imlib2: CVE-2008-6079 multiple vulnerabilities

Debian Bug report logs - #576469
imlib2: CVE-2008-6079 multiple vulnerabilities

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: submit@bugs.debian.org

Subject: imlib2: CVE-2008-6079 multiple vulnerabilities

Date: Sun, 4 Apr 2010 18:19:05 -0400

Package: imlib2
Version: 1.4.0-1.2
Severity: important
Tags: security

Hi,

the following CVE (Common Vulnerabilities & Exposures) id was
published for imlib2, which is claimed fixed by upstream 1.4.2, which
is already in unstable. lenny is very likely affected, but I can't find
any actionable info, so you will need to touch base upstream to figure
this out.

CVE-2008-6079[0]:
| Multiple unspecified vulnerabilities in imlib2 before 1.4.2 have
| unknown impact and attack vectors.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6079
    http://security-tracker.debian.org/tracker/CVE-2008-6079

Message #12 received at 576469-done@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Michael Gilbert <michael.s.gilbert@gmail.com>, 576469-done@bugs.debian.org

Subject: Re: Bug#576469: imlib2: CVE-2008-6079 multiple vulnerabilities

Date: Mon, 5 Apr 2010 15:23:19 +0200

[Message part 1 (text/plain, inline)]

Version: 1.4.2-1

Hey,
* Michael Gilbert <michael.s.gilbert@gmail.com> [2010-04-05 00:34]:
> Package: imlib2
> Version: 1.4.0-1.2
> Severity: important

raised the severity

> the following CVE (Common Vulnerabilities & Exposures) id was
> published for imlib2, which is claimed fixed by upstream 1.4.2, which
> is already in unstable. lenny is very likely affected, but I can't find
> any actionable info, so you will need to touch base upstream to figure
> this out.

This is indeed fixed in 1.4.2. For lenny, yes it is affected and actually I 
already identified and backported the fixes to the lenny version. This is 
about multiple buffer overflows (heap and stack based) in various loaders. The 
stable update will come today or tomorrow.

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #17 received at 576469-done@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 576469-done@bugs.debian.org

Date: Mon, 5 Apr 2010 16:37:51 +0200

[Message part 1 (text/plain, inline)]

Version: 1.4.0-1+lenny1

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.