libmms: CVE-2014-2892: heap-based buffer overflow

Debian Bug report logs - #745301
libmms: CVE-2014-2892: heap-based buffer overflow

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libmms: CVE-2014-2892: heap-based buffer overflow

Date: Sun, 20 Apr 2014 11:59:23 +0200

Source: libmms
Version: 0.6-1
Severity: grave
Tags: security upstream fixed-upstream

Hi,

the following vulnerability was published for libmms.

CVE-2014-2892[0]:
heap-based buffer overflow

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2892
    https://security-tracker.debian.org/tracker/CVE-2014-2892
[1] http://sourceforge.net/p/libmms/code/ci/03bcfccc22919c72742b7338d02859962861e0e8

Regards,
Salvatore

Message #10 received at 745301@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 745301@bugs.debian.org, team@security.debian.org

Subject: Re: Bug#745301: libmms: CVE-2014-2892: heap-based buffer overflow

Date: Fri, 25 Apr 2014 16:40:28 +0200

[Message part 1 (text/plain, inline)]

Hi Security Team,

On 2014-04-20 11:59:23, Salvatore Bonaccorso wrote:
> Source: libmms
> Version: 0.6-1
> Severity: grave
> Tags: security upstream fixed-upstream
> 
> Hi,
> 
> the following vulnerability was published for libmms.
> 
> CVE-2014-2892[0]:
> heap-based buffer overflow

Please find attached the debdiffs for squeeze and wheezy. Please let me know if
it's okay to upload them to the squeeze-security and wheezy-security.

Cheers
-- 
Sebastian Ramacher

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 745301@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 745301@bugs.debian.org, team@security.debian.org

Subject: Re: Bug#745301: libmms: CVE-2014-2892: heap-based buffer overflow

Date: Fri, 25 Apr 2014 16:41:36 +0200

[Message part 1 (text/plain, inline)]

On 2014-04-25 16:40:28, Sebastian Ramacher wrote:
> Hi Security Team,
> 
> On 2014-04-20 11:59:23, Salvatore Bonaccorso wrote:
> > Source: libmms
> > Version: 0.6-1
> > Severity: grave
> > Tags: security upstream fixed-upstream
> > 
> > Hi,
> > 
> > the following vulnerability was published for libmms.
> > 
> > CVE-2014-2892[0]:
> > heap-based buffer overflow
> 
> Please find attached the debdiffs for squeeze and wheezy. Please let me know if
> it's okay to upload them to the squeeze-security and wheezy-security.

And here are the patches.

Cheers
-- 
Sebastian Ramacher

[libmms_0.6-1+squeeze2.debdiff (text/plain, attachment)]

[libmms_0.6.2-3+deb7u1.debdiff (text/plain, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 745301@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Sebastian Ramacher <sramacher@debian.org>

Cc: 745301@bugs.debian.org, team@security.debian.org

Subject: Re: Bug#745301: libmms: CVE-2014-2892: heap-based buffer overflow

Date: Fri, 25 Apr 2014 16:58:53 +0200

On Fri, Apr 25, 2014 at 04:41:36PM +0200, Sebastian Ramacher wrote:
> On 2014-04-25 16:40:28, Sebastian Ramacher wrote:
> > Hi Security Team,
> > 
> > On 2014-04-20 11:59:23, Salvatore Bonaccorso wrote:
> > > Source: libmms
> > > Version: 0.6-1
> > > Severity: grave
> > > Tags: security upstream fixed-upstream
> > > 
> > > Hi,
> > > 
> > > the following vulnerability was published for libmms.
> > > 
> > > CVE-2014-2892[0]:
> > > heap-based buffer overflow
> > 
> > Please find attached the debdiffs for squeeze and wheezy. Please let me know if
> > it's okay to upload them to the squeeze-security and wheezy-security.
> 
> And here are the patches.

Please upload to security-master. Note that both updates need to be build with "-sa" since
libmms is new in the security suites.

Cheers,
        Moritz

Message #27 received at 745301@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: Moritz Muehlenhoff <jmm@inutil.org>

Cc: 745301@bugs.debian.org, team@security.debian.org

Subject: Re: Bug#745301: libmms: CVE-2014-2892: heap-based buffer overflow

Date: Fri, 25 Apr 2014 17:19:36 +0200

[Message part 1 (text/plain, inline)]

On 2014-04-25 16:58:53, Moritz Muehlenhoff wrote:
> On Fri, Apr 25, 2014 at 04:41:36PM +0200, Sebastian Ramacher wrote:
> > On 2014-04-25 16:40:28, Sebastian Ramacher wrote:
> > > Hi Security Team,
> > > 
> > > On 2014-04-20 11:59:23, Salvatore Bonaccorso wrote:
> > > > Source: libmms
> > > > Version: 0.6-1
> > > > Severity: grave
> > > > Tags: security upstream fixed-upstream
> > > > 
> > > > Hi,
> > > > 
> > > > the following vulnerability was published for libmms.
> > > > 
> > > > CVE-2014-2892[0]:
> > > > heap-based buffer overflow
> > > 
> > > Please find attached the debdiffs for squeeze and wheezy. Please let me know if
> > > it's okay to upload them to the squeeze-security and wheezy-security.
> > 
> > And here are the patches.
> 
> Please upload to security-master. Note that both updates need to be build with "-sa" since
> libmms is new in the security suites.

Built with -sa and uploaded.

Cheers
-- 
Sebastian Ramacher

[signature.asc (application/pgp-signature, inline)]

Message #32 received at 745301-close@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: 745301-close@bugs.debian.org

Subject: Bug#745301: fixed in libmms 0.6.2-4

Date: Fri, 25 Apr 2014 15:34:42 +0000

Source: libmms
Source-Version: 0.6.2-4

We believe that the bug you reported is fixed in the latest version of
libmms, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 745301@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sebastian Ramacher <sramacher@debian.org> (supplier of updated libmms package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 25 Apr 2014 15:43:03 +0200
Source: libmms
Binary: libmms-dev libmms0
Architecture: source amd64
Version: 0.6.2-4
Distribution: unstable
Urgency: high
Maintainer: Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
Changed-By: Sebastian Ramacher <sramacher@debian.org>
Description: 
 libmms-dev - MMS stream protocol library - development files
 libmms0    - MMS stream protocol library - shared library
Closes: 745301
Changes: 
 libmms (0.6.2-4) unstable; urgency=high
 .
   * Team upload.
 .
   [ Fabian Greffrath ]
   * Remove myself from Uploaders.
 .
   [ Sebastian Ramacher ]
   * Use urgency=high for security fix.
   * debian/patches/0002-CVE-2014-2892.patch: Apply upstream patch for
     CVE-2014-2892. (Closes: #745301)
   * debian/control:
     - Bump Standards-Version to 3.9.5.
     - Add dh-autoreconf to Depends and bump debhelper to >= 9.
     - Vcs-*: Ue canonical URLs.
     - Remove obsolete Dm-Upload-Allowed.
   * debian/rules: Run dh with --with autoreconf.
Checksums-Sha1: 
 56a54742a28c599141229b9a6c7401657ae31cad 2003 libmms_0.6.2-4.dsc
 07a5708d9d99aac1ffd2e03a858a3c0185ed5eb9 7088 libmms_0.6.2-4.debian.tar.xz
 bd17540325a8714739bcab8470b7ad720d8bc23e 38372 libmms-dev_0.6.2-4_amd64.deb
 bf49af2235a0110073b7a29a03f189eb5ca14a43 35414 libmms0_0.6.2-4_amd64.deb
Checksums-Sha256: 
 0ed9646d509716f139f3eed0ed09365dc81ef896aa9f0b5ccf06c2ec878ac841 2003 libmms_0.6.2-4.dsc
 e82d08c84358e2da83c4f83740a7e719facfe5adaf67717c219affd99c5fb2d0 7088 libmms_0.6.2-4.debian.tar.xz
 8af9f86b49059b80372245342eb8272e6dcb3c7709dc12ab5d4c843c895cd560 38372 libmms-dev_0.6.2-4_amd64.deb
 4de5819852f695f7a1dd96661654960dfd7171f6d82ab64c93dc6db173ab4156 35414 libmms0_0.6.2-4_amd64.deb
Files: 
 cf26af39a592ae411db462be0d34397d 38372 libdevel optional libmms-dev_0.6.2-4_amd64.deb
 ac9ef11225026fc418ab8bf8cc3c2990 35414 libs optional libmms0_0.6.2-4_amd64.deb
 c0bb25e397281ae560f3708d56f0ee4c 2003 libs optional libmms_0.6.2-4.dsc
 7ed2f50aa9b258a103604e0b1eadfcc7 7088 libs optional libmms_0.6.2-4.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJTWmbuAAoJEGny/FFupxmThXgP/RvEEei2NeweFH6RDozzaDuY
BZXi/AkUEQVk7DOmiQ9Cu7IgfIhmWJEkdMlz7ZvvYCTQZZYFKODpiw6R/tbzAq6W
T+VzlWXMzOmfguEBs2TGKuEAaWujxGOoyXICG0P2DcBTwBjFcij2R53zHFs/Dapt
+z8TwhrHYh44Hpn1U8qjQumO6jTVoVP/02zVb/SL/OKBlJwxu39tCtVl1JY3NfxK
goj2Lvp1Jyw/TX083bl25aC9KQcByXm/u8+2ACEPAttI3R3pxI+zFnkdC6OXCWkh
PezQS1VNQaEOv2uLVX6bDc1ebApaA1y8Tj6ekKxoY95xswFlG1gM526L0SxOT2eT
T81GbvY6T+hfGNSojcsTYxHogZIHa8DhBZQ+U0JyD64vm+ykikndfJw//yHOo0cj
nkIn13Z2VXqD37D53NJfuEXdQZH63ot+1LswX5m8mJJGGTYeTwZnPCDDfic8GSl/
ql3LFMCDw2WNtlBBKQvFknPibl0w6tWbUx+lXIlhD7xvgOf/5uFwdFSGVMRNFBOg
PQwd630dzoSqQdJ9whKvszU9NX8sI3xO+IGaRT10B5yhRqb1ergZaziKfdRagKWo
ZnUlxh8HJk10DqXEC+iLxFqqAHdNiGtLkjFBcPudndE5b0boBukPpz9d3AJCU/Nd
WoqOdiad50pU7MqePwC6
=zMCn
-----END PGP SIGNATURE-----

Message #37 received at 745301-close@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: 745301-close@bugs.debian.org

Subject: Bug#745301: fixed in libmms 0.6.2-3+deb7u1

Date: Sun, 04 May 2014 21:32:20 +0000

Source: libmms
Source-Version: 0.6.2-3+deb7u1

We believe that the bug you reported is fixed in the latest version of
libmms, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 745301@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sebastian Ramacher <sramacher@debian.org> (supplier of updated libmms package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 25 Apr 2014 16:14:59 +0200
Source: libmms
Binary: libmms-dev libmms0
Architecture: source amd64
Version: 0.6.2-3+deb7u1
Distribution: wheezy-security
Urgency: high
Maintainer: Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
Changed-By: Sebastian Ramacher <sramacher@debian.org>
Description: 
 libmms-dev - MMS stream protocol library - development files
 libmms0    - MMS stream protocol library - shared library
Closes: 745301
Changes: 
 libmms (0.6.2-3+deb7u1) wheezy-security; urgency=high
 .
   * Team upload.
   * debian/patches/0002-CVE-2014-2892.patch: Apply upstream patch for
     CVE-2014-2892. (Closes: #745301)
Checksums-Sha1: 
 cfc5a27d9413370bd5dd315eaa52459b420985f6 2063 libmms_0.6.2-3+deb7u1.dsc
 cdef62fd1a0e2585dd2111fc94b032f84290e351 340230 libmms_0.6.2.orig.tar.gz
 2cf8f5b50cdad8e0eb358b8d8d1b46269173101c 7502 libmms_0.6.2-3+deb7u1.debian.tar.gz
 c1b985b593d52f4b9eb7a0fd19986d053d2c1873 48238 libmms-dev_0.6.2-3+deb7u1_amd64.deb
 f19df27ca8015220f3987927b13a045f90e95549 40820 libmms0_0.6.2-3+deb7u1_amd64.deb
Checksums-Sha256: 
 d53161c2a2091be0abcd8a02ec0504a5e835d9f0722fae052f4cbd3f63132a06 2063 libmms_0.6.2-3+deb7u1.dsc
 01931b62172d7d7050fc9ef9b1b64162f3b6e9f6cc4415170192a32a0b7ea432 340230 libmms_0.6.2.orig.tar.gz
 65e048ff9fbb494bc3bf584a1d4418625c8525d1f2fda26b8eb2506f8a6dd8ff 7502 libmms_0.6.2-3+deb7u1.debian.tar.gz
 b2eace182828a3e041db0d8deaba9fefdd919d5fd156731e66c1b0b96436f7ae 48238 libmms-dev_0.6.2-3+deb7u1_amd64.deb
 bf01315e2f3ebe0ba87f0f1aaf0e310301c25e51c4ed87c6f44496532915d2ff 40820 libmms0_0.6.2-3+deb7u1_amd64.deb
Files: 
 f7db094ab66ce239a02ac3ba0ee6f89e 2063 libs optional libmms_0.6.2-3+deb7u1.dsc
 9f63aa363deb4874e072a45850161bff 340230 libs optional libmms_0.6.2.orig.tar.gz
 4da361723ba4d79de643b0955d88edf6 7502 libs optional libmms_0.6.2-3+deb7u1.debian.tar.gz
 2edfd5400f88ec1a753d2bc3aabeaea6 48238 libdevel optional libmms-dev_0.6.2-3+deb7u1_amd64.deb
 9e2fbebfb1f2a854249fc02012e1c3d2 40820 libs optional libmms0_0.6.2-3+deb7u1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJTWnxLAAoJEGny/FFupxmTGpwP/3BAFewhN+ldkZneua+OgdpB
Mzi6oGg6BRsqYEjC0+4dvpCWV2cQyqGlqdYqc6mWrWAPJYdOAVxaDXVUjbvrGfSy
dJOrY27duJOYbnd2QtdgtKkf3HV/bySoasniFGy5ryenWJVct5VxlU+UjZxIRCps
wFu5yYvAsBsJzZEEB47GMz+225Tn+9bgAt1eN5I5M7H5bptDduTLQB2qXgcFNU3m
lPOxPAENZAjSBnHeR/i1ycsW0+iIYqvueeAbgmB3T/JiZ3CLq3AJVRHQwuMXnRmp
Hx5OwQnnDpEKb+XA3rl0rtTV3B4tnYFkbjYrsMy4NJc8vlTNf/4oKMoXXTw8AO/G
Z5yzEqCVUutUkK4rCw8kr4CoebCRuw2myE05WuLa0PEXAQ7tmG38fAvs38sKs6mf
skexmkDs3qivLrdZPZicLkq1cM7RQfP9v97GyoiIzQZ9WeHo+KTGrDVLnJyzWq86
p9k3NH8l/tHbcsMpoBTFMQl3OeM6aQBaMzemjc7Aiifii02q9lZJhMbahz8GBuww
GQqnSCgcAkzx5byB89tcSy8tpzcpEYJi3XHDQo2wqn3vZ52wA23aL128Nms2PwIT
WcwQuVL4MMHRwljaZSnqWglTlZd0Kb1XhKVPsklVaFT9kyRQfbXPcHo9IqYgKbhm
WNWD3IFXUGeKmnuOH0WN
=+8Iv
-----END PGP SIGNATURE-----

Message #42 received at 745301-close@bugs.debian.org (full text, mbox, reply):

From: Sebastian Ramacher <sramacher@debian.org>

To: 745301-close@bugs.debian.org

Subject: Bug#745301: fixed in libmms 0.6-1+squeeze2

Date: Wed, 07 May 2014 22:47:43 +0000

Source: libmms
Source-Version: 0.6-1+squeeze2

We believe that the bug you reported is fixed in the latest version of
libmms, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 745301@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sebastian Ramacher <sramacher@debian.org> (supplier of updated libmms package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 25 Apr 2014 16:14:59 +0200
Source: libmms
Binary: libmms-dev libmms0
Architecture: source amd64
Version: 0.6-1+squeeze2
Distribution: squeeze-security
Urgency: high
Maintainer: Debian Multimedia Packages Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
Changed-By: Sebastian Ramacher <sramacher@debian.org>
Description: 
 libmms-dev - MMS stream protocol library - development files
 libmms0    - MMS stream protocol library - shared library
Closes: 745301
Changes: 
 libmms (0.6-1+squeeze2) squeeze-security; urgency=high
 .
   * Team upload.
   * debian/patches/0002-CVE-2014-2892.patch: Apply upstream patch for
     CVE-2014-2892. (Closes: #745301)
Checksums-Sha1: 
 41e7f99078a26738ff404beedbb635ac535343c0 1984 libmms_0.6-1+squeeze2.dsc
 d93b9c27e6c83f288e1672029aa3c081270b669b 334519 libmms_0.6.orig.tar.gz
 336e2719c6f68c215846a42da7fe8c48bb18bd0a 8999 libmms_0.6-1+squeeze2.diff.gz
 adef3a06656c6313a3eec05457aef21caaefbdce 47834 libmms-dev_0.6-1+squeeze2_amd64.deb
 6a8d6e23c24adba0137e89c30eeb5a4aaf3f0cae 39092 libmms0_0.6-1+squeeze2_amd64.deb
Checksums-Sha256: 
 caf98eefaa9ab50d76eed75941df9b397a4383b7dc97d571ef8159f52407d2b2 1984 libmms_0.6-1+squeeze2.dsc
 1f894f33b5e0334bd7c75343480bdf3a9cf79232aa92085c03f1a67e7d4ceb9d 334519 libmms_0.6.orig.tar.gz
 776ee68601fabb86a03e5959c6cecec14049c28913da870492cad1bb2a9cb75e 8999 libmms_0.6-1+squeeze2.diff.gz
 02d2566a9af4c2c2dc9a16ad544fe71e8d72a76b75a38a05f560a43c5df746ae 47834 libmms-dev_0.6-1+squeeze2_amd64.deb
 9c27dc4a5e6db66b97e14dc7c4d55588a62c8c44057b3a32fcb9278dc200ad00 39092 libmms0_0.6-1+squeeze2_amd64.deb
Files: 
 65a0affe6f41579f23cc9b11855c3af3 1984 libs optional libmms_0.6-1+squeeze2.dsc
 650ad04a4c8bd79246390b81b29680b6 334519 libs optional libmms_0.6.orig.tar.gz
 fce90ebcc71a94d652a20ed00906d8cf 8999 libs optional libmms_0.6-1+squeeze2.diff.gz
 85f3b9925e084ba86dc8947e239b50aa 47834 libdevel optional libmms-dev_0.6-1+squeeze2_amd64.deb
 2614a0817ec3dde069dfc7e11bdf1e4b 39092 libs optional libmms0_0.6-1+squeeze2_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJTWnxJAAoJEGny/FFupxmTeq8P/R57h+jnsSOMu8qVDlRpuMXG
Ib6EZHTI2WM2Quu6we8UtItyb9/LhtWhrF1xyio5d7gkjR46elGflBP3totsV22t
AJCbON5lhOYxxCj9ndvk6WPTJi64Z7xYwnYdrCfZeNJQMegTuNmVmOSKcvPbV5e5
BzUWC8N2xjj/ocB+8NUOclYIvijZxlMBMa439xWUchCnkcXT+TQN0mAojy3gaDk3
55b/icmCNeC7w1luRFQNGuD508ThgmXMmfmMeQ3bu5P7ljpBGQyK2FYsZ17Zvhns
Zd8f+/fmQXincwUeL/8vdMaZxDQP4NQh9ecJ4IYM09nMIWTdMl1ZUKwbQtjXcAAT
9WlYtVk1X3gHXJbSYcTjK8kfu+WAAiNupLhR0/pUGz6zcqwYZxk1Ulr4dut0k1qY
6ENfUuJ9KgfGYZi9Kw7/ZWcnfLj2rKRGp1QFFC6je8p7DSg1HDf4t59FObDnIG6l
pFomKqCRIvwTiaZPcyO3tPjEU4OBtcfnlREtj0pupyw67S13rjZkc/m9pqNgNQvD
gz+B8N1sKtZsByDQ/kTSQ03ab+aUJckIRbwSSYrwYrWzY3CC7LgbDPLIEW0UaJgz
PwZqAS+AeR6Q370CDGipjZKn2LJ9swnJMNLPueu13n9po6ck5fWSW+uCFU+L/Y6n
8yT67kIUngZ8sGer4FiO
=9kJs
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.