weechat: CVE-2017-14727: crash in logger plugin when converting date/time specifiers in file mask

Debian Bug report logs - #876553
weechat: CVE-2017-14727: crash in logger plugin when converting date/time specifiers in file mask

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: weechat: crash in logger plugin when converting date/time specifiers in file mask

Date: Sat, 23 Sep 2017 18:52:28 +0200

Source: weechat
Version: 1.9-1
Severity: important
Tags: security upstream

Hi

See https://weechat.org/news/98/20170923-Version-1.9.1-security-release/

Date/time conversion specifiers are expanded after replacing buffer
local variables in name of log files. In some cases, this can lead to
an error in function strftime and a crash caused by the use of an
uninitialized buffer.

https://github.com/weechat/weechat/commit/f105c6f0b56fb5687b2d2aedf37cb1d1b434d556

A CVE has not yet been assigned.

Regards,
Salvatore

Message #16 received at 876553-close@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Bouthenot <kolter@debian.org>

To: 876553-close@bugs.debian.org

Subject: Bug#876553: fixed in weechat 1.9.1-1

Date: Sat, 23 Sep 2017 21:39:20 +0000

Source: weechat
Source-Version: 1.9.1-1

We believe that the bug you reported is fixed in the latest version of
weechat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 876553@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bouthenot <kolter@debian.org> (supplier of updated weechat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 23 Sep 2017 21:47:32 +0200
Source: weechat
Binary: weechat weechat-curses weechat-core weechat-plugins weechat-doc weechat-dev
Architecture: source amd64 all
Version: 1.9.1-1
Distribution: unstable
Urgency: medium
Maintainer: Emmanuel Bouthenot <kolter@debian.org>
Changed-By: Emmanuel Bouthenot <kolter@debian.org>
Description:
 weechat    - Fast, light and extensible chat client (metapackage)
 weechat-core - Fast, light and extensible chat client - core files
 weechat-curses - Fast, light and extensible chat client - console client
 weechat-dev - Fast, light and extensible chat client - development headers
 weechat-doc - Fast, light and extensible chat client - documentation
 weechat-plugins - Fast, light and extensible chat client - plugins
Closes: 876553
Changes:
 weechat (1.9.1-1) unstable; urgency=medium
 .
   * New upstream release
     - CVE-2017-14727 - Include a patch which fix a possible crash in logger
       plugin (Closes: #876553)
   * Disable build of javascript plugin to fix weechat autoremoval from
     testing (RC bugs in libv8)
   * Bump Standards-Version to 4.1.0
Checksums-Sha1:
 c2eebae2a6825add32a6e35d9cae24ae7705e39a 2351 weechat_1.9.1-1.dsc
 caebc05c4a8627625d2688534fbba624555e5a8e 2658824 weechat_1.9.1.orig.tar.bz2
 866986d23f47bd81aa7a8c8ddce5a2e3e41d80e0 15348 weechat_1.9.1-1.debian.tar.xz
 102a3af6bd7beeee30098b1e3fd8f25650359561 724044 weechat-core-dbgsym_1.9.1-1_amd64.deb
 69c77bd747853921582f5eebd581513de7b62a27 735734 weechat-core_1.9.1-1_amd64.deb
 9478883891bbaefbb70578cd5050ccbd8ceb93ad 1107054 weechat-curses-dbgsym_1.9.1-1_amd64.deb
 b9c22e3e52a3a1f4dea94f307f1beb4c2ea4d9f6 410226 weechat-curses_1.9.1-1_amd64.deb
 e9979e6c0bee5ea509a2d50c71bef5c61ee9ad83 70372 weechat-dev_1.9.1-1_all.deb
 f8d4fc1021e98d4dc6a071e956fe88a1063dc230 860976 weechat-doc_1.9.1-1_all.deb
 89270b66599cd446c04a489d7c5f3735812fb903 1499864 weechat-plugins-dbgsym_1.9.1-1_amd64.deb
 a8cb7ba752458567bbb997c6f3bed7ae52a7c8a8 441014 weechat-plugins_1.9.1-1_amd64.deb
 c1754b677f436f9691b62ae9605189b6d1b366bc 57544 weechat_1.9.1-1_all.deb
 140ef22e240497ff1f82d7132fec58b146d70a45 11897 weechat_1.9.1-1_amd64.buildinfo
Checksums-Sha256:
 a4f37e62dde4a8b565484c1a00a0cc68e65d0767fbf798fee5e4c6e6556a8a06 2351 weechat_1.9.1-1.dsc
 a1968c41803677edb4486b5f4e14a86205afce45bf1e06cfe2c012bcd201f1cd 2658824 weechat_1.9.1.orig.tar.bz2
 0c28fa0e8ffcc630f0b77a8097bfed3663f5fee6d0b61f03856b1121aa3b2541 15348 weechat_1.9.1-1.debian.tar.xz
 b516386a0b739bf728bd697c65c3ddba54f2c5bf4fcec46a56e3153c661307a7 724044 weechat-core-dbgsym_1.9.1-1_amd64.deb
 73273a96594597bdbee4cec44823c28b5cb57952da4792ce846d00075d743403 735734 weechat-core_1.9.1-1_amd64.deb
 8ad277f5ddf99c5bd16b4401767f5651f42ed8ffc2d6aad24b4e4c99851d17b7 1107054 weechat-curses-dbgsym_1.9.1-1_amd64.deb
 798607cfc21c416026703e5b1d9f03e60f9506729ebe50e24903d2ad8a0203ba 410226 weechat-curses_1.9.1-1_amd64.deb
 538c451040d65dfe7ce10a8725faf96cf84e25d2ffe4f39c146ab45ae897e0fe 70372 weechat-dev_1.9.1-1_all.deb
 736c2db1c7c097ae5134e849421a1230aed98ae563acab04bad55a397accdb65 860976 weechat-doc_1.9.1-1_all.deb
 3f13e984e559596108fe48d241ad1b4671694dca690eff14d9ccd6ab8e4d24f1 1499864 weechat-plugins-dbgsym_1.9.1-1_amd64.deb
 b4805b72d9b72d076b79e171d3b1aeb5ece11f68e132bd77bec63467954bddc0 441014 weechat-plugins_1.9.1-1_amd64.deb
 14e43f07814735f6fd0df8c8643264c7ec205e82635efe55fe5318f42f10f5e0 57544 weechat_1.9.1-1_all.deb
 5894efaf5aebfbd46ebce41f0ca56572acec48c23c5415320802d5380766fc3f 11897 weechat_1.9.1-1_amd64.buildinfo
Files:
 4eb41eacc50a855244df100ea5bf1c72 2351 net optional weechat_1.9.1-1.dsc
 4e81b9384fc47e2b697166bc05a9b4dc 2658824 net optional weechat_1.9.1.orig.tar.bz2
 9a957739fc7e51fd1032663098b03269 15348 net optional weechat_1.9.1-1.debian.tar.xz
 92601ceea2adc0efe6ce27d1973a6b1d 724044 debug optional weechat-core-dbgsym_1.9.1-1_amd64.deb
 cb85cf42afda43b9a0626b2984340f6d 735734 net optional weechat-core_1.9.1-1_amd64.deb
 9ff3c23b7ef1c714320463a3367ec2f1 1107054 debug optional weechat-curses-dbgsym_1.9.1-1_amd64.deb
 504f0e03313dda8e63e87f91b9bc3477 410226 net optional weechat-curses_1.9.1-1_amd64.deb
 ec2776a22d9f9c5170f546a5abe708f1 70372 devel optional weechat-dev_1.9.1-1_all.deb
 c0ca9e10a6037ecd12c3481d3c3de07d 860976 doc optional weechat-doc_1.9.1-1_all.deb
 683bd58349f0c55c49f575121748f680 1499864 debug optional weechat-plugins-dbgsym_1.9.1-1_amd64.deb
 d88aa60bb048fc4f603befcc18a97dda 441014 net optional weechat-plugins_1.9.1-1_amd64.deb
 c386e48f0cc01b6f31af5c6f5893593d 57544 net optional weechat_1.9.1-1_all.deb
 d9c13abe7d960f38d2a3d30cfb9a60e4 11897 net optional weechat_1.9.1-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQ1Tfow3vJnf8QuHSwd3I5KdQsMFAlnGztYACgkQSwd3I5Kd
QsP5UA//TGysJzkLvZ/w6uM45FkDRok2AalKbq7JsvDWN8F/dmuK54uCby2VYRFk
zysHWYr8N1XdChYMsoi5AwngMrJ/zhr+pFoRIdwAfa9sxADkDvLa5yd88nn0dBCO
CU9DwuqU4e1v1UTnV8ED0Xj0SGm6WzMMOmO28blfywavwZBgIr2jaAEVdkM8WeH2
v/O+LpHptJBdP7Xkg+v5xfUrGaWZHzllqdaDnk+oGNf7Ll8mw1SCt1uktJ4ByRSX
xMdxhlyfz4fEpBpkrHNAYOuLDua2hQgzsUNCHTnlH4BMChw0tydroSr293Vrh7ya
D1Bo2N5jb27AzbLPZqskdrQxuuxgm29vbcSbcLYfCNZ2gbkinay/Mes0XoSYfjhB
2PdiBR9vOYSv9ycKDysTRQhsUFLb/OHEUT4WLAsQWAt/Ikcu4/KOIum+R0aY5oc+
7lxKz/0KBksGnjjL5LGDWl+HlKExE/5w+8+c6OfSLI3xeLhJzWQ1EzqWQWsupH8r
7Z9GG7oV29e6AVDUy+2YQDDf/42tvjO4YwchqaIUJAwIcgEMb+3745FpsSoaDSiN
H0h9rCSDOA5HgBjz33epmrAvpUAYPHH8Od+LUsWRfi2oZKxbtkYoiozBxcUTK1lb
e6FyZlf0Nl5gZsIOIhgS5fbqWgoVrWE5VTit3sTvHRApKbJwThs=
=SnQm
-----END PGP SIGNATURE-----

Message #21 received at 876553@bugs.debian.org (full text, mbox, reply):

From: Stefan Bühler <source@stbuehler.de>

To: 876553@bugs.debian.org

Subject: Re: Bug#876553: fixed in weechat 1.9.1-1

Date: Wed, 27 Sep 2017 16:23:43 +0200

Hi,

are there any plans to fix this in stable (stretch) too?

I disagree with the "Minor issue; requires a malicious IRC server"
comment on https://security-tracker.debian.org/tracker/CVE-2017-14727
(even upstream classified it as "high severity"), and it seems the patch
is easy to backport (no conflicts, compiles just fine).

cheers,
Stefan

Message #26 received at 876553-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 876553-close@bugs.debian.org

Subject: Bug#876553: fixed in weechat 1.6-1+deb9u2

Date: Fri, 29 Sep 2017 11:32:49 +0000

Source: weechat
Source-Version: 1.6-1+deb9u2

We believe that the bug you reported is fixed in the latest version of
weechat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 876553@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated weechat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 27 Sep 2017 20:53:31 +0200
Source: weechat
Binary: weechat weechat-curses weechat-core weechat-plugins weechat-doc weechat-dev weechat-dbg
Architecture: source
Version: 1.6-1+deb9u2
Distribution: stretch
Urgency: medium
Maintainer: Emmanuel Bouthenot <kolter@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 876553
Description: 
 weechat    - Fast, light and extensible chat client
 weechat-core - Fast, light and extensible chat client - core files
 weechat-curses - Fast, light and extensible chat client - console client
 weechat-dbg - Fast, light and extensible chat client - debugging symbols
 weechat-dev - Fast, light and extensible chat client - development headers
 weechat-doc - Fast, light and extensible chat client - documentation
 weechat-plugins - Fast, light and extensible chat client - plugins
Changes:
 weechat (1.6-1+deb9u2) stretch; urgency=medium
 .
   * Non-maintainer upload.
   * logger: call strftime before replacing buffer local variables
     (CVE-2017-14727) (Closes: #876553)
Checksums-Sha1: 
 57345fff775f5db0d18af8c75d456cb8bfc1d245 2667 weechat_1.6-1+deb9u2.dsc
 3f874cfe2fa62f0e822fc55a0d7c19910028662c 16916 weechat_1.6-1+deb9u2.debian.tar.xz
Checksums-Sha256: 
 4b9cd4113ea97f13202b12c0c892b811f27a85a5c60f843735ad860ffbf04bb7 2667 weechat_1.6-1+deb9u2.dsc
 d4c1aaa21f249e548f908c2f214a58ae5de8d6fee3c277372070fe8983df6371 16916 weechat_1.6-1+deb9u2.debian.tar.xz
Files: 
 201b509e0bbfacfe53ad8649c03e87ed 2667 net optional weechat_1.6-1+deb9u2.dsc
 92054b9756a974ddecd7adba39b632e9 16916 net optional weechat_1.6-1+deb9u2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlnMZS9fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EZFUP/ApwIvrqceA1TE6uOCTR+X/aD7wIu/jU
Csxa/jwR1vpc4DIQL9R7exSDCmJ4mmP9HBgPz8gABtGzNQGFCspjRfmJfL9HCJrV
Axqv6cjOpnT6M4zJNd6waa0JoVwGZyYmfc1gMMzMMIlX611fQ1V2uR9MDlhfsW64
zPeZbzp5kqFLYjbdnQ5VPNOGSHBNB2ULxhv5ulokCbMJkmJcq4kbBd3n/yTAmb4h
poAp1mBX+IXsYzMCg6aaQf95jVsgggJiJadBgA9L3Qw00GMCcAGNsGB//gFVOSoK
RpNSc4Q8/21i/HdFs9a+Ah07BfHI7PgBbSwYLl6GaEnleJ9TJ1I6ltZuYkVhMDZB
Kps19uKmQaV6aIO32yLshom7R4A+HJypMqc7M1U6CY5ov6FPqVz34P4LiP9wQR4B
5AA6CHcBdwhvs62iNGctACDPIaad1qmnqzkurL3Eh5LjD2kTrrJxxfJMSVKCFNm9
s/WNAMkEcFWFfFR71cUoOM2EL4Ted16w1GfnpNkjDUO7goW5Pm6E4IUwxIX95V2G
Z0Ua0IbOfMGt7FY1qMtZkIYYu1G/Ls/vue0bo3rC/NFVcAn+nnPBtzgbPVXwYrpz
QA38OXwohdZ/cdgNKIgrhrgoAyHrxG9udJ1AwLoKoD0E+GsYReP0yoVhdaPC4tQ0
MW/bZjNUpHhO
=9+CT
-----END PGP SIGNATURE-----

Message #31 received at 876553-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 876553-close@bugs.debian.org

Subject: Bug#876553: fixed in weechat 1.0.1-1+deb8u2

Date: Sun, 08 Oct 2017 12:03:15 +0000

Source: weechat
Source-Version: 1.0.1-1+deb8u2

We believe that the bug you reported is fixed in the latest version of
weechat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 876553@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated weechat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 27 Sep 2017 21:27:15 +0200
Source: weechat
Binary: weechat weechat-curses weechat-core weechat-plugins weechat-doc weechat-dev weechat-dbg
Architecture: all source
Version: 1.0.1-1+deb8u2
Distribution: jessie
Urgency: medium
Maintainer: Emmanuel Bouthenot <kolter@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 876553
Description: 
 weechat    - Fast, light and extensible chat client
 weechat-core - Fast, light and extensible chat client - core files
 weechat-curses - Fast, light and extensible chat client - console client
 weechat-dbg - Fast, light and extensible chat client - debugging symbols
 weechat-dev - Fast, light and extensible chat client - development headers
 weechat-doc - Fast, light and extensible chat client - documentation
 weechat-plugins - Fast, light and extensible chat client - plugins
Changes:
 weechat (1.0.1-1+deb8u2) jessie; urgency=medium
 .
   * Non-maintainer upload.
   * logger: call strftime before replacing buffer local variables
     (CVE-2017-14727) (Closes: #876553)
Checksums-Sha1: 
 f309ddc72ce73814e81a9b5ac57c41b9a6f7ab1f 2611 weechat_1.0.1-1+deb8u2.dsc
 b0adcaa9d463a31e09c814ea6ac5e87c18d155e2 16392 weechat_1.0.1-1+deb8u2.debian.tar.xz
 008427c57d8d4394ba5b5c54bd3b2c8649ab3d16 48798 weechat_1.0.1-1+deb8u2_all.deb
 eb5d2baf36d4cd634239ea8d30b76eb764b80ce7 775174 weechat-doc_1.0.1-1+deb8u2_all.deb
 f339f839a4a72697642697a6e0bb6d31ac9c187a 60312 weechat-dev_1.0.1-1+deb8u2_all.deb
Checksums-Sha256: 
 f3f84cb64a83e5256a04ae83d95f8248183b261ff11f65d613ee283a3ddd909d 2611 weechat_1.0.1-1+deb8u2.dsc
 5587f3ca3aa1b9a4d7b5025e432bbf67d6416af4aa10a0c9e30a7a3baa319098 16392 weechat_1.0.1-1+deb8u2.debian.tar.xz
 ca277b8fd8036a9c58052f607a3d51eb63f6f39ce21bbb8c58b8a00f26f1f966 48798 weechat_1.0.1-1+deb8u2_all.deb
 e40b411edba85e0625414e4d3adaabc7fe4a2093fd8d2a87c8115eb023921b92 775174 weechat-doc_1.0.1-1+deb8u2_all.deb
 a2b8c76d723664bbe066cc35243ed4784fa5b686401a1873c0a5cf7c46311011 60312 weechat-dev_1.0.1-1+deb8u2_all.deb
Files: 
 dbb01c4713a8667ef85f5d300d5031b2 2611 net optional weechat_1.0.1-1+deb8u2.dsc
 fdb73bee6e6280bc52fdd3de25df4c70 16392 net optional weechat_1.0.1-1+deb8u2.debian.tar.xz
 f3abca434414658510efa103c7d1ea5d 48798 net optional weechat_1.0.1-1+deb8u2_all.deb
 e68a902308127dacb324a08765cabcfc 775174 doc optional weechat-doc_1.0.1-1+deb8u2_all.deb
 b011e511252ea81df283f7e9b362fed3 60312 devel optional weechat-dev_1.0.1-1+deb8u2_all.deb

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlnMZ8ZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89ENikP+wRGpIILlVxJpv3S929lqaGdsfXImirS
4g8clvaBFwIoHhcaB3TmzYYB//uYzCaznbeXDe7XyXH5hSx41Tg7z9GHaWUc2n6N
Oxou7knOMm2MQMnB5/YTYZYOGBzgSopDT0KPUK6fi86cG1/+fhrnlvyNI0hZxowI
ush6enCrmr8ymj0iGoTXT9rRTzPiSM1NPlcTNpBPbDsfkDYlVpQY1aRRso2alZRO
dVm2yXt/wkHi9A6clPIWoWhcTRWj8FNWIMxT3TB9zbsFGaOw7qETaVEz4cw0BSeZ
CFKkkBnb3Ql/eN7qV0Y0KGp+F4ukDEr6Ki3pjD8hiUKHoI2czkLuLxcT6Yc1GSNm
OVaUvmIR0tw4Bfl9UD/F6cKgZV5C/St3oB2l2jQi3UEoeKJ8MfpZq0Zchdw2mKb5
o7mDL4DizA24+npLws3JBD5qIB/DLz+M2iU8rx4SnF/KxOOtsP8QCMwg7BnmF+9c
g4IflSUJgI/uoXRKlHpc+bNFQIRKdfTg8xopX3d2hNL9YQkW8pgi08pm23snFORJ
X8ZK7EITsVTv299HypWddfntvafidfVagWAZsWp8xsGaEGhpgcIfTY8MXO7fPV03
EwSKn1M7v1WJGynhcNgK5zGbLTtpGUVXO4CrzBfYX1rHkQpZ6sdh4n20S7eLOQG6
5WSUMnA7o/z1
=9i78
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.