libpano13: CVE-2021-33293 out-of-bounds read

Related Vulnerabilities: CVE-2021-33293  

Debian Bug report logs - #1008024
libpano13: CVE-2021-33293 out-of-bounds read

version graph

Reported by: Markus Koschany <apo@debian.org>

Date: Sun, 20 Mar 2022 18:09:01 UTC

Severity: important

Tags: fixed-upstream, security, upstream

Found in versions 2.9.20~rc3+dfsg-1, 2.9.19+dfsg-3+deb10u1, 2.9.19+dfsg-2

Fixed in version 2.9.21~rc1+dfsg-1

Done: Salvatore Bonaccorso <carnil@debian.org>

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>:
Bug#1008024; Package libpano13. (Sun, 20 Mar 2022 18:09:03 GMT) (full text, mbox, link).


Acknowledgement sent to Markus Koschany <apo@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>. (Sun, 20 Mar 2022 18:09:03 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: submit <submit@bugs.debian.org>
Subject: libpano13: CVE-2021-33293 out-of-bounds read
Date: Sun, 20 Mar 2022 19:07:06 +0100
[Message part 1 (text/plain, inline)]
Package: libpano13
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for libpano13.

CVE-2021-33293[0]:
| Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-
| bounds read in the function panoParserFindOLine() in parser.c.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-33293
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33293

Please adjust the affected versions in the BTS as needed.

Regards,

Markus

[signature.asc (application/pgp-signature, inline)]

Added tag(s) fixed-upstream and upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 18:33:02 GMT) (full text, mbox, link).


Marked as found in versions 2.9.19+dfsg-2. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 18:33:03 GMT) (full text, mbox, link).


Marked as found in versions 2.9.19+dfsg-3+deb10u1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 18:33:03 GMT) (full text, mbox, link).


Marked as found in versions 2.9.20~rc3+dfsg-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 18:33:04 GMT) (full text, mbox, link).


Marked as fixed in versions 2.9.21~rc1+dfsg-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 18:33:04 GMT) (full text, mbox, link).


Marked Bug as done Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 18:33:05 GMT) (full text, mbox, link).


Notification sent to Markus Koschany <apo@debian.org>:
Bug acknowledged by developer. (Sun, 20 Mar 2022 18:33:05 GMT) (full text, mbox, link).


Message sent on to Markus Koschany <apo@debian.org>:
Bug#1008024. (Sun, 20 Mar 2022 18:33:07 GMT) (full text, mbox, link).


Message #22 received at 1008024-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: control@bugs.debian.org
Cc: 1008024-submitter@bugs.debian.org
Subject: tagging 1008024, found 1008024 in 2.9.19+dfsg-2, found 1008024 in 2.9.19+dfsg-3+deb10u1 ...
Date: Sun, 20 Mar 2022 19:28:20 +0100
tags 1008024 + upstream fixed-upstream
found 1008024 2.9.19+dfsg-2
found 1008024 2.9.19+dfsg-3+deb10u1
found 1008024 2.9.20~rc3+dfsg-1
found 1008024 2.9.20~rc3+dfsg-1
close 1008024 2.9.21~rc1+dfsg-1
thanks




Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Mon Mar 21 13:09:20 2022; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.