CVE-2018-6544 / CVE-2018-1000051

Debian Bug report logs - #891245
CVE-2018-6544 / CVE-2018-1000051

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2018-6544 / CVE-2018-1000051

Date: Fri, 23 Feb 2018 19:36:24 +0100

Package: mupdf
Version: 1.11+ds1-2
Severity: grave
Tags: security

Please see
https://security-tracker.debian.org/tracker/CVE-2018-1000051
https://security-tracker.debian.org/tracker/CVE-2018-6544

Cheers,
        Moritz

Message #10 received at 891245-close@bugs.debian.org (full text, mbox, reply):

From: Kan-Ru Chen (陳侃如) <koster@debian.org>

To: 891245-close@bugs.debian.org

Subject: Bug#891245: fixed in mupdf 1.12.0+ds1-1

Date: Wed, 14 Mar 2018 12:49:48 +0000

Source: mupdf
Source-Version: 1.12.0+ds1-1

We believe that the bug you reported is fixed in the latest version of
mupdf, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 891245@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Kan-Ru Chen (陳侃如) <koster@debian.org> (supplier of updated mupdf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 14 Mar 2018 21:26:44 +0900
Source: mupdf
Binary: libmupdf-dev mupdf mupdf-tools
Architecture: source amd64
Version: 1.12.0+ds1-1
Distribution: unstable
Urgency: high
Maintainer: Kan-Ru Chen (陳侃如) <koster@debian.org>
Changed-By: Kan-Ru Chen (陳侃如) <koster@debian.org>
Description:
 libmupdf-dev - development files for the MuPDF viewer
 mupdf      - lightweight PDF viewer
 mupdf-tools - command line tools for the MuPDF viewer
Closes: 891245
Changes:
 mupdf (1.12.0+ds1-1) unstable; urgency=high
 .
   * New upstream version 1.12.0+ds1
   * Exclude thirdparty/{freeglut,lcms2} from upstream source
   * Refresh patches
   * Add freeglut3-dev build-dep
   * d/mupdf.docs: Include droid fonts NOTICE file
   * d/patches: Fix CVE-2018-6544 / CVE-2018-1000051 (Closes: #891245)
Checksums-Sha1:
 83448e582264b3fd47fbd7369be8588e494e1d59 2182 mupdf_1.12.0+ds1-1.dsc
 cad833e1f0927ca9750229350627d9680cc2e376 21967664 mupdf_1.12.0+ds1.orig.tar.xz
 a7de6500392729ab7df26cc151474ca58c9d442b 26800 mupdf_1.12.0+ds1-1.debian.tar.xz
 206f3e1693bc77ac03851db375bcdca943302282 21526180 libmupdf-dev_1.12.0+ds1-1_amd64.deb
 c036f6e0bd39dc03933fd7f473e5bc4477fb8cbc 19213204 mupdf-tools_1.12.0+ds1-1_amd64.deb
 b5d0038739579bcb1c6289125183a662d569bcdc 10091 mupdf_1.12.0+ds1-1_amd64.buildinfo
 2cb3d78fe0bb34d2c8c9a27d457b1ac90643a14e 18989284 mupdf_1.12.0+ds1-1_amd64.deb
Checksums-Sha256:
 8084100bece3ad9e2523004c4fde51ea8e58a449ad53d5cb4708517090031a4d 2182 mupdf_1.12.0+ds1-1.dsc
 c3fc2e424a240c12ae79ec12dccd6273d1265487b668e28c7ccf75f6b58d9d5d 21967664 mupdf_1.12.0+ds1.orig.tar.xz
 40d8634f7046aa8bfe0515fd77fa5c9b29252612fd1b44095c375a9977b4fa6a 26800 mupdf_1.12.0+ds1-1.debian.tar.xz
 0342471c06f7c5ea66c91948f649a2e4638efc1376e83a57318068dedf92c216 21526180 libmupdf-dev_1.12.0+ds1-1_amd64.deb
 b1c061df6d12ba0c0941bdf78a0015f2ccf7b889f2a903097459b720ba2a8810 19213204 mupdf-tools_1.12.0+ds1-1_amd64.deb
 9230c1721201c258bc09ab201ab2d88e5db44bca71d2b20e8cfa364606f0b7ea 10091 mupdf_1.12.0+ds1-1_amd64.buildinfo
 dc7b6fe9db48d2558c4d448cf5785b280c527e1b61629acd5cdea939e670c0f8 18989284 mupdf_1.12.0+ds1-1_amd64.deb
Files:
 f0fc4549ff43814ad39c32fb9e1e3937 2182 text optional mupdf_1.12.0+ds1-1.dsc
 3881cbbc1d7af2308563cf6c0c6ff8f2 21967664 text optional mupdf_1.12.0+ds1.orig.tar.xz
 2499b2bf6dfc6eb6abf2eeb8895c0fc5 26800 text optional mupdf_1.12.0+ds1-1.debian.tar.xz
 61ef2bcfaf2bcc39a830db17192257c2 21526180 libdevel optional libmupdf-dev_1.12.0+ds1-1_amd64.deb
 152372dd8ac1bbb0a2a083d72deeba26 19213204 text optional mupdf-tools_1.12.0+ds1-1_amd64.deb
 1bd7ca0377e413c7ce74242c702f1062 10091 text optional mupdf_1.12.0+ds1-1_amd64.buildinfo
 63f609a55e50b27d12d702be0f37ea20 18989284 text optional mupdf_1.12.0+ds1-1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE2JDTPWFH4vUeM4aHCjk1SrblfeEFAlqpFbMACgkQCjk1Srbl
feG2AQ/+MPGKk7vH4c8eT+hOnli8lzNJNVFN87mvkse+/Z0gE1ZIH8kN5bbT0HPn
6M/8zWgbxCI+SIl62RUEkNcaRyxg8JKb/NXGBv2y6sTqpSHZPRyq3bU2kxSz1fcO
BUiWBhJZI0Jbrkvw4ABIwq2VqugzlfSSERHAWVs7WSC90Ft5zeKKeUkQX6HT+vqN
FA/qW/02lL3WOGeK7THjVkKeIyH51X3aR4Dw+/Tvm+pXItRNzzjO9CjEuHSIRd2w
r8k4VLkPiGap2wph8LScz2COX0O259X5/cG2zUPJkQJMw+3YDtEr3lCUmikZN6YJ
wX47TN4aAHwqw6EVHOJk9NVFno2nHRztKEULV9wmDAzaWo3ynhLOxim5sI/ll+Xk
oBax75AkrRW4TdmtbDlqTBMJyJF4Cg6fVcmQfvysqOCVhQL9LVB6fHGn4CPBAUC3
0uQhCfCNCEKkeI/w9kQhCbO6YAjlLE69m6RdgSJsR4/SZcut+UxjiI8YGBGGecNo
yTngcDRgzeF5k5F/PHPC+oQEotvK09lboeh5XVTNgZqA4lqALTNiMtQblXposwVT
Eoja0V/ESvnfmgWQfV2MtXpmba4RAv+nzgz6Yw+X9NzOOsjGovmE730ROtA0gbrb
WMnR7GK/9pks+AdQc9MilawR/so8nqgTISm4L0J2EjfXfF7XEws=
=A8sP
-----END PGP SIGNATURE-----

Message #15 received at 891245-close@bugs.debian.org (full text, mbox, reply):

From: Thorsten Alteholz <debian@alteholz.de>

To: 891245-close@bugs.debian.org

Subject: Bug#891245: fixed in mupdf 1.9a+ds1-4+deb9u3

Date: Fri, 30 Mar 2018 19:49:18 +0000

Source: mupdf
Source-Version: 1.9a+ds1-4+deb9u3

We believe that the bug you reported is fixed in the latest version of
mupdf, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 891245@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thorsten Alteholz <debian@alteholz.de> (supplier of updated mupdf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Mar 2018 19:03:02 +0100
Source: mupdf
Binary: libmupdf-dev mupdf mupdf-tools
Architecture: source amd64
Version: 1.9a+ds1-4+deb9u3
Distribution: stretch-security
Urgency: high
Maintainer: Kan-Ru Chen (陳侃如) <koster@debian.org>
Changed-By: Thorsten Alteholz <debian@alteholz.de>
Description:
 libmupdf-dev - development files for the MuPDF viewer
 mupdf      - lightweight PDF viewer
 mupdf-tools - command line tools for the MuPDF viewer
Closes: 891245
Changes:
 mupdf (1.9a+ds1-4+deb9u3) stretch-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2018-6544, CVE-2018-1000051
     add patches to fix use after free (Closes: #891245)
Checksums-Sha1:
 afc494552ea7c6ea08bc1b846a1f7f105df78cb2 2340 mupdf_1.9a+ds1-4+deb9u3.dsc
 2699c33ddc8f33819cd0791f3762a3a268873286 13325139 mupdf_1.9a+ds1.orig.tar.gz
 8dacfcaae746ae330ff22551a1be0ef9cdc93d4b 31144 mupdf_1.9a+ds1-4+deb9u3.debian.tar.xz
 10538cf6915166d9847c06eeb5b4ef5c608971d6 7299194 libmupdf-dev_1.9a+ds1-4+deb9u3_amd64.deb
 75618934c391b9b5081dac18a66977455cf4fa27 2143884 mupdf-dbgsym_1.9a+ds1-4+deb9u3_amd64.deb
 40d0e563bb7bd8fe63bd08b0efaff0c7295bf57c 2400160 mupdf-tools-dbgsym_1.9a+ds1-4+deb9u3_amd64.deb
 0d2244905f55f7b503a6db6a4fb74874e1208576 6910214 mupdf-tools_1.9a+ds1-4+deb9u3_amd64.deb
 92e52bda7ba194da0834329ea3e68783475e7252 8891 mupdf_1.9a+ds1-4+deb9u3_amd64.buildinfo
 352faf5ba416d838cbb6af3a7ef8c39ccb300075 6858952 mupdf_1.9a+ds1-4+deb9u3_amd64.deb
Checksums-Sha256:
 c33949fc1a23e0b0624443d3f5d42d7126fa521d82bbedcf5bbfd80cffdab62f 2340 mupdf_1.9a+ds1-4+deb9u3.dsc
 1b5d6126472f99ae2c99f1b474169b752764d63a90d3dd6e6a6f8fac8cdd0b75 13325139 mupdf_1.9a+ds1.orig.tar.gz
 79c3943eb80eb3284a50662fde12dc38c5aa6af7acd07dcea7ef402e56fd0783 31144 mupdf_1.9a+ds1-4+deb9u3.debian.tar.xz
 473e993793199c0aa3456f0987fb5f3d9f16092386d1e6ea34743a39a18d22ad 7299194 libmupdf-dev_1.9a+ds1-4+deb9u3_amd64.deb
 b7b4666838cbccaefa5f523be274a0ca052df8cb6316d6d9bdf40cfcc59e3bd5 2143884 mupdf-dbgsym_1.9a+ds1-4+deb9u3_amd64.deb
 1ce0f0f25626407cae57798e4ef8d682ac1ea6468325cad9b5ccbf42fc49e79f 2400160 mupdf-tools-dbgsym_1.9a+ds1-4+deb9u3_amd64.deb
 15f90950e1596a294875426c1b5d43baf0aa95007e6bc2489f10297e30c5c2ca 6910214 mupdf-tools_1.9a+ds1-4+deb9u3_amd64.deb
 06a44759c85c8d1d17975689ea2309f98358445ef32e64b783df5def88e9e3dc 8891 mupdf_1.9a+ds1-4+deb9u3_amd64.buildinfo
 b8a590fe5d2fe05d2f97cd516d508d4222046d77696d800f0c262acf118eef3d 6858952 mupdf_1.9a+ds1-4+deb9u3_amd64.deb
Files:
 8481059cdb18a460c6899db39f6e363f 2340 text optional mupdf_1.9a+ds1-4+deb9u3.dsc
 62e41e176d501171476cf4f6a03d8306 13325139 text optional mupdf_1.9a+ds1.orig.tar.gz
 2627b1754973895e7793992d787ade3e 31144 text optional mupdf_1.9a+ds1-4+deb9u3.debian.tar.xz
 d5091816724a7726d8124252d28ff0fa 7299194 libdevel optional libmupdf-dev_1.9a+ds1-4+deb9u3_amd64.deb
 f2449ba1e05e606af447acf774fb5f84 2143884 debug extra mupdf-dbgsym_1.9a+ds1-4+deb9u3_amd64.deb
 c0f78c820070325f85e53612fb6ddcf3 2400160 debug extra mupdf-tools-dbgsym_1.9a+ds1-4+deb9u3_amd64.deb
 680682c71c6216d6db19e8ed9b191729 6910214 text optional mupdf-tools_1.9a+ds1-4+deb9u3_amd64.deb
 6f304a5645ed02e26f0d76023b7023dc 8891 text optional mupdf_1.9a+ds1-4+deb9u3_amd64.buildinfo
 89154092347f00684ab68ded51e8759e 6858952 text optional mupdf_1.9a+ds1-4+deb9u3_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQKnBAEBCgCRFiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAlq5MaxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcTHGRlYmlhbkBh
bHRlaG9sei5kZQAKCRCW/KwNOHtYR7MxD/0VtwvE9CqoZWKscVKr3cL+dHsihiix
W0Y8TXUcFBIQcIZNlLHSCwLHb7oDIt9YQMOY50JVslJ4I/GU5BmE2jtUVOwj7smr
0Sy9tNmuUF03q/mA5FopiNSM8SX3FLb2hey1VdyyhdA3UCGsSq2v/+k+2FsT7dgg
Hy18hMCnWrBtv5FZxy+/habytuaBCPyLYJ9ZnM+QnvVeWd4v5FYR0B3VN9T5HQIf
M/lYJDE4F46Ug9m8eLsxqaquYjINV6jqft54pNcgbjf7X03as8aJtuUpuYEf7vxC
34c0uGpYD8vIb0c9oQ9YMO3/W8T2TJiUg7Rhl+R+YsFjNgmlBsxaHPtmV8axPTEg
3RAEkYDx0ZQOvwuvi+snWIkWweF4vWu7bTQgJsjQ6DepfqBPUXovhDytfiEJSpt0
cGQLSi5JDSbPeeneBfRoZPVEsThdVkIbycEPF8aSEG0BvdFOs3NKtJG6u0wqe2HD
iWd2u348U5q+uVKSncduh6SIr3AMpnDXv/FDHVv8wGpB+aZgCTgfCeMO5RT8X8i7
QpHQfzx131nq7JL2JRV/s8cGIyRYNhTgh9vMhWerEnR7znUTCZVdmrMZzTkpPsXR
7GkD0Op7XgDm2H8sw+vNo3Xb0GFO0zOJdmCnUlwpiDKGJ7s8O+6J+jnlsKvTOiim
WfRVuugVy/QQ2A==
=wi2l
-----END PGP SIGNATURE-----

Message #20 received at 891245-close@bugs.debian.org (full text, mbox, reply):

From: Thorsten Alteholz <debian@alteholz.de>

To: 891245-close@bugs.debian.org

Subject: Bug#891245: fixed in mupdf 1.5-1+deb8u4

Date: Fri, 30 Mar 2018 19:52:37 +0000

Source: mupdf
Source-Version: 1.5-1+deb8u4

We believe that the bug you reported is fixed in the latest version of
mupdf, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 891245@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thorsten Alteholz <debian@alteholz.de> (supplier of updated mupdf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Mar 2018 19:20:25 +0100
Source: mupdf
Binary: libmupdf-dev mupdf mupdf-tools
Architecture: source amd64
Version: 1.5-1+deb8u4
Distribution: jessie-security
Urgency: high
Maintainer: Kan-Ru Chen (陳侃如) <koster@debian.org>
Changed-By: Thorsten Alteholz <debian@alteholz.de>
Description:
 libmupdf-dev - development files for the MuPDF viewer
 mupdf      - lightweight PDF viewer
 mupdf-tools - commmand line tools for the MuPDF viewer
Closes: 891245
Changes:
 mupdf (1.5-1+deb8u4) jessie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2018-6544, CVE-2018-1000051
     add patches to fix use after free (Closes: #891245)
Checksums-Sha1:
 bfb983f97d4898aff5cd7ee9e0ac4a296f9ae436 2285 mupdf_1.5-1+deb8u4.dsc
 9b451774d628d2953df7591f0fcdb465f7da4fa5 7528994 mupdf_1.5.orig.tar.gz
 45a571652d98ad3668d6d284b61f9a0b50358ec7 29316 mupdf_1.5-1+deb8u4.debian.tar.xz
 3ba46b521b35c102b4b5ee7c3092e35664a4f3d7 3462948 libmupdf-dev_1.5-1+deb8u4_amd64.deb
 ed071187b632da954159dfad555e602126227575 3418956 mupdf_1.5-1+deb8u4_amd64.deb
 6d2b421fd05e03cc3e9d401d9827ef30d990dda5 3580898 mupdf-tools_1.5-1+deb8u4_amd64.deb
Checksums-Sha256:
 d9c8d0baaedd74e884f5f20a1b7bc7475ffdaab698541c0d0535b6ca09c713d5 2285 mupdf_1.5-1+deb8u4.dsc
 9ef2a457c119031cbf84cf89bfe9bf01d3fbb4b739bb4707bb58bfe141102ff2 7528994 mupdf_1.5.orig.tar.gz
 db3b1cb18b3f97d7e0945e8be160e7700bee5c19e5d4ffa3593f6939810d3018 29316 mupdf_1.5-1+deb8u4.debian.tar.xz
 448e94c1f582935080c0938669366991566a981ab63b99a8f3d6f0bceb1a5a0e 3462948 libmupdf-dev_1.5-1+deb8u4_amd64.deb
 e0c203d744e5a49866093042d1c12a37cc254f8fb150be95806d156b085ebe3a 3418956 mupdf_1.5-1+deb8u4_amd64.deb
 6d1b76a520e205a888d6f07ada37b2a38240ee4d4db2857a1c99105b274759e1 3580898 mupdf-tools_1.5-1+deb8u4_amd64.deb
Files:
 4654c8f2558c7bbf4fe13746df587f0f 2285 text optional mupdf_1.5-1+deb8u4.dsc
 89dd2ad96a3679035b89007d7dcbd847 7528994 text optional mupdf_1.5.orig.tar.gz
 8d1f63878040d36e8e98747acc361d33 29316 text optional mupdf_1.5-1+deb8u4.debian.tar.xz
 d2d7a6250b08a0ca4ee9c346d49ad387 3462948 libdevel optional libmupdf-dev_1.5-1+deb8u4_amd64.deb
 0c161163d4f35e939dc919c0f340a9c3 3418956 text optional mupdf_1.5-1+deb8u4_amd64.deb
 f3ca1190cf3e8ef153a04409bc53c714 3580898 text optional mupdf-tools_1.5-1+deb8u4_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQKnBAEBCgCRFiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAlq5MW9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcTHGRlYmlhbkBh
bHRlaG9sei5kZQAKCRCW/KwNOHtYR0nKEAC4ZPRyLq7ghOMfpNlZ3CmgqymubEOW
IN60fh04LHdd4UXi49F0jtwX5Lk1o8vHWzOI4YcQdbd12SU/qxvpbJRKhJEJxNio
dthFOB9lo1LEfb22ekZZ+gpYhJohcpnnUoFg1XVdeFHb4/JfEaRlQTjGsvi6+TzT
DNLwoguMlKC8cpXJxSpPF0kNYxpwUbUz9hFDD4D/Hv2cHRgva496EEXMqhSD1ASx
ssfWE3/naS1bwj7EzciZKVWjzNY0VVmC9qfq2F+/fTGSmV7dBS6c4Q9sF9crZ81r
ntZ8WgqHvEdtf7qqKTXKUoOz0mA4SH9hWKz+dBMKxuKoS7EMm/yEMGswTOIskxja
OJ/QFiDP73VdfCbOr9O5rzyhrJ3CwYmkOxS2HKZ0nCUZT4SMqt0Xtk9ExXyyKj2b
MFV6tjdc3CPWYlLC83/jggZz7ZIfrKd/rnd4lsHSdb+dAHSvrG4c8SA1LXrVUmrQ
DnBvt3OH0FELEmNe906bWI3qpNSPqVzo8kbJtPZbxpCxIF85ri6qveB/ATcdW7ce
MvnCE4x3nVJ24wyaV1Hbr3IdUPhhKJjLB5ZeI9XsdQC8Sx8yFarWKUfsSBhJmvOv
75MOXFh+6WRzARqaMI7gogANL38EHa2NcZuhwYlkogqVGqvR9ZHfFLUggi0VjLlI
md3RbwxkIJ1Miw==
=9Ech
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.