close file!?!?\n"; --- UnAlz.cpp.old 2004-11-25 07:23:36.0 +0100 +++ UnAlz.cpp 2005-11-20 01:04:23.0 +0100 @@ -359,6 +359,8 @@ return FALSE; } FRead(zipHeader.fileName, zipHeader.head.fileNameLength); + if(zipHeader.head.fileNameLength > MAX_PATH - 5) + zipHeader.head.fileNameLength = MAX_PATH - 5; zipHeader.fileName[zipHeader.head.fileNameLength] = (CHAR)NULL; --- End Message --- --- Begin Message --- Version: 0.55-1 On Thu, Mar 16, 2006 at 10:35:33AM -0800, Steve Langasek wrote: >> It still looks closed (in all versions) to me. Are you sure that that is >> what you want, instead of - say - fixing it? > http://bugs.debian.org/cgi-bin/pkgreport.cgi?src=unalz&dist=unstable This was fixed in a QA upload a while ago (0.55-1), since upstream 0.53 fixed it; the changelog missed it, though. I've verified that the code does indeed contain the patch given in the patch log, so I'm marking it as closed. /* Steinar */ -- Homepage: http://www.sesse.net/ --- End Message ---
aspectj_1.1.1-2_i386.changes ACCEPTED
Accepted: aspectj-doc_1.1.1-2_all.deb to pool/contrib/a/aspectj/aspectj-doc_1.1.1-2_all.deb aspectj_1.1.1-2.diff.gz to pool/contrib/a/aspectj/aspectj_1.1.1-2.diff.gz aspectj_1.1.1-2.dsc to pool/contrib/a/aspectj/aspectj_1.1.1-2.dsc aspectj_1.1.1-2_all.deb to pool/contrib/a/aspectj/aspectj_1.1.1-2_all.deb Announcing to debian-devel-changes@lists.debian.org Thank you for your contribution to Debian. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Processing of aspectj_1.1.1-2_i386.changes
aspectj_1.1.1-2_i386.changes uploaded successfully to localhost along with the files: aspectj_1.1.1-2.dsc aspectj_1.1.1-2.diff.gz aspectj_1.1.1-2_all.deb aspectj-doc_1.1.1-2_all.deb Greetings, Your Debian queue daemon -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#280485: Licence question for DocBook: The Definitive Guide
Hi, The Debian package of DocBook: The Definitive Guide is currently orphaned and unmaintained. I'm considering maintaining it as I need to consult it from time-to-time. While investigating the package I noticed this release-critical bug against it: http://bugs.debian.org/280485 This relates to the licencing of TDG and is an issue because a recent general resolution of the Debian project ruled that works licenced under the GFDL are free according to the standards of freedom Debian has set for itself, provided they do not contain unmodifiable sections. We would prefer to distribute TDG in the "free" section of the archive if possible. The problem with unmodifiable sections is that they are against the idea of free software (and free documentation) - that you have the freedom to make any changes necessary or wanted and share them with the world. http://www.debian.org/vote/2006/vote_001#outcome Would it be possible for Norman Walsh and O'Reilly & Associates, Inc. to grant permission for "DocBook: The Definitive Guide" to be distributed without the back cover text? The reason is that back cover texts are unmodifiable and irremovable. A statement from both copyright holders giving permission to distribute TDG under the GFDL with no invariant sections, front cover texts or back cover texts should be sufficient. Alternatively, removing the text "; with the Back-Cover Texts being Back Cover Text" from the licence text of the upcoming release would suffice. http://docbook.org/tdg/en/html/dbcpyright.html Thanks in advance for any assistance or clarifications you may be able to offer. -- bye, pabs http://wiki.debian.org/PaulWise signature.asc Description: This is a digitally signed message part
Bug#374242: electric: lesstif1 is deprecated, transition to lesstif2
Package: electric Severity: normal Good day, Your package electric has been detected as depending on the deprecated lesstif1. This bug is part of a mass bug filling and the remedy is usually quite simple. Build-depending instead on 'lesstif2-dev'. I'll happily help if you have any problems. I plan to NMU the package if needs be to push things along. Background: http://lists.debian.org/debian-devel/2006/06/msg00719.html Best wishes, -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Bug#223918: marked as done (alltraxclock: Please don't package it as a native package)
Your message dated Sun, 18 Jun 2006 05:38:47 +0200 with message-id <[EMAIL PROTECTED]> and subject line closing obsolete bugs has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) --- Begin Message --- Package: alltraxclock Version: 2.0.2-0 Severity: normal seesat5 is not a native Debian package. Please change the packaging to a non-native packaging (.orig.tar.gz + .diff.gz + .dsc). TIA Adrian --- End Message --- --- Begin Message --- There's nothing left to do, see: http://packages.qa.debian.org/a/alltraxclock/news/20060520T030213Z.html --- End Message ---
Bug#223904: marked as done (alltraxclock: debian_revision should start with 1)
Your message dated Sun, 18 Jun 2006 05:38:47 +0200 with message-id <[EMAIL PROTECTED]> and subject line closing obsolete bugs has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) --- Begin Message --- Package: gkrellm-alltraxclock Version: 2.0.2-0 Severity: normal ection 5.6.11. of your policy says: <-- snip --> ... It is conventional to restart the at `1' each time the is increased. ... <-- snip --> Starting debian_revision e.g. gives to a NMU of a new upstream version a higher version number than to the first maintainer upload of this upstream version. --- End Message --- --- Begin Message --- There's nothing left to do, see: http://packages.qa.debian.org/a/alltraxclock/news/20060520T030213Z.html --- End Message ---
