CVE-2013-0131: NVIDIA UNIX GPU Driver ARGB Cursor Buffer Overflow in "NoScanout" Mode.

Related Vulnerabilities: CVE-2013-0131  

Debian Bug report logs - #704547
CVE-2013-0131: NVIDIA UNIX GPU Driver ARGB Cursor Buffer Overflow in "NoScanout" Mode.

version graph

Reported by: Andreas Beckmann <anbe@debian.org>

Date: Tue, 2 Apr 2013 20:09:02 UTC

Severity: critical

Tags: security

Merged with 704567

Found in versions nvidia-graphics-drivers/313.18-1, nvidia-graphics-drivers/310.14-1, nvidia-graphics-drivers/195.36.24-1

Fixed in versions 310.44-1, nvidia-graphics-drivers/313.30-1, nvidia-graphics-drivers/304.88-1

Done: Andreas Beckmann <anbe@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian NVIDIA Maintainers <pkg-nvidia-devel@lists.alioth.debian.org>:
Bug#704547; Package nvidia-glx. (Tue, 02 Apr 2013 20:09:06 GMT) (full text, mbox, link).


Acknowledgement sent to Andreas Beckmann <anbe@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian NVIDIA Maintainers <pkg-nvidia-devel@lists.alioth.debian.org>. (Tue, 02 Apr 2013 20:09:06 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: CVE-2013-0131: NVIDIA UNIX GPU Driver ARGB Cursor Buffer Overflow in "NoScanout" Mode.
Date: Tue, 02 Apr 2013 22:06:05 +0200
Package: nvidia-glx
Version: 195.36.24-1
Severity: critical
Tags: security
Justification: root security hole

Quoting from

  http://nvidia.custhelp.com/app/answers/detail/a_id/3290

When the NVIDIA driver for the X Window System is operated in
"NoScanout" mode, and an X client installs an ARGB cursor that is larger
than the expected size (64x64 or 256x256, depending on the driver
version), the driver will overflow a buffer. This can cause a denial of
service (e.g., an X server segmentation fault), or could be exploited to
achieve arbitrary code execution. Because the X server runs as setuid
root in many configurations, an attacker could potentially use this
vulnerability in those configurations to gain root privileges.  To
install an ARGB cursor, an application would require a connection to a
running X server. Normally, X servers are configured to only accept
authenticated connections from the local host, but some X servers may be
configured to more permissively allow connections, and/or to allow
connections over a network. 

"NoScanout" mode is enabled implicitly on NVIDIA products which lack
display output connectors, and can be enabled explicitly on some other
configurations with the X configuration option:

Option "UseDisplayDevice" "none"

NVIDIA GPU drivers for OSes other than Linux, FreeBSD, VMware ESX, and
Solaris are not affected.

This vulnerability has been present since NVIDIA driver version 195.22.
The overflow is fixed in 304.88, 310.44, 313.30, and all drivers newer
than those versions.  NVIDIA recommends that users upgrade to a fixed
driver version, or disable NoScanout mode, where possible. 

This vulnerability was identified by NVIDIA. There are no known reports
of exploits of this vulnerability in the wild. 



Vulnerable versions in Debian:

 nvidia-graphics-drivers | 195.36.31-6squeeze2 | squeeze/non-free           | source
 nvidia-graphics-drivers | 295.59-1~bpo60+2    | squeeze-backports/non-free | source
 nvidia-graphics-drivers | 304.64-4            | wheezy/non-free            | source
 nvidia-graphics-drivers | 304.84-1            | sid/non-free               | source
 nvidia-graphics-drivers | 313.26-1            | experimental/non-free      | source

sid and experimental will be fixed by a new upstream versions to be
uploaded later today or tomorrow. No fix will be possible for squeeze
and squeeze-backports (as this is a closed source driver and these
"ancient" versions are no longer supported).


Andreas



Reply sent to Andreas Beckmann <anbe@debian.org>:
You have taken responsibility. (Tue, 02 Apr 2013 21:51:13 GMT) (full text, mbox, link).


Notification sent to Andreas Beckmann <anbe@debian.org>:
Bug acknowledged by developer. (Tue, 02 Apr 2013 21:51:13 GMT) (full text, mbox, link).


Message #10 received at 704547-close@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>
To: 704547-close@bugs.debian.org
Subject: Bug#704547: fixed in nvidia-graphics-drivers 304.88-1
Date: Tue, 02 Apr 2013 21:48:56 +0000
Source: nvidia-graphics-drivers
Source-Version: 304.88-1

We believe that the bug you reported is fixed in the latest version of
nvidia-graphics-drivers, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 704547@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Beckmann <anbe@debian.org> (supplier of updated nvidia-graphics-drivers package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 02 Apr 2013 22:43:31 +0200
Source: nvidia-graphics-drivers
Binary: nvidia-glx xserver-xorg-video-nvidia nvidia-glx-ia32 libgl1-nvidia-glx libxvmcnvidia1 libgl1-nvidia-glx-ia32 nvidia-alternative nvidia-kernel-dkms nvidia-kernel-source nvidia-vdpau-driver nvidia-vdpau-driver-ia32 nvidia-smi libcuda1 libcuda1-ia32 libnvidia-compiler libnvidia-compiler-ia32 libnvcuvid1 libnvidia-ml1 nvidia-opencl-common nvidia-opencl-icd nvidia-opencl-icd-ia32 nvidia-libopencl1 nvidia-libopencl1-ia32 libgl1-nvidia-alternatives libgl1-nvidia-alternatives-ia32 libglx-nvidia-alternatives nvidia-detect
Architecture: source amd64
Version: 304.88-1
Distribution: unstable
Urgency: low
Maintainer: Debian NVIDIA Maintainers <pkg-nvidia-devel@lists.alioth.debian.org>
Changed-By: Andreas Beckmann <anbe@debian.org>
Description: 
 libcuda1   - NVIDIA CUDA runtime library
 libcuda1-ia32 - please switch to multiarch libcuda1:i386
 libgl1-nvidia-alternatives - transition libGL.so* diversions to glx-alternative-nvidia
 libgl1-nvidia-alternatives-ia32 - simplifies replacing MESA libGL with GPU vendor libraries (32-bit
 libgl1-nvidia-glx - NVIDIA binary OpenGL libraries${nvidia:LegacyDesc}
 libgl1-nvidia-glx-ia32 - please switch to multiarch libgl1-nvidia${nvidia:Legacy}-glx:i386
 libglx-nvidia-alternatives - transition libgl.so diversions to glx-alternative-nvidia
 libnvcuvid1 - NVIDIA CUDA nvcuvid runtime library
 libnvidia-compiler - NVIDIA runtime compiler library
 libnvidia-compiler-ia32 - please switch to multiarch libnvidia-compiler:i386
 libnvidia-ml1 - NVIDIA management library (NVML) runtime library
 libxvmcnvidia1 - NVIDIA binary XvMC library${nvidia:LegacyDesc}
 nvidia-alternative - allows the selection of NVIDIA as GLX provider
 nvidia-detect - NVIDIA GPU detection utility
 nvidia-glx - NVIDIA metapackage${nvidia:LegacyDesc}
 nvidia-glx-ia32 - NVIDIA 32-bit libraries${nvidia:LegacyDesc} (transitional package
 nvidia-kernel-dkms - NVIDIA binary kernel module DKMS source${nvidia:LegacyDesc}
 nvidia-kernel-source - NVIDIA binary kernel module source${nvidia:LegacyDesc}
 nvidia-libopencl1 - NVIDIA OpenCL library
 nvidia-libopencl1-ia32 - please switch to multiarch nvidia-libopencl1:i386
 nvidia-opencl-common - NVIDIA OpenCL driver
 nvidia-opencl-icd - NVIDIA OpenCL ICD
 nvidia-opencl-icd-ia32 - please switch to multiarch nvidia-opencl-icd:i386
 nvidia-smi - NVIDIA System Management Interface
 nvidia-vdpau-driver - NVIDIA vdpau driver
 nvidia-vdpau-driver-ia32 - please switch to multiarch nvidia-vdpau-driver:i386
 xserver-xorg-video-nvidia - NVIDIA binary Xorg driver${nvidia:LegacyDesc}
Closes: 704547
Changes: 
 nvidia-graphics-drivers (304.88-1) unstable; urgency=low
 .
   * New upstream legacy 304xx branch release 304.88 (2013-04-02).
     - Fixed CVE-2013-0131: NVIDIA UNIX GPU Driver ARGB Cursor Buffer
       Overflow in "NoScanout" Mode.  This buffer overflow, which occurred
       when an X client installed a large ARGB cursor on an X server
       running in NoScanout mode, could cause a denial of service (e.g.,
       an X server segmentation fault), or could be exploited to achieve
       arbitrary code execution.  (Closes: #704547)
       For more details, see:
       http://nvidia.custhelp.com/app/answers/detail/a_id/3290
Checksums-Sha1: 
 c388a88a4f06b7e19be3f77b154416139dc19cd3 3965 nvidia-graphics-drivers_304.88-1.dsc
 f32c9463900a5a5a678aa21c6b534c7469ba7fbf 104500519 nvidia-graphics-drivers_304.88.orig.tar.gz
 9f58dbea81912c37796500088332e1a4b1c44d56 112492 nvidia-graphics-drivers_304.88-1.debian.tar.gz
 5dddcd9429289e07d6d42c039df6faf7617f0546 348002 nvidia-glx_304.88-1_amd64.deb
 1e2a416b1ba49dd25e153d4610cc3cba3d6b7d5f 2291004 xserver-xorg-video-nvidia_304.88-1_amd64.deb
 1e28fe875cbe6dc838892e7c2b86af829b562685 93580 nvidia-glx-ia32_304.88-1_amd64.deb
 d2172c68834d2126753b40239e80aa81eed29253 6563746 libgl1-nvidia-glx_304.88-1_amd64.deb
 5970a2b93155fecc40c249c7c24ba7ac3ad62d41 279378 libxvmcnvidia1_304.88-1_amd64.deb
 703383b29c0d363c4f09bd35bfba6c8dba584587 93834 libgl1-nvidia-glx-ia32_304.88-1_amd64.deb
 f62606ff2bd0668a4f6f32c4a5eb9d0c96ff7a6c 94382 nvidia-alternative_304.88-1_amd64.deb
 d0afa8299d4058a6f102afb4404fcdc018a86ecb 6907090 nvidia-kernel-dkms_304.88-1_amd64.deb
 6627fe7cef7f01ff10ba795523b429651aeac573 9064158 nvidia-kernel-source_304.88-1_amd64.deb
 c6e92b8caf5a46ddb4586bcc78f583c9b8aa5297 834620 nvidia-vdpau-driver_304.88-1_amd64.deb
 0a82f2e05ef12d9f803e005dfe6e8aae791031ec 93634 nvidia-vdpau-driver-ia32_304.88-1_amd64.deb
 bed9f2302a59c94bd18c331251b2007e042a131d 144798 nvidia-smi_304.88-1_amd64.deb
 a118e70562a8cfadb52f544461cb17f2e4828028 3274686 libcuda1_304.88-1_amd64.deb
 494d37a424cd10a42819496bd99c62d3389bd3e2 93598 libcuda1-ia32_304.88-1_amd64.deb
 0de9c21f50a207b6c223f89b9c0f5ec4a7cb7a4c 6979514 libnvidia-compiler_304.88-1_amd64.deb
 5cc3fd12e7900f41e0b19ff30e3f999fbc24f850 93148 libnvidia-compiler-ia32_304.88-1_amd64.deb
 8f784fff760d9318f0e72598245706568c5ac9ef 623170 libnvcuvid1_304.88-1_amd64.deb
 75d5de3c019885d463a514224c1dd9419295c923 215178 libnvidia-ml1_304.88-1_amd64.deb
 ceffb8712409a0be9897dfab7af52872f65a900c 93322 nvidia-opencl-common_304.88-1_amd64.deb
 6788ff45ea567f46010ffb247a3f7d982916cc42 2907618 nvidia-opencl-icd_304.88-1_amd64.deb
 6280bc1265099e3072c2327df44d073083950a16 93538 nvidia-opencl-icd-ia32_304.88-1_amd64.deb
 940c9d47408cd69bba8e5cf815f3d876467eb9b9 99930 nvidia-libopencl1_304.88-1_amd64.deb
 84dad3dcdb9e9d596cac5e448498cf02c61ecb44 93134 nvidia-libopencl1-ia32_304.88-1_amd64.deb
 08f71761de40bbf34007ee82fc6018e524cc115c 93526 libgl1-nvidia-alternatives_304.88-1_amd64.deb
 630f46d3bcb2bfb84215f9def05bc8cc49f9735d 95366 libgl1-nvidia-alternatives-ia32_304.88-1_amd64.deb
 b79413e980e52a7835e54db16d5c94b43cc29046 93480 libglx-nvidia-alternatives_304.88-1_amd64.deb
 911e3bbcc98a4484110ab61e85f6827be85fce01 95800 nvidia-detect_304.88-1_amd64.deb
Checksums-Sha256: 
 d50743560aa7882457fd1359f160f2f225c28e98d4a1d1c87d9af24f9ce94981 3965 nvidia-graphics-drivers_304.88-1.dsc
 126f7c9b937869260e5ce5a051b069b3efb74bff070f1a3f6c7914b06381eda8 104500519 nvidia-graphics-drivers_304.88.orig.tar.gz
 969c5ace9dadf74a753bd6fc861254ec681f4a9a2d8fd62e140bd0068da25edc 112492 nvidia-graphics-drivers_304.88-1.debian.tar.gz
 30b31fa9fc9442391e8236f5462c84dd66aa83635eacf61d24d6a50849db5642 348002 nvidia-glx_304.88-1_amd64.deb
 556e41e3a8d94073ef622b8423d0cb21c745fce0ca36604024aeebd5f7f19607 2291004 xserver-xorg-video-nvidia_304.88-1_amd64.deb
 ab645429d7e3ca3371b60be506fc27554a787619b245b80484012688542771c5 93580 nvidia-glx-ia32_304.88-1_amd64.deb
 b9d1cf4571c75ada02caa7de419a2a57b37e1961d3e6acf790e7b6d745dc251c 6563746 libgl1-nvidia-glx_304.88-1_amd64.deb
 568e4d7271dd69e63a235be531d5ae20a3f251f186ee70b3e9ca1c3428ae24ff 279378 libxvmcnvidia1_304.88-1_amd64.deb
 0fa5eb8735617d5da6eeb4e7af2c00c1ab5e01cca424efbddbb63fc7555e3e22 93834 libgl1-nvidia-glx-ia32_304.88-1_amd64.deb
 ad5fd1d6954ec8a9f185dd491e57fa815df671733e26d55e729917531c14b7c4 94382 nvidia-alternative_304.88-1_amd64.deb
 3901eef2cb27f4e0b590628dc134e6d866089569de90f73e9ce23d8881523ddd 6907090 nvidia-kernel-dkms_304.88-1_amd64.deb
 0795393c94db369c6a5a5f0501ce6e30ca43470805002f50074027a80c41d3fd 9064158 nvidia-kernel-source_304.88-1_amd64.deb
 d5ee0fca12fcd697f99625df02ebcfbbff9a148a6ed0177377329448da4b0fe0 834620 nvidia-vdpau-driver_304.88-1_amd64.deb
 06baa4e3693d15eb27009dfd474df0ef08640c2151a7edba2f24bf1a87c38a0d 93634 nvidia-vdpau-driver-ia32_304.88-1_amd64.deb
 4c9e32c45ca0061f42078669ebcb7ef8205e8b4411a0d40783981fac55c98984 144798 nvidia-smi_304.88-1_amd64.deb
 c588b7b0c150cf8cd3cdabd3a9f24b4358d0447ee444cd6d0c2aa8507690edfb 3274686 libcuda1_304.88-1_amd64.deb
 6b0e7b46b274cbc259937bff6c17e3780c49d596c6954949e7b6d19ce0f11172 93598 libcuda1-ia32_304.88-1_amd64.deb
 2332a29980bebf935dfffa6d00dec3ca846edeac528c19407c696736a9b66f1d 6979514 libnvidia-compiler_304.88-1_amd64.deb
 1016678ff53d1f5fe4c89da72e060dbb71789dff5f68776440d55a8284dc8711 93148 libnvidia-compiler-ia32_304.88-1_amd64.deb
 6f9d4bd39d3928e01c222d2a8ed012a89b0216ccbb70b5f4b4656e04da4354db 623170 libnvcuvid1_304.88-1_amd64.deb
 31b4f8a48edf94711a89a155cc9ad63eb04343d311ad958d8574c7ae20c9a78d 215178 libnvidia-ml1_304.88-1_amd64.deb
 a7d6738059f7fd79487a2921f16ef76753836449b93e8ae92ac003fe6921001a 93322 nvidia-opencl-common_304.88-1_amd64.deb
 34ce0725ee9871f9cfb5def7afd121e15d42f9cfefa6e37e6edd3d1ca694c42e 2907618 nvidia-opencl-icd_304.88-1_amd64.deb
 32dd6f8426a4cea1d3c41794a684042342f0970b306c00fa2254029973c01eae 93538 nvidia-opencl-icd-ia32_304.88-1_amd64.deb
 f8fe5c8b1317bf0f3268a687ae40541e84b176e286365f0cea91604d0430ce9c 99930 nvidia-libopencl1_304.88-1_amd64.deb
 26846dca4977d9e1872823415a127260b1c2c05a2edc84755ee50f18941032fc 93134 nvidia-libopencl1-ia32_304.88-1_amd64.deb
 bca2e445e462c3f9232b3ad9dd82337817b573ec3372c82ba885250ca1cce2ec 93526 libgl1-nvidia-alternatives_304.88-1_amd64.deb
 3bb3d89f9dff82aa78982ad59b5b7cc36113fbaad6f67780584a2d401fb76f70 95366 libgl1-nvidia-alternatives-ia32_304.88-1_amd64.deb
 9ffe7c2164e17768a561cbda747b5d5364d5798395394766f6fcfc56fded823d 93480 libglx-nvidia-alternatives_304.88-1_amd64.deb
 d704a937b12892faaec8020f8149a178d1bff91f354d6083e1d80016334b60ef 95800 nvidia-detect_304.88-1_amd64.deb
Files: 
 f9770a477e1d5ae32d7fe27a736fda4d 3965 non-free/libs optional nvidia-graphics-drivers_304.88-1.dsc
 0f934641044c3506157afa0a3ca16aeb 104500519 non-free/libs optional nvidia-graphics-drivers_304.88.orig.tar.gz
 09ae8e53031a5f54fb84f0d6de80581b 112492 non-free/libs optional nvidia-graphics-drivers_304.88-1.debian.tar.gz
 fe82cdada39c3eb683cdde424e8c64a4 348002 non-free/x11 optional nvidia-glx_304.88-1_amd64.deb
 45c19edbe2b86fb087a62ba0c2770a1d 2291004 non-free/x11 optional xserver-xorg-video-nvidia_304.88-1_amd64.deb
 9b5350bf4634069409b0a96190646a42 93580 non-free/oldlibs extra nvidia-glx-ia32_304.88-1_amd64.deb
 06bdd60105239fdd9822c0e2fa167e6b 6563746 non-free/libs optional libgl1-nvidia-glx_304.88-1_amd64.deb
 793671069906e08f29bedeb7c4336a76 279378 non-free/libs optional libxvmcnvidia1_304.88-1_amd64.deb
 ee215f52d13c063509a97d359dc4637b 93834 non-free/oldlibs extra libgl1-nvidia-glx-ia32_304.88-1_amd64.deb
 380890453d53289d4ca7b16f41f9400f 94382 non-free/libs optional nvidia-alternative_304.88-1_amd64.deb
 b3f68cd93266bafe11777f6622b96429 6907090 non-free/kernel optional nvidia-kernel-dkms_304.88-1_amd64.deb
 29cde06d6d6bcf9bc28c1d30bd1a3f66 9064158 non-free/kernel optional nvidia-kernel-source_304.88-1_amd64.deb
 21226a1d5a69f3d8681e727dd02b5555 834620 non-free/video optional nvidia-vdpau-driver_304.88-1_amd64.deb
 ec74730dd83475352729679312df5b9c 93634 non-free/oldlibs extra nvidia-vdpau-driver-ia32_304.88-1_amd64.deb
 b44a66cec0c957141cdc933170017b37 144798 non-free/utils optional nvidia-smi_304.88-1_amd64.deb
 ed418f95ea76f6e397df5ba8b66c5d68 3274686 non-free/libs optional libcuda1_304.88-1_amd64.deb
 53109e6c39fff3f74dbc5f2dec33db95 93598 non-free/oldlibs extra libcuda1-ia32_304.88-1_amd64.deb
 05fddaa7906f7f9660e348218484ff5f 6979514 non-free/libs optional libnvidia-compiler_304.88-1_amd64.deb
 eacee8e30d81988e0d67e298037960a5 93148 non-free/oldlibs extra libnvidia-compiler-ia32_304.88-1_amd64.deb
 1afb93e4e4521fd395d7f7e21b8bfa87 623170 non-free/libs optional libnvcuvid1_304.88-1_amd64.deb
 0ed0e565da2e40d08b893442045047be 215178 non-free/libs optional libnvidia-ml1_304.88-1_amd64.deb
 bcbb233e8318654f5cb85ad0b2d25f85 93322 non-free/libs optional nvidia-opencl-common_304.88-1_amd64.deb
 8d860a07643435e8f6a1e11549c4876f 2907618 non-free/libs optional nvidia-opencl-icd_304.88-1_amd64.deb
 e25095acfd1f7599e3a75dcd3a2f3199 93538 non-free/oldlibs extra nvidia-opencl-icd-ia32_304.88-1_amd64.deb
 04e0c7332cf184ea62d2abd91d7dfc2f 99930 non-free/libs optional nvidia-libopencl1_304.88-1_amd64.deb
 cec0453565c969bf7b5e43ae020e0fe1 93134 non-free/oldlibs extra nvidia-libopencl1-ia32_304.88-1_amd64.deb
 51649c2539cbc929d3386a128ec754ff 93526 non-free/oldlibs optional libgl1-nvidia-alternatives_304.88-1_amd64.deb
 123d2f4cbef055d1868e2ea1b9f3d498 95366 non-free/libs extra libgl1-nvidia-alternatives-ia32_304.88-1_amd64.deb
 9ca882c9aa77457887d1c3b2a73be4a6 93480 non-free/oldlibs optional libglx-nvidia-alternatives_304.88-1_amd64.deb
 76cbde048f6f20f77b23b4f4218adcdc 95800 non-free/x11 optional nvidia-detect_304.88-1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJRW0/MAAoJEF+zP5NZ6e0I6CAP/ipls7TIJeYN+3ROFNuwC1qx
ref/XH1YXCHTY2CfVKWfihYECS4wJawcY52rHVF4yCw0LBvl26jlYgVM+ZL+VNA4
T7kJEP6A/BA3pmgDOXpHCCOycmRhUme3AK6phMp6kOH/PCl+SuXivYSXCVJPFa8s
CS9L6lpoFTJ4a/YOIX+KNoVA6Jj9VcBaZpf5NT+iZD027PLQgXf9XsX0kHzNPiWR
Rsg/6PKqmJ04I6+Rtsx790BGlTnLG7uFIkSpkSOrO66Mh4VKRXl9crTgyO3/5xql
wNRcCmijsn2XEOveyu7AXKJRL12vdRC1ggyO7KvXggO9sXyHnlV5qicaMKHL09Ek
6CIMULggLaCl15KBaHW9lcwYoqbJdc5fTFXwF0en2N+RhfgX5kbxkL74PiofppFs
k8Dl2h4ouhfYyWx9fz/a6coE+Kci3vaIfebLQiiVBPygk6DRgD1EXcxXGh7swMCn
ls0MBOmTEQdXsFYCoZUUmtbdtgrdyYR9EbEcXRYbCnvlelMJvDVkZ2LnLLVKYOSw
2KD2SDa3KDnQFhxx4Ae4+E/hNTFSuloEMhkBzm1OaRn81MxNuFMFqTuTh0eLUEaD
FEyuDB/A2EWSBroZBd5k4AATa+El9v1cowAl+MnIZJJkT56/rP4uYAK45/R/m5vB
KPe2pZxI7F49kWSXc+ao
=EwEl
-----END PGP SIGNATURE-----




Merged 704547 704567 Request was from Vincent Cheng <vincentc1208@gmail.com> to control@bugs.debian.org. (Wed, 03 Apr 2013 02:12:16 GMT) (full text, mbox, link).


Marked as found in versions nvidia-graphics-drivers/310.14-1 and reopened. Request was from Andreas Beckmann <anbe@debian.org> to control@bugs.debian.org. (Fri, 05 Apr 2013 02:09:05 GMT) (full text, mbox, link).


Marked as fixed in versions 310.44-1. Request was from Andreas Beckmann <anbe@debian.org> to control@bugs.debian.org. (Fri, 05 Apr 2013 02:09:07 GMT) (full text, mbox, link).


Reply sent to Andreas Beckmann <anbe@debian.org>:
You have taken responsibility. (Fri, 05 Apr 2013 02:51:06 GMT) (full text, mbox, link).


Notification sent to Andreas Beckmann <anbe@debian.org>:
Bug acknowledged by developer. (Fri, 05 Apr 2013 02:51:06 GMT) (full text, mbox, link).


Message #21 received at 704547-close@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>
To: 704547-close@bugs.debian.org
Subject: Bug#704547: fixed in nvidia-graphics-drivers 313.30-1
Date: Fri, 05 Apr 2013 02:48:18 +0000
Source: nvidia-graphics-drivers
Source-Version: 313.30-1

We believe that the bug you reported is fixed in the latest version of
nvidia-graphics-drivers, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 704547@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Beckmann <anbe@debian.org> (supplier of updated nvidia-graphics-drivers package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 05 Apr 2013 03:57:30 +0200
Source: nvidia-graphics-drivers
Binary: nvidia-glx xserver-xorg-video-nvidia nvidia-glx-ia32 libgl1-nvidia-glx libgl1-nvidia-glx-ia32 nvidia-alternative nvidia-kernel-dkms nvidia-kernel-source nvidia-vdpau-driver nvidia-vdpau-driver-ia32 nvidia-smi nvidia-cuda-proxy libcuda1 libcuda1-ia32 libnvidia-compiler libnvidia-compiler-ia32 libnvcuvid1 libnvidia-encode1 libnvidia-ml1 nvidia-opencl-common nvidia-opencl-icd nvidia-opencl-icd-ia32 nvidia-libopencl1 nvidia-libopencl1-ia32 libgl1-nvidia-alternatives libgl1-nvidia-alternatives-ia32 libglx-nvidia-alternatives nvidia-detect
Architecture: source amd64
Version: 313.30-1
Distribution: experimental
Urgency: low
Maintainer: Debian NVIDIA Maintainers <pkg-nvidia-devel@lists.alioth.debian.org>
Changed-By: Andreas Beckmann <anbe@debian.org>
Description: 
 libcuda1   - NVIDIA CUDA runtime library
 libcuda1-ia32 - please switch to multiarch libcuda1:i386
 libgl1-nvidia-alternatives - transition libGL.so* diversions to glx-alternative-nvidia
 libgl1-nvidia-alternatives-ia32 - simplifies replacing MESA libGL with GPU vendor libraries (32-bit
 libgl1-nvidia-glx - NVIDIA binary OpenGL libraries${nvidia:LegacyDesc}
 libgl1-nvidia-glx-ia32 - please switch to multiarch libgl1-nvidia${nvidia:Legacy}-glx:i386
 libglx-nvidia-alternatives - transition libgl.so diversions to glx-alternative-nvidia
 libnvcuvid1 - NVIDIA CUDA nvcuvid runtime library
 libnvidia-compiler - NVIDIA runtime compiler library
 libnvidia-compiler-ia32 - please switch to multiarch libnvidia-compiler:i386
 libnvidia-encode1 - NVIDIA nvidia-encode runtime library
 libnvidia-ml1 - NVIDIA management library (NVML) runtime library
 nvidia-alternative - allows the selection of NVIDIA as GLX provider
 nvidia-cuda-proxy - NVIDIA CUDA Proxy
 nvidia-detect - NVIDIA GPU detection utility
 nvidia-glx - NVIDIA metapackage${nvidia:LegacyDesc}
 nvidia-glx-ia32 - NVIDIA 32-bit libraries${nvidia:LegacyDesc} (transitional package
 nvidia-kernel-dkms - NVIDIA binary kernel module DKMS source${nvidia:LegacyDesc}
 nvidia-kernel-source - NVIDIA binary kernel module source${nvidia:LegacyDesc}
 nvidia-libopencl1 - NVIDIA OpenCL library
 nvidia-libopencl1-ia32 - please switch to multiarch nvidia-libopencl1:i386
 nvidia-opencl-common - NVIDIA OpenCL driver
 nvidia-opencl-icd - NVIDIA OpenCL ICD
 nvidia-opencl-icd-ia32 - please switch to multiarch nvidia-opencl-icd:i386
 nvidia-smi - NVIDIA System Management Interface
 nvidia-vdpau-driver - NVIDIA vdpau driver
 nvidia-vdpau-driver-ia32 - please switch to multiarch nvidia-vdpau-driver:i386
 xserver-xorg-video-nvidia - NVIDIA binary Xorg driver${nvidia:LegacyDesc}
Closes: 704547
Changes: 
 nvidia-graphics-drivers (313.30-1) experimental; urgency=low
 .
   * New upstream short lived branch release 313.30 (2013-04-02).
     * Fixed CVE-2013-0131: NVIDIA UNIX GPU Driver ARGB Cursor Buffer
       Overflow in "NoScanout" Mode.  This buffer overflow, which occurred
       when an X client installed a large ARGB cursor on an X server
       running in NoScanout mode, could cause a denial of service (e.g.,
       an X server segmentation fault), or could be exploited to achieve
       arbitrary code execution.  (Closes: #704547)
       For more details, see:
       http://nvidia.custhelp.com/app/answers/detail/a_id/3290
   * Merge changes from 304.88-1 and 310.44 (UNRELEASED).
Checksums-Sha1: 
 6a919b2a4557baa2616bcc76780baaa7200e76b6 4027 nvidia-graphics-drivers_313.30-1.dsc
 777a6787ea8eafae98d8fd3092ea1a3f3d6e57cf 103861765 nvidia-graphics-drivers_313.30.orig.tar.gz
 d9b918c7ee6847374e3ca5b8feb7aaf36f083c2b 114120 nvidia-graphics-drivers_313.30-1.debian.tar.gz
 32dc2c131b94292aa2e704c240fc8e5b545c2068 345252 nvidia-glx_313.30-1_amd64.deb
 6009a4b7cc8a8d0b23294c36299634f158c8067d 2291028 xserver-xorg-video-nvidia_313.30-1_amd64.deb
 d6d813d7323d40ac8c00be6a85914cacb8990261 97416 nvidia-glx-ia32_313.30-1_amd64.deb
 acf4534f53b6232695829e87833c6acf5956c545 6524300 libgl1-nvidia-glx_313.30-1_amd64.deb
 96db34e711da481f64bd43cea682323da0011440 97662 libgl1-nvidia-glx-ia32_313.30-1_amd64.deb
 37b79ee09226b60ca99821cbd257a354397fe73b 98228 nvidia-alternative_313.30-1_amd64.deb
 ffddd258ec7d3adf02ac374b51d55f36bcbbf165 5913788 nvidia-kernel-dkms_313.30-1_amd64.deb
 8c064b91b899c434b0d5b21906bcc7ecd93a28ec 7764762 nvidia-kernel-source_313.30-1_amd64.deb
 7dba6f917bf1d2c277994d01aac2c379093a64bb 834954 nvidia-vdpau-driver_313.30-1_amd64.deb
 89ce4fe8117a14cb85f426b3b1a4e8ea3646954c 97460 nvidia-vdpau-driver-ia32_313.30-1_amd64.deb
 d3afad8726bd829a6a4811f3f5c4a8056c493d37 148360 nvidia-smi_313.30-1_amd64.deb
 10c7713e1e8c91b7d4f5314e136b239cd61c92c8 117258 nvidia-cuda-proxy_313.30-1_amd64.deb
 3fa80ddde1d72e5563676a5e5263c44363bbb681 3326688 libcuda1_313.30-1_amd64.deb
 8afe8a11d9a73284935a948f85a3c409e987ec41 97424 libcuda1-ia32_313.30-1_amd64.deb
 2e4f6001a4c3eba0d464d768639a4bc9a3f67902 6972426 libnvidia-compiler_313.30-1_amd64.deb
 39e0cfa91dac75f1a86997f0d677e5a1cb423552 96990 libnvidia-compiler-ia32_313.30-1_amd64.deb
 02400739266b917f2c834e2a80e9bc68b356181a 682866 libnvcuvid1_313.30-1_amd64.deb
 b9ca2a5bac7d94b070ecd4d6d1ca7dd09e2d743d 135536 libnvidia-encode1_313.30-1_amd64.deb
 0cebf4a1160f391567bc5196829b7f718398758b 218738 libnvidia-ml1_313.30-1_amd64.deb
 f817d2379c6e79f1d430e904c8f1165badc7f9b9 97194 nvidia-opencl-common_313.30-1_amd64.deb
 d91409097eb0f8b3fc7da58c00ee86b5f0cad72a 2894864 nvidia-opencl-icd_313.30-1_amd64.deb
 552ff9c88560119dab8b38cc9821719634a449a0 97362 nvidia-opencl-icd-ia32_313.30-1_amd64.deb
 8508265d9e67025e1e71e7dcb5603af40100f7f8 103838 nvidia-libopencl1_313.30-1_amd64.deb
 83121ddc461e86288a4e5d81933d02ebf2e16559 96974 nvidia-libopencl1-ia32_313.30-1_amd64.deb
 1352aeae553acd0447699871c60c34d913cb7dcf 97398 libgl1-nvidia-alternatives_313.30-1_amd64.deb
 151d6b545806117da69dfc33a8272b0b545401dc 99228 libgl1-nvidia-alternatives-ia32_313.30-1_amd64.deb
 7696294678d66e31242dcfe9e17d154e0500dd3f 97334 libglx-nvidia-alternatives_313.30-1_amd64.deb
 1f4851422be2a60e74751b54ebd44afdf66ff556 99810 nvidia-detect_313.30-1_amd64.deb
Checksums-Sha256: 
 eef3b645847e45e180150a3ff35346ec1505776e3170c300a5b71561254c029c 4027 nvidia-graphics-drivers_313.30-1.dsc
 88db6c8b40e0df2b8defb4db363c6a56e3bf93e18cf445d7937df060255238e2 103861765 nvidia-graphics-drivers_313.30.orig.tar.gz
 c8320df0bc2f81b84ad750f444b07c46151dc3970bca8954476ee60ac8e0c3c0 114120 nvidia-graphics-drivers_313.30-1.debian.tar.gz
 2a8732eba4c4d7a345954c16c1799c6ed6ab5b8e6a0e93431d274df6a4e43bc9 345252 nvidia-glx_313.30-1_amd64.deb
 ae4c55a45ed418673afd1ec89cc7994ca5bbf80bf0efa390ccc0da58f1370dcb 2291028 xserver-xorg-video-nvidia_313.30-1_amd64.deb
 960039f570b05995b5dad9727f5edf847bb3b363bcc471d387e063f8f98a7337 97416 nvidia-glx-ia32_313.30-1_amd64.deb
 dafefc9c99ccd06368eeb48adfc186b1e8b54905f6d3985fe5c6233256d168cd 6524300 libgl1-nvidia-glx_313.30-1_amd64.deb
 f4f03f4e6b6f20cd678c1bfe791c344d9d75b6a3dbe430e384e719961df51920 97662 libgl1-nvidia-glx-ia32_313.30-1_amd64.deb
 4e4c411046d125adae801f699d78473d32fc2ade1c7ba00d4f4a9656d778419f 98228 nvidia-alternative_313.30-1_amd64.deb
 29d645bffc95ceb4dea62a706113b87966b4afb32d54fdeab28e2b869f9fafce 5913788 nvidia-kernel-dkms_313.30-1_amd64.deb
 cd644ba5f9cb8681218bee9bdf8f77097c9f981600d62fc6f2a1c1c072581312 7764762 nvidia-kernel-source_313.30-1_amd64.deb
 29baf8aa5a4a84a329766418fd3ff5686b37ba160b4999da784288bb3a838a27 834954 nvidia-vdpau-driver_313.30-1_amd64.deb
 50a6f1e8aa09f6d7931a69ab408ed8ac023d8e004bc761867b0305b9f7436090 97460 nvidia-vdpau-driver-ia32_313.30-1_amd64.deb
 7ea9be03738ba9867b1c199e6611c1a73844b02bfea39ea725795306bced38f7 148360 nvidia-smi_313.30-1_amd64.deb
 04357c4e8440a56691c5b2795de7bc98bd2ebd3024040a549827fe68bc449fee 117258 nvidia-cuda-proxy_313.30-1_amd64.deb
 d6d0a1ee3e94020914a7046bad042e3e7143845618d2e8ad48ca3c1fbab772ce 3326688 libcuda1_313.30-1_amd64.deb
 642bbf4af6c06f8610f6487da962b543a11e172b53f615a48179fb4e9a86acad 97424 libcuda1-ia32_313.30-1_amd64.deb
 914f5b09d089cc5474c50f0ae02290932931bfdabb64e40e87fc22e7261377dd 6972426 libnvidia-compiler_313.30-1_amd64.deb
 fcd0f74e309fa6c313777968070fc9530db2aa6fe863e6d5c4a799cb1baa0a9d 96990 libnvidia-compiler-ia32_313.30-1_amd64.deb
 d1854561aae710ffd2b49c57f3fc4db6822b8fc5399294d7c62a93cb9e6e1f14 682866 libnvcuvid1_313.30-1_amd64.deb
 ddf80faaf6ccdb7db6886a0753954acb9d9048b4d92994150104d3465a9de444 135536 libnvidia-encode1_313.30-1_amd64.deb
 0dd225023323e8fb70f29fc7dcbf39319bee71a00014b3b8a1a2ba1442ec94dd 218738 libnvidia-ml1_313.30-1_amd64.deb
 2d484c7055b41f718dde8c60f2b58fa08b96ef4c6aab52128673ad7ba0c74de3 97194 nvidia-opencl-common_313.30-1_amd64.deb
 bc491d24e55029b09239daceb7050d204e970e1735eebf172186125f92f18749 2894864 nvidia-opencl-icd_313.30-1_amd64.deb
 cec886150e95b039298bfd0fc30c08f7a36dd19fac462631716a059b33ec1737 97362 nvidia-opencl-icd-ia32_313.30-1_amd64.deb
 45f33bfbb1cfc698fce55941d91f2e1e64be430a881f48bc2ab01cc1bbfc6c77 103838 nvidia-libopencl1_313.30-1_amd64.deb
 4198c471db23aa575f96e4e7ca09dae96cc0983926a6003588ca017251d9b570 96974 nvidia-libopencl1-ia32_313.30-1_amd64.deb
 ca4007fd29db071e8f97b5251c62bc00504c4acde0d38c38690a4d5a0e90b608 97398 libgl1-nvidia-alternatives_313.30-1_amd64.deb
 c8e77c89397d3ab1d2d54fe914e58acd12aca6bb2e56e03b5e2c4cdf0bb6da93 99228 libgl1-nvidia-alternatives-ia32_313.30-1_amd64.deb
 38bb51a74d6a622cddbf08e5823880d2bd9e630ca1b985f2ccf95efc2a3a49c3 97334 libglx-nvidia-alternatives_313.30-1_amd64.deb
 9862c24091453871106750c0c37b86ba80c0cda1b9ecead4023947aa87021736 99810 nvidia-detect_313.30-1_amd64.deb
Files: 
 47e925d859c9abc4df10c81b84e94772 4027 non-free/libs optional nvidia-graphics-drivers_313.30-1.dsc
 1998eaba17a260b69dbfc99191951ea4 103861765 non-free/libs optional nvidia-graphics-drivers_313.30.orig.tar.gz
 41f7a0bf59ba32f2f3e3ed71c79bbad9 114120 non-free/libs optional nvidia-graphics-drivers_313.30-1.debian.tar.gz
 28f36a38fb3f34703dd4b656642c2fb3 345252 non-free/x11 optional nvidia-glx_313.30-1_amd64.deb
 b44580983afebe7b460209ca296125e6 2291028 non-free/x11 optional xserver-xorg-video-nvidia_313.30-1_amd64.deb
 153a811bebc58af5f5f579b96acdedb0 97416 non-free/oldlibs extra nvidia-glx-ia32_313.30-1_amd64.deb
 4ac30af205e8a21de790d0b07e56a509 6524300 non-free/libs optional libgl1-nvidia-glx_313.30-1_amd64.deb
 d9981b210b1adba80130df751fd2a2d1 97662 non-free/oldlibs extra libgl1-nvidia-glx-ia32_313.30-1_amd64.deb
 9738f14a09b523a3b475c3475e5a88a2 98228 non-free/libs optional nvidia-alternative_313.30-1_amd64.deb
 983af55176ca87098f8ee35e3d8b82a7 5913788 non-free/kernel optional nvidia-kernel-dkms_313.30-1_amd64.deb
 18801ea93ac6439764c32a5fc8172b14 7764762 non-free/kernel optional nvidia-kernel-source_313.30-1_amd64.deb
 389ed56a03092f17d22b735fb38ddb29 834954 non-free/video optional nvidia-vdpau-driver_313.30-1_amd64.deb
 8e264f3ff040e11324650521feb72b3b 97460 non-free/oldlibs extra nvidia-vdpau-driver-ia32_313.30-1_amd64.deb
 93ac14a4d1212a6cfdd21e8c7c0a2572 148360 non-free/utils optional nvidia-smi_313.30-1_amd64.deb
 b7f51c3d022d8195b55fab98b426839f 117258 non-free/utils optional nvidia-cuda-proxy_313.30-1_amd64.deb
 7b1471e165da4786119b71022cdb9b9b 3326688 non-free/libs optional libcuda1_313.30-1_amd64.deb
 224f501368baa02ce68a147950f5c99e 97424 non-free/oldlibs extra libcuda1-ia32_313.30-1_amd64.deb
 be42c3b380fee6152580edea526f2931 6972426 non-free/libs optional libnvidia-compiler_313.30-1_amd64.deb
 3b374a8368f2b2c4a9d667ba63b2d202 96990 non-free/oldlibs extra libnvidia-compiler-ia32_313.30-1_amd64.deb
 be790bd29be898d63b836e9de1ed2ce5 682866 non-free/libs optional libnvcuvid1_313.30-1_amd64.deb
 b6d6246f1b9ca57ce358d00f36b89aef 135536 non-free/libs optional libnvidia-encode1_313.30-1_amd64.deb
 362c686985f441bb729f560e45c53fdb 218738 non-free/libs optional libnvidia-ml1_313.30-1_amd64.deb
 5e76bd3d4ad7587d0f6e15b38e131bd1 97194 non-free/libs optional nvidia-opencl-common_313.30-1_amd64.deb
 e3806cdef4cf941d29cdc53801dc055b 2894864 non-free/libs optional nvidia-opencl-icd_313.30-1_amd64.deb
 02aa71dc3bfadfe22606cb0975ae9417 97362 non-free/oldlibs extra nvidia-opencl-icd-ia32_313.30-1_amd64.deb
 db28dc81d824b2b9760d79c1dba602e5 103838 non-free/libs optional nvidia-libopencl1_313.30-1_amd64.deb
 64c86aa9362d0db0f3e8cff178dc4560 96974 non-free/oldlibs extra nvidia-libopencl1-ia32_313.30-1_amd64.deb
 efdfe1c77f42cd2b1b9605c2733aa589 97398 non-free/oldlibs optional libgl1-nvidia-alternatives_313.30-1_amd64.deb
 630fd698c03117fc9f80a8c6b05e1e01 99228 non-free/libs extra libgl1-nvidia-alternatives-ia32_313.30-1_amd64.deb
 f8a6575bec37a3c85807db80eda2f000 97334 non-free/oldlibs optional libglx-nvidia-alternatives_313.30-1_amd64.deb
 7fb73582da88dd12905aacd1b8e47452 99810 non-free/x11 optional nvidia-detect_313.30-1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJRXjDrAAoJEF+zP5NZ6e0I9ToQAKMZwARtVL8M99pkK+gp5EVu
+065iJoZpXVuXII2qwI/Chy/BzIAFldploFOTZlqQIKSSDyQEhTQGq7AedzRbE/l
5b3MRLFNAQ6QXTrj6Os4Bx2iJ097Qpqao70w3ed8/hnkdJYrViBfJh5rX4KUT/cL
JK3CFQcgXvglrNL9yzSRLhrlTI1fe90FSrHCAaPzS6N7VTrF/NcAqEyxEzSB5S7A
jWtdKTro3xmkgoQ4AcVSCTJZrbSIxy1FPZ0F+XGO/RLK+gDrxbPfnB9lBA6A2Hvr
fci6Mw6UaB3kB5fttzjgZvnq5g4DXf2TOBrRrfmpn9PWq4ldKW/bvA4VJRXC+oED
UPURtj79Yqkvs0DjOM8cnwrD2MnTSLRFjm2tiN2yzJcNt13tqO/wu2dXgp4EcTLX
G2VxKn7cNJOwWRm2AEQyTfA21BW4cl86C3AkDc4/8dhz3iHDrq++id00xRWHETAT
m2w299d9+p3aH/GHERUp4EOf4bi54UJr9zd4hbI4EEHgKyrMWDe/g93maY3Q7liA
KUukpBGq0NhjGwWMnElky4LYt6Me/ECKnV6uhbm15TDhyqs80r1nyiJZBNhxgboH
Ks/U02qAe9fF51++LPPk9tK14UqxuKryTj58ZCDGdQ7gDdSURZWicYz0QizxnDgx
4X6mXMrVMY8zRrHBFXsd
=JJ31
-----END PGP SIGNATURE-----




Reply sent to Andreas Beckmann <anbe@debian.org>:
You have taken responsibility. (Fri, 05 Apr 2013 02:51:07 GMT) (full text, mbox, link).


Notification sent to Wolfgang Walter <wolfgang.walter@stwm.de>:
Bug acknowledged by developer. (Fri, 05 Apr 2013 02:51:07 GMT) (full text, mbox, link).


Marked as found in versions nvidia-graphics-drivers/313.18-1. Request was from Andreas Beckmann <anbe@debian.org> to control@bugs.debian.org. (Fri, 05 Apr 2013 11:24:04 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 30 Jun 2013 07:28:29 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 13:27:26 2019; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.