netpbm: [CVE-2005-3632, CVE-2005-3662] multiple buffer overflows in pnmtopng

Debian Bug report logs - #351639
netpbm: [CVE-2005-3632, CVE-2005-3662] multiple buffer overflows in pnmtopng

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <mpitt@debian.org>

To: Debian BTS Submit <submit@bugs.debian.org>

Subject: netpbm: [CVE-2005-3632, CVE-2005-3662] multiple buffer overflows in pnmtopng

Date: Mon, 6 Feb 2006 12:35:28 +0100

[Message part 1 (text/plain, inline)]

Package: netpbm
Version: 2:10.0-10
Severity: critical
Tags: security patch confirmed

Hi!

Over 3 months ago, DSA-904-1 announced that these two vulnerabilities
would be fixed in -11, but unstable is still vulnerable to these
issues. Please pull the fixes from sarge-security.

http://www.debian.org/security/2005/dsa-904
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3632
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3662

Please mention the CVE numbers in the changelog when you fix this.

Thank you,

Martin

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

In a world without walls and fences, who needs Windows and Gates?

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 351639@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <martin.pitt@ubuntu.com>

To: 351639@bugs.debian.org

Subject: Ubuntu patch

Date: Mon, 6 Feb 2006 18:14:16 +0100

[Message part 1 (text/plain, inline)]

Hi!
 
You can get the Ubuntu patch from

  http://patches.ubuntu.com/patches/netpbm-free.CVE-2006-3662_3632.diff

Thanks,

Martin
-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

In a world without walls and fences, who needs Windows and Gates?

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 351639-submitter@bugs.debian.org (full text, mbox, reply):

From: "Adam D. Barratt" <debian-bts@adam-barratt.org.uk>

To: 351639-submitter@bugs.debian.org

Subject: Debian bug #351639

Date: Thu, 26 Oct 2006 20:33:38 +0100

Hi,

You should have recently received (or will soon receive) an e-mail
telling you that I've closed Debian bug #351639 in the netpbm 
package, which you reported.

Due to the fact that the package was uploaded by someone who does not
normally do so, the bug was marked as "fixed" rather than closed.

Debian's bug tracking system now allows for this information to be
recorded in a more useful manner, enabling these bugs to be closed.

Due to the volume of bugs affected by this change, we are unfortunately
not sending individualized explanations for each bug. If you have
questions about the fix for your particular bug or about this email,
please contact me directly or follow up to the bug report in the Debian
BTS.

[It's possible you may receive multiple messages stating that the bug
was fixed in several different versions of the package. There are two
common reasons for this:

  - the bug was fixed in one version but subsequently found to exist
    in a later version

  - the bug existed in multiple distributions (for instance, "unstable"
    and "stable") and was thus fixed in a separate upload to each
    distribution
]

Regards,

Adam

Send a report that this bug log contains spam.