CVE-2017-6886 CVE-2017-6887

Debian Bug report logs - #864183
CVE-2017-6886 CVE-2017-6887

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2017-6886 CVE-2017-6887

Date: Sun, 04 Jun 2017 23:31:55 +0200

Source: libraw
Severity: grave
Tags: security

Please see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6886
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6887

Cheers,
        Moritz

Message #10 received at 864183@bugs.debian.org (full text, mbox, reply):

From: David Bremner <david@tethera.net>

To: 864183@bugs.debian.org

Subject: Re: [Pkg-phototools-devel] Bug#864183: CVE-2017-6886 CVE-2017-6887

Date: Tue, 06 Jun 2017 08:20:51 -0300

Moritz Muehlenhoff <jmm@debian.org> writes:

> Source: libraw
> Severity: grave
> Tags: security
>
> Please see
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6886
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6887

I started to look at this, but gave up on (me) fixing it for the initial
stretch release.

1. Between the version in stretch and the version being patched,
upstream has run the 15k line dcraw.c through clang-format, which means
the patch referenced in the CVE would need to move about 2k lines to
apply :(.

2. As I started to try to hand apply upstream d7c3d2cb460be10, I
realized there are security related changes from some other commit

-      if (len > 2560000 || !(cbuf = (char *)malloc(len)))
+      if (len < 1 || len > 2560000 || !(cbuf = (char *)malloc(len)))

in particular the (len > 2560000) is not present in the code in stretch.

It seems to come from upstream commit 8d0935 [3 files changed, 208
insertions(+), 154 deletions(-)], which also would need hand applying,
or some other cleverness.

Message #25 received at 864183-done@bugs.debian.org (full text, mbox, reply):

From: Luciano Bello <luciano@debian.org>

To: 864183-done@bugs.debian.org

Subject: CVE-2017-6886 CVE-2017-6887

Date: Mon, 21 Aug 2017 20:30:24 -0400

Source: libraw
Source-Version: 0.17.2-6+deb9u1

Fixed by https://www.debian.org/security/2017/DSA-3950

/luciano

Message #30 received at 864183-done@bugs.debian.org (full text, mbox, reply):

From: Luciano Bello <luciano@debian.org>

To: 864183-done@bugs.debian.org

Subject: CVE-2017-6886 CVE-2017-6887

Date: Mon, 21 Aug 2017 20:29:50 -0400

Source: libraw
Source-Version: 0.16.0-9+deb8u3

Fixed by https://www.debian.org/security/2017/DSA-3950

/luciano

Send a report that this bug log contains spam.