CVE-2010-0001: integer underflow

Debian Bug report logs - #566002
CVE-2010-0001: integer underflow

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2010-0001: integer underflow

Date: Wed, 20 Jan 2010 15:52:57 +0100

Package: gzip
Version: 1.3.12-8
Severity: grave
Tags: security patch

Hi Bdale, Carl

Carl, I saw too late that you're a new co-maintainer so I only
forwarded the pre-notification to Bdale (who is probably busy at LCA).
i
the following CVE (Common Vulnerabilities & Exposures) id was
published for gzip and is still open for unstable/testing.

CVE-2010-0001[0] (from the DSA text):
Aki Helin discovered an integer underflow when decompressing files that
are compressed using the LZW algorithm. This could lead to the execution
of arbitrary code when trying to decompress a crafted LZW compressed
gzip archive.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

I am available for NMU/sponsoring, in case you're still busy, just drop
me a line, please.

Cheers
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0001
    http://security-tracker.debian.org/tracker/CVE-2010-0001

patch:
--- gzip-1.3.12.orig/unlzw.c
+++ gzip-1.3.12/unlzw.c
@@ -248,7 +248,8 @@
        int  o;

     resetbuf:
-       e = insize-(o = (posbits>>3));
+       o = posbits >> 3;
+       e = o <= insize ? insize - o : 0;

        for (i = 0 ; i < e ; ++i) {
            inbuf[i] = inbuf[i+o];

Message #10 received at 566002@bugs.debian.org (full text, mbox, reply):

From: Bdale Garbee <bdale@gag.com>

To: Steffen Joeris <steffen.joeris@skolelinux.de>, 566002@bugs.debian.org

Subject: Re: Bug#566002: CVE-2010-0001: integer underflow

Date: Thu, 21 Jan 2010 07:33:25 +1300

[Message part 1 (text/plain, inline)]

On Wed, 20 Jan 2010 15:52:57 +0100, Steffen Joeris <steffen.joeris@skolelinux.de> wrote:
> Carl, I saw too late that you're a new co-maintainer so I only
> forwarded the pre-notification to Bdale (who is probably busy at LCA).

Carl and I are both at LCA, I'm done with my talk now and he isn't yet, so
I'm on this and will make an upload shortly.  Thanks!

Bdale

[Message part 2 (application/pgp-signature, inline)]

Message #15 received at 566002-done@bugs.debian.org (full text, mbox, reply):

From: Nick Andrik <nick.andrik@gmail.com>

To: 566002-done@bugs.debian.org

Subject: Re: Bug#566002: CVE-2010-0001: integer underflow

Date: Sun, 24 Jan 2010 13:03:39 +0100

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Version: 1.3.12-9

This bug was fixed in the package but the bug number was not mentioned
in the changelog.


- --
=Do-
N.AND


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAktcNxsACgkQrdZ2oYS0I7Iu/wCfeMSVZJUP0sCY8RXZWwMbtN8G
yT4AoMGPgaBKRrkcYk5gG9zOZoVRzsYf
=MhuY
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.