CVE-2015-6609 CVE-2015-6602 CVE-2015-3875

Debian Bug report logs - #806375
CVE-2015-6609 CVE-2015-6602 CVE-2015-3875

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2015-6609 CVE-2015-6602 CVE-2015-3875

Date: Thu, 26 Nov 2015 19:53:23 +0100

Source: android-platform-frameworks-native
Severity: important
Tags: security

Please see
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6609  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6602
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3875

Cheers,
        Moritz

Message #10 received at 806375@bugs.debian.org (full text, mbox, reply):

From: Hans-Christoph Steiner <hans@eds.org>

To: 806375@bugs.debian.org

Subject: Debian not affected

Date: Fri, 27 Nov 2015 11:31:31 +0000

These bugs do not really affect Debian because libutils is not included
in any process that runs with elevated privileges nor any process that
is connected to the network by default.  On Android, libutils is used in
'system' level processes (basically like setuid root).

libutils is only used in the Android SDK tools in Debian.  So if someone
processed images or audio files with the Android SDK, it might be
vulnerable, but that means the attacker already has user access.  The
exploit would let a build script run arbitrary commands via an
image/sound/video file planted in the build.  If an attacker can plant
an image/sound/video file, they might as well just plant code, so not
really a useful exploit.

In any case, it will be fixed with the upcoming upload.

.hc

Message #15 received at 806375@bugs.debian.org (full text, mbox, reply):

From: 殷啟聰 <seamlikok@gmail.com>

To: 806375@bugs.debian.org

Subject: Should Be Reassigned to android-platform-system-core But Won't Be Fixed by Next Upload

Date: Thu, 24 Dec 2015 17:09:48 +0800

According to the CVE descriptions, these bugs belongs to libutils.
Since Android 5.1.1, libutils has been moved to
src:android-platform-system-core (See
<http://anonscm.debian.org/cgit/android-tools/android-platform-system-core.git>),
so after the next upload (6.0.0_r24) I will reassign this bug to
android-libutils or src:android-platform-system-core.

However this bug can't be closed yet. This bug refers to 3 CVEs, one
of them (CVE-2015-6609) belongs to "libutils in Android before 5.1.1
LMY48X and 6.0 before 2015-11-01". Currently the latest version in
Alioth is 6.0.0_r26 which is on 2015-09-24. Even the latest 6.0.1_r3
is on 2015-10-13 (See
<https://android.googlesource.com/platform/system/core/+/android-6.0.1_r3>).

Maybe Android 6.1 solves it. :)

Message #20 received at 806375@bugs.debian.org (full text, mbox, reply):

From: 殷啟聰 <seamlikok@gmail.com>

To: 806375@bugs.debian.org

Subject: Re: CVE-2015-6609 CVE-2015-6602 CVE-2015-3875

Date: Fri, 5 Feb 2016 12:47:36 +0800

Control: reassign -1 android-libutils 1:6.0.0+r26-1~stage1.1
Control: tags -1 confirmed fixed-upstream

It is fixed since Android 6.0.1 Release 13.

Message #31 received at 806375-close@bugs.debian.org (full text, mbox, reply):

From: Kai-Chung Yan <seamlikok@gmail.com>

To: 806375-close@bugs.debian.org

Subject: Bug#806375: fixed in android-platform-system-core 1:6.0.1+r16-1

Date: Wed, 17 Feb 2016 22:22:38 +0000

Source: android-platform-system-core
Source-Version: 1:6.0.1+r16-1

We believe that the bug you reported is fixed in the latest version of
android-platform-system-core, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 806375@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Kai-Chung Yan <seamlikok@gmail.com> (supplier of updated android-platform-system-core package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 16 Feb 2016 14:54:25 +0800
Source: android-platform-system-core
Binary: android-liblog android-liblog-dev android-libcutils android-libcutils-dev adb android-libsparse android-libsparse-dev android-libutils android-libutils-dev android-libziparchive android-libziparchive-dev android-platform-system-core-headers android-libbacktrace android-libbacktrace-dev android-libadb android-libadb-dev android-libbase android-libbase-dev fastboot
Architecture: source amd64 all
Version: 1:6.0.1+r16-1
Distribution: unstable
Urgency: medium
Maintainer: Android tools Maintainer <android-tools-devel@lists.alioth.debian.org>
Changed-By: Kai-Chung Yan <seamlikok@gmail.com>
Description:
 adb        - Android Debug Bridge
 android-libadb - Library for Android Debug Bridge
 android-libadb-dev - Library for Android Debug Bridge - Development files
 android-libbacktrace - Android backtrace library
 android-libbacktrace-dev - Android backtrace library - Development files
 android-libbase - Android base library
 android-libbase-dev - Android base library - Development files
 android-libcutils - Android utils library for C
 android-libcutils-dev - Android utils library for C - Development files
 android-liblog - Android NDK logger interfaces
 android-liblog-dev - Android NDK logger interfaces - Development files
 android-libsparse - Android Sparse library
 android-libsparse-dev - Android Sparse library - Development files
 android-libutils - Android Utility Function Library
 android-libutils-dev - Android Utility Function Library - Development files
 android-libziparchive - Android zip archive library
 android-libziparchive-dev - Android zip archive library - Development files
 android-platform-system-core-headers - Shared headers in AOSP repository platform/system/core
 fastboot   - Android fastboot tool
Closes: 806375
Changes:
 android-platform-system-core (1:6.0.1+r16-1) unstable; urgency=medium
 .
   * New upstream release (Closes: #806375)
   * Only execute build commands on amd64 & i386
   * d/control: adb & fastboot Provides their android-tools-* counterparts
   * Pull bash-completion for adb & fastboot from src:android-tools/5.1.1.r29-2
   * Add manpages for adb & fastboot
Checksums-Sha1:
 8d8f97f442d6016a05134e21f8ebc31296a731e0 3752 android-platform-system-core_6.0.1+r16-1.dsc
 3e054a833c30bef4bc6b65ba8a549c277487b085 853224 android-platform-system-core_6.0.1+r16.orig.tar.xz
 2d58c40db336202a8877149efabcc343621f2846 22848 android-platform-system-core_6.0.1+r16-1.debian.tar.xz
 9a2e581d44085474db5f178c2d1ac68c290e1fd0 157466 adb-dbgsym_6.0.1+r16-1_amd64.deb
 c7f673967faacaa3524c358b1e6e0959bc5e4388 45526 adb_6.0.1+r16-1_amd64.deb
 e5ea07742e320ac4b6e94d4761d10d7f83ece4e0 323994 android-libadb-dbgsym_6.0.1+r16-1_amd64.deb
 70854b7367abed0f32f2c2c672d039ce2a3b4c90 13790 android-libadb-dev_6.0.1+r16-1_amd64.deb
 728fd0de337acc42a6803bb79413c8f0c821caa0 55262 android-libadb_6.0.1+r16-1_amd64.deb
 6fb93e7d7657a632ef531bddc9648b2dfd7d06a6 184152 android-libbacktrace-dbgsym_6.0.1+r16-1_amd64.deb
 db28110fed86c0cc9a4d1270d5d88ac1666256c9 7040 android-libbacktrace-dev_6.0.1+r16-1_amd64.deb
 9e0f7cb00556446680b9920c5e29ee7a32e305e0 20618 android-libbacktrace_6.0.1+r16-1_amd64.deb
 1588d6f01a3c90b35907c0aeefbf101d4a029772 63012 android-libbase-dbgsym_6.0.1+r16-1_amd64.deb
 67afb17cd1b68bf17a7b6a6279e9d070015197af 11152 android-libbase-dev_6.0.1+r16-1_amd64.deb
 8d6f7d80235c713b0239d3fb10401b2bcca77fa5 10598 android-libbase_6.0.1+r16-1_amd64.deb
 9aaa7b49d4eff66cb80d3ab2366e67df728f37f1 45148 android-libcutils-dbgsym_6.0.1+r16-1_amd64.deb
 b7344d13e7f657fce43bc97bffb02042bf2dc51e 20106 android-libcutils-dev_6.0.1+r16-1_amd64.deb
 0309e873557636174bafd3b2de1ccda8c76bdf95 20456 android-libcutils_6.0.1+r16-1_amd64.deb
 b830d1fdc5782bd7e0d2c659bfd3519475499c76 33114 android-liblog-dbgsym_6.0.1+r16-1_amd64.deb
 d0c504cbf036f97b30cc72103f97e46917d62466 15992 android-liblog-dev_6.0.1+r16-1_amd64.deb
 691ca4839c82f43b7fee6bcf183b06206f144eac 16602 android-liblog_6.0.1+r16-1_amd64.deb
 b94cee97478c20a5821ea45e500a60cecfe4ec86 28688 android-libsparse-dbgsym_6.0.1+r16-1_amd64.deb
 0b964873d4479e5962bc36b4b926cf87deb4bd0f 7000 android-libsparse-dev_6.0.1+r16-1_amd64.deb
 f814c3a264a29ced82179694afea9b89321014d7 16292 android-libsparse_6.0.1+r16-1_amd64.deb
 2b6d64297a421872849f997e8bdfe77d6650b3db 222912 android-libutils-dbgsym_6.0.1+r16-1_amd64.deb
 ea7dda4482353f8dedfa64adbc62c8e2afa1528e 53612 android-libutils-dev_6.0.1+r16-1_amd64.deb
 f494f70fdfe491725555fedaf5f501a092a6b26d 51862 android-libutils_6.0.1+r16-1_amd64.deb
 66126ab29e480d4005af1fc0384a9e370b9995f2 45044 android-libziparchive-dbgsym_6.0.1+r16-1_amd64.deb
 bb3c79f845e9a4c6fb93b5aba25a6214a762cce6 6972 android-libziparchive-dev_6.0.1+r16-1_amd64.deb
 de52ec77b82a3926d02f4878829e0b76cc4472e5 12776 android-libziparchive_6.0.1+r16-1_amd64.deb
 392165c04824de234d40f7601bc096d31d96f8fd 27558 android-platform-system-core-headers_6.0.1+r16-1_all.deb
 d8bca7c8bbd88aa12696d6ce9af3e21087e71e41 48860 fastboot-dbgsym_6.0.1+r16-1_amd64.deb
 c21a49efce04c2dc7a72a7f86b3fb554341f3678 25088 fastboot_6.0.1+r16-1_amd64.deb
Checksums-Sha256:
 2efb92d46b550cb0a1c544e17c81b3a5f047ad9b1b16972a5eb48eb5fb5d5692 3752 android-platform-system-core_6.0.1+r16-1.dsc
 47557f3b0918266abde36d6297c4d158a5770638d1710d5ca36e9f628370d168 853224 android-platform-system-core_6.0.1+r16.orig.tar.xz
 6a29ec3791d039153fa68b49c97558090f85739c133a5e5ac191b6215c2e8d52 22848 android-platform-system-core_6.0.1+r16-1.debian.tar.xz
 48647bd7ff74b7037c673d1b822540d23505b8e5a32b4082feb5c576d42eb18e 157466 adb-dbgsym_6.0.1+r16-1_amd64.deb
 f2ba9ab9bec75e709fc2ea500bace4584188e84fbc43596245667e8798405005 45526 adb_6.0.1+r16-1_amd64.deb
 4bc8bc8a1b998424f441a0f0591e506b3f18b0ed31d117355f1a716ed37adf9e 323994 android-libadb-dbgsym_6.0.1+r16-1_amd64.deb
 c17d9856ce5bb79bb5e17925935907484acce26bb391340988bed798a0c6e6eb 13790 android-libadb-dev_6.0.1+r16-1_amd64.deb
 4c86bddf595b60864034fb6c7e21158186584aa5f0cd2916850859484644b7b4 55262 android-libadb_6.0.1+r16-1_amd64.deb
 e88db3141783a602c92cf9d66329461c2f2844f646ee3232b11972da66199b52 184152 android-libbacktrace-dbgsym_6.0.1+r16-1_amd64.deb
 8ea7780c4446b4df11ae6216a879e853a7a0aef634f7f6aba92f5112c4b4c89e 7040 android-libbacktrace-dev_6.0.1+r16-1_amd64.deb
 3988e24744f75f88b759bcf4a91647e78dae9c1c2c477fb007a749fc86dcd6dd 20618 android-libbacktrace_6.0.1+r16-1_amd64.deb
 e86a5ac82a2f799acf586a52c25914a35b2f9a577a5e63087402f9f804fe2250 63012 android-libbase-dbgsym_6.0.1+r16-1_amd64.deb
 86e0a15b021e33694a9454d80ff0ed64d227edd427a674f1ce177fdaea5c252a 11152 android-libbase-dev_6.0.1+r16-1_amd64.deb
 45e41bddeff0f49564a411ae99690d98fcb0a3836d544cd6357fa81082d5f5ee 10598 android-libbase_6.0.1+r16-1_amd64.deb
 168e9f85a384869c39d78b8cb24c957dae6336b61ae6b5c5cb9202c77c0b22b6 45148 android-libcutils-dbgsym_6.0.1+r16-1_amd64.deb
 0d09da240c268a4278c90ce3339249f2eb435e2afb3bf1ae18f0ff7c247be0c8 20106 android-libcutils-dev_6.0.1+r16-1_amd64.deb
 da7dc4148de026ff0f7b0a34d3fc5eb74bd8164cb1ad9a0f0fc1c509f0949d1c 20456 android-libcutils_6.0.1+r16-1_amd64.deb
 848d5780c89606c8b582b7290152b8016ca318cb31b2da28e7c6f4bc23abd88a 33114 android-liblog-dbgsym_6.0.1+r16-1_amd64.deb
 3a5d688e17f8b25eca13cb4b3dbdcab243a651b6b17f5414f4f3044c6d43a0bc 15992 android-liblog-dev_6.0.1+r16-1_amd64.deb
 fd8960ab410300ee492ec113dac38446b5779fd372ada74e571ebb3e310127f4 16602 android-liblog_6.0.1+r16-1_amd64.deb
 34d6785d1010214919e2e5ed7f944fd9f691d163627bc369f07af7b3b5d13d75 28688 android-libsparse-dbgsym_6.0.1+r16-1_amd64.deb
 a56bbecf44ebdd6c4321588f2757e40c4eac422ec112680a13c11d4113e99d4c 7000 android-libsparse-dev_6.0.1+r16-1_amd64.deb
 81548ef8440b92a679cf59e6c19b5e01fd743227b7cff6e8ebe5e52c5ae8effc 16292 android-libsparse_6.0.1+r16-1_amd64.deb
 68e2a05ea1d54a8cac6157d655674a5fc5c281e87bf991760859a6c474551a0d 222912 android-libutils-dbgsym_6.0.1+r16-1_amd64.deb
 e4de75f96e7465cbd490f14d1489a5565d62618b2b64cdcb7e7511ce7a7809fc 53612 android-libutils-dev_6.0.1+r16-1_amd64.deb
 72bdc0ede988884982ecfe46793699abde55bb2af714a04420ab146572057b16 51862 android-libutils_6.0.1+r16-1_amd64.deb
 4f3ec4e22f4d9e7670508723755f85dd1b5a4302e59abf0c6c2c19be2fb7ffc3 45044 android-libziparchive-dbgsym_6.0.1+r16-1_amd64.deb
 ce2560916bdb9997ad707a792745174de207171e09543337f54ce1790eb9173f 6972 android-libziparchive-dev_6.0.1+r16-1_amd64.deb
 5a8ce1445e115490f92b69bdbd0e8f6a31f1cd91949c85389f2a6262a46dc90e 12776 android-libziparchive_6.0.1+r16-1_amd64.deb
 e0b2c5aa708605a2c689ac8931fbd2770cef9a99cf807705d86cfdd8dcaa4706 27558 android-platform-system-core-headers_6.0.1+r16-1_all.deb
 286fabb57d77e1215b696cc0786fba745fd501c5e386b8f95fd2034b29cf1444 48860 fastboot-dbgsym_6.0.1+r16-1_amd64.deb
 53817dbaaf7548781633eaf65c464e9786fe46327038e52b0956ddd947aed82e 25088 fastboot_6.0.1+r16-1_amd64.deb
Files:
 098b1c49d1840b314f39ce36a881b91d 3752 devel optional android-platform-system-core_6.0.1+r16-1.dsc
 55b50d69c97c11d5fa4ea74b3f6b4e9e 853224 devel optional android-platform-system-core_6.0.1+r16.orig.tar.xz
 a7f01089ccc0385caa7bd375d1cb7a60 22848 devel optional android-platform-system-core_6.0.1+r16-1.debian.tar.xz
 1d0b2ba0feaf4c46536e71721385307c 157466 debug extra adb-dbgsym_6.0.1+r16-1_amd64.deb
 8cefd65c9530f358807b07d92e668e67 45526 devel optional adb_6.0.1+r16-1_amd64.deb
 14c33da297908cea7cee933dc8b279ba 323994 debug extra android-libadb-dbgsym_6.0.1+r16-1_amd64.deb
 ecaf127373a3d9806740dc17ac73bc7d 13790 libdevel optional android-libadb-dev_6.0.1+r16-1_amd64.deb
 6befab60665ba09c91a63ba1ade70500 55262 libs optional android-libadb_6.0.1+r16-1_amd64.deb
 8bda5d671522506edc41968fe86dee65 184152 debug extra android-libbacktrace-dbgsym_6.0.1+r16-1_amd64.deb
 c87cd3a5118ef18627fd44d56721c058 7040 libdevel optional android-libbacktrace-dev_6.0.1+r16-1_amd64.deb
 2002bf8375b8fbbdb70d9083c042c63d 20618 libs optional android-libbacktrace_6.0.1+r16-1_amd64.deb
 92672f2a5d7bb885dafff34d8467f138 63012 debug extra android-libbase-dbgsym_6.0.1+r16-1_amd64.deb
 97a635e6acc76725e5b881099947a6fc 11152 libdevel optional android-libbase-dev_6.0.1+r16-1_amd64.deb
 4f36ecb391304232e5a6e5672b8f01e0 10598 libs optional android-libbase_6.0.1+r16-1_amd64.deb
 ca3654706bcf864996b3d22c16003d60 45148 debug extra android-libcutils-dbgsym_6.0.1+r16-1_amd64.deb
 b9c380f2e779fad0498d9e6fad20d19f 20106 libdevel optional android-libcutils-dev_6.0.1+r16-1_amd64.deb
 e43d6801570c41bffbbac943962b527b 20456 libs optional android-libcutils_6.0.1+r16-1_amd64.deb
 70a7f10774a162296d13e00635a0c223 33114 debug extra android-liblog-dbgsym_6.0.1+r16-1_amd64.deb
 7802526700fa97ed081ea1681af0c260 15992 libdevel optional android-liblog-dev_6.0.1+r16-1_amd64.deb
 5468be666445e58b7c9f4bf9ed0faa20 16602 libs optional android-liblog_6.0.1+r16-1_amd64.deb
 82f2cbf2541143f67897cad4acaccd13 28688 debug extra android-libsparse-dbgsym_6.0.1+r16-1_amd64.deb
 9987190ddaa6d01ade43adada47db4ed 7000 libdevel optional android-libsparse-dev_6.0.1+r16-1_amd64.deb
 36d751680141679a3c4846cb6d2da5b0 16292 libs optional android-libsparse_6.0.1+r16-1_amd64.deb
 178d18407cd2d4a4aee9d2d90b272b97 222912 debug extra android-libutils-dbgsym_6.0.1+r16-1_amd64.deb
 ba72e636c27d9b140c5ec0571de21301 53612 libdevel optional android-libutils-dev_6.0.1+r16-1_amd64.deb
 941a6cbc45da3afd72433d0dacabc8ac 51862 libs optional android-libutils_6.0.1+r16-1_amd64.deb
 439de751dfadfdf81c033d371bd78c4d 45044 debug extra android-libziparchive-dbgsym_6.0.1+r16-1_amd64.deb
 9a64cb47a29925f6b667ecce6b55bd4f 6972 libdevel optional android-libziparchive-dev_6.0.1+r16-1_amd64.deb
 89f9f6e37ba87452332fc62e61f48e84 12776 libs optional android-libziparchive_6.0.1+r16-1_amd64.deb
 518be5f82e8a4c50a8432ade3ed4ea1f 27558 libdevel optional android-platform-system-core-headers_6.0.1+r16-1_all.deb
 ce7e7bc61697da0a251d9f684f8df3d0 48860 debug extra fastboot-dbgsym_6.0.1+r16-1_amd64.deb
 3718e677aa939b051e0554dbbac8c420 25088 devel optional fastboot_6.0.1+r16-1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPG for Android - https://guardianproject.info/code/gnupg/

iQEcBAEBCAAGBQJWxOagAAoJED4XeBe6G5v67y0H/0OF6trX1ciFLL/upsUGowWb
vD6dOPWUiFvfCxHXDow6kRmzpBVdEsJwbWrb+R4hPSEMLH9paNfXY4ywMvuVQdWt
EL+KDMTA4JLfWs0BMXjVXa9Ug9hoKxvjpxAUtXk7EjxTvXiVtSXbMhfXLCnHI/zt
kTP2FjqeHPKQ9f/7TWvm0OxOOl9AYu9KgpVDHV0QH/kkGgcsk5f/P/8V4Xp7m+2w
U2vqroequRP1geyy8kXRS3GxGu9gqAd9YqIKzhLHNuDR5uKqmlqEnb2FnhEqZLX9
4ND1Oy7uxN7SYjsaacFhRh4md23c6bZ877r831JFbZ3UQab27q/aFRMgncm2fDU=
=pX1q
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.