Debian Bug report logs -
#817799
libotr5: Exploitable integer overflow vulnerability (CVE-2016-2851)
Reported by: Michail Bachmann <m.bachmann@cms.hu-berlin.de>
Date: Thu, 10 Mar 2016 14:03:01 UTC
Severity: grave
Tags: security
Found in versions libotr/4.1.0-7, 3.2.1-1
Fixed in versions libotr/4.1.1-1, 3.2.1-1+deb7u2, libotr/4.1.0-2+deb8u1
Done: Salvatore Bonaccorso <carnil@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian Privacy Tools Maintainers <pkg-privacy-maintainers@lists.alioth.debian.org>:
Bug#817799; Package libotr5.
(Thu, 10 Mar 2016 14:03:06 GMT) (full text, mbox, link).
Acknowledgement sent
to Michail Bachmann <m.bachmann@cms.hu-berlin.de>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian Privacy Tools Maintainers <pkg-privacy-maintainers@lists.alioth.debian.org>.
(Thu, 10 Mar 2016 14:03:06 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Package: libotr5
Version: 4.1.0-7
Severity: grave
Tags: security
Justification: user security hole
Dear Maintainer,
the libotr versions prior to 4.1.1 contain an integer overflow vulnerability.
This can cause buffer overflow that could lead to code execution. The
vulnerability has been assigned the CVE-2016-2851.
You can find more information here:
https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/
Sincerely,
Michail Bachmann
-- System Information:
Debian Release: stretch/sid
APT prefers unstable
APT policy: (500, 'unstable'), (300, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 4.4.0-1-686-pae (SMP w/2 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages libotr5 depends on:
ii libc6 2.22-2
ii libgcrypt20 1.6.5-2
libotr5 recommends no packages.
Versions of packages libotr5 suggests:
pn libotr5-bin <none>
-- no debconf information
Reply sent
to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility.
(Thu, 10 Mar 2016 14:09:08 GMT) (full text, mbox, link).
Notification sent
to Michail Bachmann <m.bachmann@cms.hu-berlin.de>:
Bug acknowledged by developer.
(Thu, 10 Mar 2016 14:09:09 GMT) (full text, mbox, link).
Message #10 received at 817799-done@bugs.debian.org (full text, mbox, reply):
Source: libotr
Source-Version: 4.1.1-1
Hi,
On Thu, Mar 10, 2016 at 02:49:20PM +0100, Michail Bachmann wrote:
> Package: libotr5
> Version: 4.1.0-7
> Severity: grave
> Tags: security
> Justification: user security hole
>
> Dear Maintainer,
>
> the libotr versions prior to 4.1.1 contain an integer overflow vulnerability.
> This can cause buffer overflow that could lead to code execution. The
> vulnerability has been assigned the CVE-2016-2851.
>
> You can find more information here:
>
> https://www.x41-dsec.de/lab/advisories/x41-2016-001-libotr/
Thanks. The fix is already on the way, cf.
https://tracker.debian.org/news/754059 thus fixing the bugreport with
that version.
Regards,
Salvatore
Marked as found in versions 3.2.1-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Thu, 10 Mar 2016 14:09:15 GMT) (full text, mbox, link).
Marked as fixed in versions 3.2.1-1+deb7u2.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Thu, 10 Mar 2016 14:09:16 GMT) (full text, mbox, link).
Marked as fixed in versions libotr/4.1.0-2+deb8u1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Thu, 10 Mar 2016 14:09:17 GMT) (full text, mbox, link).
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Wed, 13 Apr 2016 07:34:42 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 17:16:38 2019;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon