libpodofo: CVE-2017-6845

Debian Bug report logs - #861562
libpodofo: CVE-2017-6845

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Multiple security issues

Date: Thu, 02 Mar 2017 19:28:23 +0100

Source: libpodofo
Severity: grave
Tags: security

New podofo issues (no CVEs yet):

http://www.openwall.com/lists/oss-security/2017/03/02/10
http://www.openwall.com/lists/oss-security/2017/03/02/9
http://www.openwall.com/lists/oss-security/2017/03/02/8
http://www.openwall.com/lists/oss-security/2017/03/02/7
http://www.openwall.com/lists/oss-security/2017/03/02/6
http://www.openwall.com/lists/oss-security/2017/03/02/5
http://www.openwall.com/lists/oss-security/2017/03/02/4
http://www.openwall.com/lists/oss-security/2017/03/02/3
http://www.openwall.com/lists/oss-security/2017/03/02/2

Cheers,
        Moritz

Message #10 received at 856592@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 856592@bugs.debian.org

Subject: Re: Bug#856592: Multiple security issues

Date: Fri, 3 Mar 2017 06:43:03 +0100

Hello,

On Thu, Mar 02, 2017 at 07:28:23PM +0100, Moritz Muehlenhoff wrote:
> Source: libpodofo
> Severity: grave
> Tags: security
> 
> New podofo issues (no CVEs yet):
> 
> http://www.openwall.com/lists/oss-security/2017/03/02/10
> http://www.openwall.com/lists/oss-security/2017/03/02/9
> http://www.openwall.com/lists/oss-security/2017/03/02/8
> http://www.openwall.com/lists/oss-security/2017/03/02/7
> http://www.openwall.com/lists/oss-security/2017/03/02/6
> http://www.openwall.com/lists/oss-security/2017/03/02/5
> http://www.openwall.com/lists/oss-security/2017/03/02/4
> http://www.openwall.com/lists/oss-security/2017/03/02/3
> http://www.openwall.com/lists/oss-security/2017/03/02/2

And http://www.openwall.com/lists/oss-security/2017/03/02/1 in the
above list.

I'm not sure if Agostino Sarubbo has already requested CVEs (I hope
so). Otherwise it's not going to be easy to track those issues, apart
from opening individual bugs for each item.

Regards,
Salvatore

Message #13 received at 856592@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 856592@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#856592: Multiple security issues

Date: Fri, 3 Mar 2017 08:40:37 +0100

[Message part 1 (text/plain, inline)]

On Fri, Mar 03, 2017 at 06:43:03AM +0100, Salvatore Bonaccorso wrote:
> in the above list.

aheam, what a list.
Anyway, you (Moritz) opened this bug as RC, but is it fine to downgrade
to important if I deem the issues not grave enough to be RC?
They are all crashes, with maliciously crafted PDFs…

> I'm not sure if Agostino Sarubbo has already requested CVEs (I hope
> so).

I hope so too, if he read that email about the move to that web form.

> Otherwise it's not going to be easy to track those issues, apart
> from opening individual bugs for each item.

which I would have preferred anyway :)
I think I will clone+retitle this bug appropriately (and take care of
updating CVE/list if/when I'll do so).

-- 
regards,
                        Mattia Rizzolo

GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540      .''`.
more about me:  https://mapreri.org                             : :'  :
Launchpad user: https://launchpad.net/~mapreri                  `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia  `-

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 856592@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Mattia Rizzolo <mattia@debian.org>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 856592@bugs.debian.org

Subject: Re: Bug#856592: Multiple security issues

Date: Sun, 12 Mar 2017 22:07:32 +0100

On Fri, Mar 03, 2017 at 08:40:37AM +0100, Mattia Rizzolo wrote:
> On Fri, Mar 03, 2017 at 06:43:03AM +0100, Salvatore Bonaccorso wrote:
> > in the above list.
> 
> aheam, what a list.
> Anyway, you (Moritz) opened this bug as RC, but is it fine to downgrade
> to important if I deem the issues not grave enough to be RC?
> They are all crashes, with maliciously crafted PDFs…

Which is the most common attack vector on desktop systems...

If there's no upstream (or failing that, maintainer) activity in
fixing these security issues in the forthcoming months towards the
stretch release, stretch is better off without it.

Cheers,
        Moritz

Message #25 received at 856592@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 856592@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#856592: Multiple security issues

Date: Mon, 13 Mar 2017 12:21:24 +0100

Hi,

On Fri, Mar 03, 2017 at 06:43:03AM +0100, Salvatore Bonaccorso wrote:
> Hello,
> 
> On Thu, Mar 02, 2017 at 07:28:23PM +0100, Moritz Muehlenhoff wrote:
> > Source: libpodofo
> > Severity: grave
> > Tags: security
> > 
> > New podofo issues (no CVEs yet):
> > 
> > http://www.openwall.com/lists/oss-security/2017/03/02/10
> > http://www.openwall.com/lists/oss-security/2017/03/02/9
> > http://www.openwall.com/lists/oss-security/2017/03/02/8
> > http://www.openwall.com/lists/oss-security/2017/03/02/7
> > http://www.openwall.com/lists/oss-security/2017/03/02/6
> > http://www.openwall.com/lists/oss-security/2017/03/02/5
> > http://www.openwall.com/lists/oss-security/2017/03/02/4
> > http://www.openwall.com/lists/oss-security/2017/03/02/3
> > http://www.openwall.com/lists/oss-security/2017/03/02/2
> 
> And http://www.openwall.com/lists/oss-security/2017/03/02/1 in the
> above list.

FTR, for all of those CVEs have been assigned.

Regards,
Salvatore

Message #46 received at 861562-submitter@bugs.debian.org (full text, mbox, reply):

From: mattia@debian.org

To: 861562-submitter@bugs.debian.org

Subject: Bug #861562 in libpodofo marked as pending

Date: Sat, 24 Feb 2018 10:41:19 +0000

Control: tag -1 pending

Hello,

Bug #861562 in libpodofo reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below, and you can check the diff of the fix at:

https://salsa.debian.org/debian/libpodofo/commit/6a0cf8cd5d0fa4eed5d9829965d479bebf0b1bac

------------------------------------------------------------------------
Add upstream patch for CVE-2017-6845.

Closes: #861562
Signed-off-by: Mattia Rizzolo <mattia@debian.org>

------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

Message #53 received at 861562-close@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: 861562-close@bugs.debian.org

Subject: Bug#861562: fixed in libpodofo 0.9.5-9

Date: Sat, 24 Feb 2018 11:22:46 +0000

Source: libpodofo
Source-Version: 0.9.5-9

We believe that the bug you reported is fixed in the latest version of
libpodofo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 861562@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mattia Rizzolo <mattia@debian.org> (supplier of updated libpodofo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Feb 2018 11:38:43 +0100
Source: libpodofo
Binary: libpodofo-dev libpodofo-utils libpodofo0.9.5
Architecture: source
Version: 0.9.5-9
Distribution: unstable
Urgency: medium
Maintainer: Mattia Rizzolo <mattia@debian.org>
Changed-By: Mattia Rizzolo <mattia@debian.org>
Description:
 libpodofo-dev - PoDoFo development files
 libpodofo-utils - PoDoFo utilities
 libpodofo0.9.5 - PoDoFo - library to work with the PDF file format
Closes: 860995 861562 861597 889511
Changes:
 libpodofo (0.9.5-9) unstable; urgency=medium
 .
   * Add upstream patches for security issues:
     + CVE-2017-6845 Closes: #861562
     + CVE-2017-8054 Closes: #860995
     + CVE-2017-8378 Closes: #861597
     + CVE-2018-5295 Closes: #889511
     + CVE-2018-5308
   * d/control:
     + Move the packaging to salsa.debian.org.
     + Bump Standards-Version to 4.1.3, no changes needed.
     + Move libpodofo-utils to section utils.
   * d/rules: Move from the deprecated dh_install --fail-missing to dh_missing.
   * d/copyright: Bump copyright year for debian/*.
   * Bump debhelper compat level to 11.
Checksums-Sha1:
 22265a95e4d0632000785feba79a12ba39026a91 2126 libpodofo_0.9.5-9.dsc
 f56846ede8d87fceb1d0384fcb2a98b0b9f54057 19888 libpodofo_0.9.5-9.debian.tar.xz
 bb9b6965c6a64da60a9fef215b7adde0c551adea 8544 libpodofo_0.9.5-9_amd64.buildinfo
Checksums-Sha256:
 09f495d02231c98b2d95dcd6fe0f4d3aadc280fde10cb97e75efc8ca75fb6012 2126 libpodofo_0.9.5-9.dsc
 31536fd0e81bc910ce3378840646f54c69463e230161c575bb1eeb38175fafd6 19888 libpodofo_0.9.5-9.debian.tar.xz
 84be9aa7806fe40e11b5fa7457300ced1421eea668f227d2c22bab4c5ab184ce 8544 libpodofo_0.9.5-9_amd64.buildinfo
Files:
 eb706e4b75cf4c71e9164347ceab5329 2126 libdevel optional libpodofo_0.9.5-9.dsc
 1acf189b272bde337c5e53a8a1f098b6 19888 libdevel optional libpodofo_0.9.5-9.debian.tar.xz
 746639378cf7664488a6d1fad869a854 8544 libdevel optional libpodofo_0.9.5-9_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAlqRRZkACgkQCBa54Yx2
K60Djw/7B6Z8jdudjAFNY5yxQhm2urku6Lwbl1he1weOPLgdjbvnTMZhSociIhgV
GM4jGxqSacyA7v27p+jTl9UAXRU7uNamcq8QpKo15QB0zBu+HGVO+oyeZGREJHCM
Ph6PVpmFXrRyzhf5NKftzsi4abft0F9rUDtTaj4VJAJSBVuqyWjM6GLhcDsYCm3u
wUVsrqnP283+J44OfZbqWtVcSQimPwVN6DQ+5oxIRRyFiEFBkpjm+m0LpDFFhWP/
raqo+uBprDZd5X/9NQ4ZdNlyuKwSLC0gOhZtAlBUFgFE+MjZaYk1HQxRFvEKoS+P
ExV/vgBl/I0Au5XKixjM/YyzkXiPNAbPSio9hUXDEPmGJXI9qlBnv005VxtYFj4g
jzzudnNpuVNmsjFmPsjM3R4493k5JDKf7N8mqqpUBMWV4/9C8AbW5WGmTGLVBhdA
ONeP5kcjmetI5CqNNVDJKdpR60n0XhAjr8FxQW/UlXAq9XXcSkGIbM+4dmxiQPq/
ojLe7bCYGgPH0AgNZPVLA0NzBn7+fUh8vWVYUVUF2a+wQY8lyPSOPkmVULV4g+gu
H/4Eb3O39UxGTwzHq9V9KjRtXJVPfp+k9jAL5aLFmVwSghCgq2H+7su/8jT9uU/o
5xyRg+GBTgju/CID/MFYfXYjWb5m5XYtN5RhptXOXMB0+oEUd/8=
=ZRNu
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.