xscreensaver: CVE-2015-8025: crash when hot-swapping monitors while locked

Debian Bug report logs - #802914
xscreensaver: CVE-2015-8025: crash when hot-swapping monitors while locked

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <mgilbert@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: xscreensaver: upstream 5.34 fixes crash

Date: Sat, 24 Oct 2015 23:59:38 -0400

package: xscreensaver
severity: important
tags: security

A new upstream version is out that fixes a crash while swapping
monitors, which has security implications.

Best wishes,
Mike

Message #14 received at 802914@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Michael Gilbert <mgilbert@debian.org>, 802914@bugs.debian.org

Subject: Re: Bug#802914: xscreensaver: upstream 5.34 fixes crash

Date: Sun, 25 Oct 2015 07:41:11 +0100

Hi,

On Sat, Oct 24, 2015 at 11:59:38PM -0400, Michael Gilbert wrote:
> package: xscreensaver
> severity: important
> tags: security
> 
> A new upstream version is out that fixes a crash while swapping
> monitors, which has security implications.

FTR, a CVE has been requested
http://www.openwall.com/lists/oss-security/2015/10/24/2 .

Fedora packaging as well contains the extracted patch, see
https://security-tracker.debian.org/802914 for details.

Regards,
Salvatore

Message #19 received at 802914@bugs.debian.org (full text, mbox, reply):

From: Tormod Volden <debian.tormod@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 802914@bugs.debian.org

Cc: Michael Gilbert <mgilbert@debian.org>

Subject: Re: Bug#802914: xscreensaver: upstream 5.34 fixes crash

Date: Sun, 25 Oct 2015 08:41:28 +0100

On Sun, Oct 25, 2015 at 7:41 AM, Salvatore Bonaccorso <carnil@debian.org> wrote:
> On Sat, Oct 24, 2015 at 11:59:38PM -0400, Michael Gilbert wrote:
>> A new upstream version is out that fixes a crash while swapping
>> monitors, which has security implications.

Thanks for the report, guys. I will package the new upstream version
immediately.

Regards,
Tormod

Message #26 received at 802914@bugs.debian.org (full text, mbox, reply):

From: Tormod Volden <debian.tormod@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 802914@bugs.debian.org

Cc: Michael Gilbert <mgilbert@debian.org>

Subject: Re: Bug#802914: xscreensaver: upstream 5.34 fixes crash

Date: Sun, 25 Oct 2015 12:03:14 +0100

[Message part 1 (text/plain, inline)]

On Sun, Oct 25, 2015 at 7:41 AM, Salvatore Bonaccorso wrote:
> On Sat, Oct 24, 2015 at 11:59:38PM -0400, Michael Gilbert wrote:
>> A new upstream version is out that fixes a crash while swapping
>> monitors, which has security implications.

Here is also a debdiff for stable (jessie-security)

[xscreensaver_5.30-1+deb8u1.debdiff (application/octet-stream, attachment)]

Message #33 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: Tormod Volden <debian.tormod@gmail.com>

To: 802914-close@bugs.debian.org

Subject: Bug#802914: fixed in xscreensaver 5.34-1

Date: Mon, 26 Oct 2015 03:25:42 +0000

Source: xscreensaver
Source-Version: 5.34-1

We believe that the bug you reported is fixed in the latest version of
xscreensaver, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802914@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tormod Volden <debian.tormod@gmail.com> (supplier of updated xscreensaver package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 25 Oct 2015 09:31:21 +0100
Source: xscreensaver
Binary: xscreensaver xscreensaver-data xscreensaver-data-extra xscreensaver-gl xscreensaver-gl-extra xscreensaver-screensaver-webcollage xscreensaver-screensaver-bsod
Architecture: source armhf
Version: 5.34-1
Distribution: unstable
Urgency: medium
Maintainer: Tormod Volden <debian.tormod@gmail.com>
Changed-By: Tormod Volden <debian.tormod@gmail.com>
Description:
 xscreensaver - Screensaver daemon and frontend for X11
 xscreensaver-data - Screen saver modules for screensaver frontends
 xscreensaver-data-extra - Extra screen saver modules for screensaver frontends
 xscreensaver-gl - GL(Mesa) screen saver modules for screensaver frontends
 xscreensaver-gl-extra - Extra GL(Mesa) screen saver modules for screensaver frontends
 xscreensaver-screensaver-bsod - BSOD screen saver module from XScreenSaver
 xscreensaver-screensaver-webcollage - Webcollage screen saver module from XScreenSaver
Closes: 802914
Changes:
 xscreensaver (5.34-1) unstable; urgency=medium
 .
   * New upstream release 5.34
     - Fixed a crash when hot-swapping monitors while locked.
       (Closes: #802914)
     - Fixed some incorrect output from xscreensaver-command -watch.
Checksums-Sha1:
 2052edff572aeed1f257773fa7b62e19b2f74e92 2736 xscreensaver_5.34-1.dsc
 a6d9a391981730cedcd51e75c35ffb4101928cc2 10788657 xscreensaver_5.34.orig.tar.gz
 8948031a0ed905a9be8baf6ff02c2af2c7c532e0 79551 xscreensaver_5.34-1.diff.gz
 051d09e2f6436ae77ed96752db1774b1bc2d1a1c 909600 xscreensaver-data-extra_5.34-1_armhf.deb
 3993700a38859c3dad69be1ee654c4e42d2cd949 281960 xscreensaver-data_5.34-1_armhf.deb
 fd68fb22a6b313fa1760c38120d7a446e9b0158d 1761316 xscreensaver-gl-extra_5.34-1_armhf.deb
 c987554094c617397ea98e3c4ddcc054b64555a1 1057842 xscreensaver-gl_5.34-1_armhf.deb
 9414c678c94c1e791bb3941206c922ef639f6447 158408 xscreensaver-screensaver-bsod_5.34-1_armhf.deb
 849e247ea42a5f0949eb31c20ab2f43377a6755b 62578 xscreensaver-screensaver-webcollage_5.34-1_armhf.deb
 ee13a3860ed1b69e3998c49a29cdd2b2a35f9709 541062 xscreensaver_5.34-1_armhf.deb
Checksums-Sha256:
 3c66b2befff48036f25a7b3a9b84e30204f82b25d1503afe829390f74ebcaf08 2736 xscreensaver_5.34-1.dsc
 6fff7ec4be743e5c042647ea9687dd0cdf48d1dd5e8e15098e5018bbd02e5e27 10788657 xscreensaver_5.34.orig.tar.gz
 20999f420020638a925e9708dfd946d35ae2eec133f744e81ff7303d11a29e77 79551 xscreensaver_5.34-1.diff.gz
 4a5a440264da0cb8d8cda45e7023f1772c8f2444199a2b24a2855ee2c85f887d 909600 xscreensaver-data-extra_5.34-1_armhf.deb
 b326e7754452e281eec9a46042435a7773d86de4c1730e26d5691b2cf40e23ae 281960 xscreensaver-data_5.34-1_armhf.deb
 0e17c15fc71c01d9bfb01c1266610bb39f0f7086f41ed12b998fdf17d18891be 1761316 xscreensaver-gl-extra_5.34-1_armhf.deb
 315de11668863ef9d6ab105d17200d8ebdb97d86076674afca1f05fba839f7ae 1057842 xscreensaver-gl_5.34-1_armhf.deb
 2ed70309bb421b544aab981d509e736e57ca4634a1b6f1bf581b3c4a1beb90c0 158408 xscreensaver-screensaver-bsod_5.34-1_armhf.deb
 50fda2f2e4db28e7d9edd9e97a55335fe45f6dbbffc4ad29492f953776b7a0c3 62578 xscreensaver-screensaver-webcollage_5.34-1_armhf.deb
 304fa7fe470e7736fec568e6faee598a59758ba46503b7ee68d189f1dff6a7d9 541062 xscreensaver_5.34-1_armhf.deb
Files:
 84a9b62be019716d959ee35e884aaa9f 2736 x11 optional xscreensaver_5.34-1.dsc
 b71f7d652ec7c28473d3526b234a3168 10788657 x11 optional xscreensaver_5.34.orig.tar.gz
 340081ec81b7b8c76059f70662754c89 79551 x11 optional xscreensaver_5.34-1.diff.gz
 5f75a493bfef16d0982d365fe89449e8 909600 x11 optional xscreensaver-data-extra_5.34-1_armhf.deb
 9fc1ecd45848c94840bbb7f39da34ce7 281960 x11 optional xscreensaver-data_5.34-1_armhf.deb
 44465336c561929ae6a870c4ee7c40d2 1761316 x11 optional xscreensaver-gl-extra_5.34-1_armhf.deb
 59cadbcc84433af9ed0d52a3f4c291eb 1057842 x11 optional xscreensaver-gl_5.34-1_armhf.deb
 d7ac3186983b10a1a7ebff5c48f71bb7 158408 x11 optional xscreensaver-screensaver-bsod_5.34-1_armhf.deb
 d70684d4ddb4d2fed8f0b9215f69a873 62578 x11 optional xscreensaver-screensaver-webcollage_5.34-1_armhf.deb
 d4fc0e0a7b4a8f79e46cd5f6104b3c8f 541062 x11 optional xscreensaver_5.34-1_armhf.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJWLYY8AAoJEPAe+gXRgGsPtmYP/jTQzRFiDr3Zx64JhuGEa+Xq
k17OgijnKlw1LlsYGWNffpsWpHmpAnpaap3fQerCTcrUtOsZOywHbVa0ZhmuzJay
uceFYfVICPBLh8771a5f+ilEaS2iB+s/gwT39RMt+Upq6QlXQZZTSMmbzC5FPIfb
3wsJjAvh8EAsxiwKRFTo4bFteVrqvP+vJv01SU92riuyrZTu4W7CDpXVORVvqvGZ
l+ZRLS8M164aVoV0RlTZuuYbTOi2KJarXEWHsm1FZuIhL3jMuMd27mnt5cy4EPk3
ylPl+Jv/Oyam3gUKo/sodh4UYRANJWLG0WN38S3yHx+pEdzNO4kH5QXauLuSPgA7
d5H8i6s9KZKUl6b234acdIOIOUeVF/uzVXjnLxaK/7n3TwcL2AOF/qSLK0YTqbUp
xSt4QCH2Cgz2WBFmjnNrqrwIx4haKmOYHUuF+cHJEgq7P0PXVl/dTRLOHrt1dhkT
vIxSe+5/EfNnFyZJKXOC3ZEtJQpnBPfZ6I0R+eUnV/f4hItAif1PiqCvZUcGnq9Z
cZ7PhPc4rex077drdKtntpM/qiWt+Zo+DpgEgco0xbUuxT1KwFw1jdj4M5y4ILxk
06KwXOrhlrRuhivm1dq8fVvr825YrbwG2AjqcjGdyrKvldgB2UcslnNMc0Hd85pv
PInJXFI/ZMaRxua5kjF1
=+p2y
-----END PGP SIGNATURE-----

Message #42 received at 802914@bugs.debian.org (full text, mbox, reply):

From: Tormod Volden <debian.tormod@gmail.com>

To: Michael Gilbert <mgilbert@debian.org>, Salvatore Bonaccorso <carnil@debian.org>

Cc: 802914@bugs.debian.org

Subject: Re: Bug#802914: xscreensaver: upstream 5.34 fixes crash

Date: Fri, 30 Oct 2015 18:45:44 +0100

[Message part 1 (text/plain, inline)]

On Sun, Oct 25, 2015 at 12:03 PM, Tormod Volden wrote:
> On Sun, Oct 25, 2015 at 7:41 AM, Salvatore Bonaccorso wrote:
>> On Sat, Oct 24, 2015 at 11:59:38PM -0400, Michael Gilbert wrote:
>>> A new upstream version is out that fixes a crash while swapping
>>> monitors, which has security implications.
>
> Here is also a debdiff for stable (jessie-security)

I have updated the patch with the now assigned CVE reference. AFAICS
it still hasn't been uploaded?

For this bug report, updated link, the one above is broken now.
https://security-tracker.debian.org/tracker/CVE-2015-8025

Tormod

[xscreensaver_5.30-1+deb8u1.debdiff (application/octet-stream, attachment)]

Message #49 received at 802914@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Tormod Volden <debian.tormod@gmail.com>, 802914@bugs.debian.org

Cc: Michael Gilbert <mgilbert@debian.org>

Subject: Re: Bug#802914: xscreensaver: upstream 5.34 fixes crash

Date: Sat, 31 Oct 2015 15:12:08 +0100

Hi Tormod,

On Fri, Oct 30, 2015 at 06:45:44PM +0100, Tormod Volden wrote:
> On Sun, Oct 25, 2015 at 12:03 PM, Tormod Volden wrote:
> > On Sun, Oct 25, 2015 at 7:41 AM, Salvatore Bonaccorso wrote:
> >> On Sat, Oct 24, 2015 at 11:59:38PM -0400, Michael Gilbert wrote:
> >>> A new upstream version is out that fixes a crash while swapping
> >>> monitors, which has security implications.
> >
> > Here is also a debdiff for stable (jessie-security)
> 
> I have updated the patch with the now assigned CVE reference. AFAICS
> it still hasn't been uploaded?

No not yet. We have it though on our todo list here:

https://anonscm.debian.org/viewvc/secure-testing/data/dsa-needed.txt?view=markup

Regards,
Salvatore

Message #54 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 802914-close@bugs.debian.org

Subject: Bug#802914: fixed in xscreensaver 5.11-1+deb6u11

Date: Sat, 31 Oct 2015 19:49:12 +0000

Source: xscreensaver
Source-Version: 5.11-1+deb6u11

We believe that the bug you reported is fixed in the latest version of
xscreensaver, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802914@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated xscreensaver package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 31 Oct 2015 19:28:04 +0000
Source: xscreensaver
Binary: xscreensaver xscreensaver-data xscreensaver-data-extra xscreensaver-gl xscreensaver-gl-extra xscreensaver-screensaver-webcollage xscreensaver-screensaver-bsod
Architecture: source amd64
Version: 5.11-1+deb6u11
Distribution: squeeze-lts
Urgency: high
Maintainer: Jose Luis Rivas <ghostbar@debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Description: 
 xscreensaver - Automatic screensaver for X
 xscreensaver-data - data files to be shared among screensaver frontends
 xscreensaver-data-extra - data files to be shared among screensaver frontends
 xscreensaver-gl - GL(Mesa) screen hacks for xscreensaver
 xscreensaver-gl-extra - GL(Mesa) screen hacks for xscreensaver
 xscreensaver-screensaver-bsod - BSOD hack from XScreenSaver
 xscreensaver-screensaver-webcollage - Webcollage hack from XScreenSaver
Closes: 802914
Changes: 
 xscreensaver (5.11-1+deb6u11) squeeze-lts; urgency=high
 .
   * CVE-2015-8025: Fix crash when hot-swapping monitors while locked.
     (Closes: #802914)
Checksums-Sha1: 
 43e39ebb2f92a614987a14c4d17d52c2b4c3aaec 2446 xscreensaver_5.11-1+deb6u11.dsc
 b31f33def5659826750a6a5369f573989798747c 75578 xscreensaver_5.11-1+deb6u11.diff.gz
 770528fb02ef83c59c16f74b8460256fb91c5dd9 748612 xscreensaver_5.11-1+deb6u11_amd64.deb
 ff64d726974eb955b07eff65bbc5d1d47877ff93 543616 xscreensaver-data_5.11-1+deb6u11_amd64.deb
 fc17c35f7b44a2722cd6a8bf21fd29cc74457514 2693438 xscreensaver-data-extra_5.11-1+deb6u11_amd64.deb
 01aa1022f31934d9aa4e8973bbf05287e2b05b91 2198962 xscreensaver-gl_5.11-1+deb6u11_amd64.deb
 41732405df80545cc5fd69fc67bf74d442992c9f 2291932 xscreensaver-gl-extra_5.11-1+deb6u11_amd64.deb
 35414c9eea0c5be53863851c1a836eead00adf87 64022 xscreensaver-screensaver-webcollage_5.11-1+deb6u11_amd64.deb
 33b09484f0baa78a0ddf10d869a99f0ee6d3bb47 168210 xscreensaver-screensaver-bsod_5.11-1+deb6u11_amd64.deb
Checksums-Sha256: 
 12478d6e6ea7af272ba462f68061aec6bf0a9f07f4baa0d4a17c8a90bafc72ac 2446 xscreensaver_5.11-1+deb6u11.dsc
 67b4b266fe8f6afd3f1509916ae457aead021c02109ef3e0affab0844bd799c3 75578 xscreensaver_5.11-1+deb6u11.diff.gz
 92371ef4879efaa46c51390d761a74b638bffe87acddcb22cbfa07cb98b924d0 748612 xscreensaver_5.11-1+deb6u11_amd64.deb
 5eda7552f748696502b3afd34bc6e848baac30baaa65fa2570715665b4d36afc 543616 xscreensaver-data_5.11-1+deb6u11_amd64.deb
 dc0ffee182733279fa9b5230d5191564b981249a96346fdff21962cf63ad3bb6 2693438 xscreensaver-data-extra_5.11-1+deb6u11_amd64.deb
 237b90ad0ee2bad5260d20e32182cb61747e292b46c21f5d6d4b8180d4d9faf8 2198962 xscreensaver-gl_5.11-1+deb6u11_amd64.deb
 a5982492f0dd0318e50be4e6541031a46da6a6772949348070aa9d2e5444ce2c 2291932 xscreensaver-gl-extra_5.11-1+deb6u11_amd64.deb
 e07ebaef8b19b569fb98bf283c9bc6bb3c91e0de9bb902d7c6d111608ee4d87b 64022 xscreensaver-screensaver-webcollage_5.11-1+deb6u11_amd64.deb
 976fe29ca7809502a2b61a559d67e70847c5e5ad0fc920ce4404d60771ff06e4 168210 xscreensaver-screensaver-bsod_5.11-1+deb6u11_amd64.deb
Files: 
 c4efc83355c14d64824b71f995c2ccc7 2446 x11 optional xscreensaver_5.11-1+deb6u11.dsc
 7ff847e3b406118a99db0ce3424ff2c8 75578 x11 optional xscreensaver_5.11-1+deb6u11.diff.gz
 82b154afc893b0c1679085eadc555117 748612 x11 optional xscreensaver_5.11-1+deb6u11_amd64.deb
 a39957fa87302d7a0d981dcca6acfb6a 543616 x11 optional xscreensaver-data_5.11-1+deb6u11_amd64.deb
 8749fe51aa465be9a8af8c72d1eec1ca 2693438 x11 optional xscreensaver-data-extra_5.11-1+deb6u11_amd64.deb
 d90373ea4c46a8da68d733aefb9c40ab 2198962 x11 optional xscreensaver-gl_5.11-1+deb6u11_amd64.deb
 b77debf564df6a2e993c8a45ad4f0027 2291932 x11 optional xscreensaver-gl-extra_5.11-1+deb6u11_amd64.deb
 720b675476ab8d88b93057f1cc9b3349 64022 x11 optional xscreensaver-screensaver-webcollage_5.11-1+deb6u11_amd64.deb
 ae421608cf93384d79a6fb25d0b45ca4 168210 x11 optional xscreensaver-screensaver-bsod_5.11-1+deb6u11_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWNRf+AAoJEB6VPifUMR5YsxIP/AsbKmVjAKZbpvye1l8578RS
OmvNq7w8z99/5J9FCDXhGV2eg1Sp6gavn0u2/CB2WTM1Pr3tV1ZLf3T9c+R7XrJA
DivTse3yLVj0/cIydgECVGhZzsGC/sj+wWQNpu76qOJE/DVGCckX0MIzQOndu4gh
udOleKKLJmbFlTh5MDn4u57k/NvnJyS3EOL839vtiwAEVAj/RMnwHw/9qwZRs3u3
WOlXfmIlMsjFcMXmMUDoxjjIb2r7TeVpGaLlgN0iwJX7GxreIcVx9EkIC/fgike3
DsDL3pDexaulruTWxC1zlV5F8jH2ZToqs5WQB7ImKsJTa96vxfIw2ZaWz/2NJf9+
JmOzmfB0Ct23SZ/HSsh4UpJ4Fk6nPPjPjJNOjQn0G/sTXcnfelYTZ3X7InpoUk7J
DNYZ+yg1fHsYzQE0Iyyvq3B7R4BLy1OcRaiVEm0c8p9Z7v3y91WyNZ+2bnNV7b0K
uROnF3/TGE+uhyjGvSO25X0619BIOwcyjECCLz9FGrGmgMTCBizT+1iO8DTLd4vw
o4RkHRfdGEyxg5LnCv6SBqyqkn+vWBBj6wGKuDYYy76e6TkCoS8DsQu3VEJS9C8s
Pkq4n6nxl8tiy5Ug5oCG9X/SCLS7Q9GFcOVW1nhOsnDmC6Qxt/4mvvxoQs+obM6z
0cftrUOh9sMVkByuloHZ
=y9d9
-----END PGP SIGNATURE-----

Message #59 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: Tormod Volden <debian.tormod@gmail.com>

To: 802914-close@bugs.debian.org

Subject: Bug#802914: fixed in xscreensaver 5.30-1+deb8u1

Date: Tue, 12 Jan 2016 06:32:26 +0000

Source: xscreensaver
Source-Version: 5.30-1+deb8u1

We believe that the bug you reported is fixed in the latest version of
xscreensaver, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802914@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tormod Volden <debian.tormod@gmail.com> (supplier of updated xscreensaver package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 25 Oct 2015 11:35:52 +0100
Source: xscreensaver
Binary: xscreensaver xscreensaver-data xscreensaver-data-extra xscreensaver-gl xscreensaver-gl-extra xscreensaver-screensaver-webcollage xscreensaver-screensaver-bsod
Architecture: source amd64
Version: 5.30-1+deb8u1
Distribution: jessie-security
Urgency: medium
Maintainer: Tormod Volden <debian.tormod@gmail.com>
Changed-By: Tormod Volden <debian.tormod@gmail.com>
Description:
 xscreensaver - Screensaver daemon and frontend for X11
 xscreensaver-data - Screen saver modules for screensaver frontends
 xscreensaver-data-extra - Extra screen saver modules for screensaver frontends
 xscreensaver-gl - GL(Mesa) screen saver modules for screensaver frontends
 xscreensaver-gl-extra - Extra GL(Mesa) screen saver modules for screensaver frontends
 xscreensaver-screensaver-bsod - BSOD screen saver module from XScreenSaver
 xscreensaver-screensaver-webcollage - Webcollage screen saver module from XScreenSaver
Closes: 802914
Changes:
 xscreensaver (5.30-1+deb8u1) jessie-security; urgency=medium
 .
   * Add upstream patch for "xscreensaver aborts when unplugging second
     monitor" security issue (closes: #802914)
     http://www.openwall.com/lists/oss-security/2015/10/24/2
Checksums-Sha1:
 8f4d48a0c24ebaa88473fba22aedff7a0f5c12ff 3457 xscreensaver_5.30-1+deb8u1.dsc
 734e0861145ec67cb848348fc25ea29393dc4d95 9555281 xscreensaver_5.30.orig.tar.gz
 ddcb336e6397afa50540ba443c8e47500cb617c9 79746 xscreensaver_5.30-1+deb8u1.diff.gz
 e2abcc9bb9e114ba8ca09247b427a42d444a0504 560478 xscreensaver_5.30-1+deb8u1_amd64.deb
 6cea92a60c1a0a26b3e468f3c6296967345fe8af 300214 xscreensaver-data_5.30-1+deb8u1_amd64.deb
 f191fd15e3a495ed1ec90ec8c212124101821a85 1009906 xscreensaver-data-extra_5.30-1+deb8u1_amd64.deb
 4f4b3d17597512bf2974f37c39f0bbd2b4e34aff 1062864 xscreensaver-gl_5.30-1+deb8u1_amd64.deb
 6c22930b8e3ca5f487a408a6eacf46d80db9579f 1623296 xscreensaver-gl-extra_5.30-1+deb8u1_amd64.deb
 dffc6e07685dfe0effe1669d016cc96c54b4c9ab 61604 xscreensaver-screensaver-webcollage_5.30-1+deb8u1_amd64.deb
 48c9e0ab99fc25f7210c9770ab409d9f6d856347 163050 xscreensaver-screensaver-bsod_5.30-1+deb8u1_amd64.deb
Checksums-Sha256:
 3039f41d3573673a5c138064f09ddfde6b3f0a77d6ad2b19ddbc977237eb73f7 3457 xscreensaver_5.30-1+deb8u1.dsc
 3771176876a402738e0f91dcb3654b57cfa430cf90d3413a6bad5daf1d085d52 9555281 xscreensaver_5.30.orig.tar.gz
 3e992ae07d0588053ab25166b3228bdb5d6f6925ed344737fff37e24a8248ffc 79746 xscreensaver_5.30-1+deb8u1.diff.gz
 f10454578470453fde5cbd5d21979b12df209544ccf389e7f8650c838771e26d 560478 xscreensaver_5.30-1+deb8u1_amd64.deb
 6cb05e42e31abde7803c4d1c3d84119a137439e068fa1d8a4d27649c8529effb 300214 xscreensaver-data_5.30-1+deb8u1_amd64.deb
 d870ea294ceb7524db3ac661802e2cfc69364a3931dab7b7d233f9cf7d1fe6cf 1009906 xscreensaver-data-extra_5.30-1+deb8u1_amd64.deb
 42360d8f59b81d08185646bb4c8ac6d4ad81ce2b88f3d2546a649b0524d1b866 1062864 xscreensaver-gl_5.30-1+deb8u1_amd64.deb
 5fe6ca6a6458c1e3e5933a7cf8c09906d366e5365176c485e633608ab704b251 1623296 xscreensaver-gl-extra_5.30-1+deb8u1_amd64.deb
 960c619dbceee52ebb076ae1ba104875c58a1a08d7a0ab94d1e409a7ce5ae95e 61604 xscreensaver-screensaver-webcollage_5.30-1+deb8u1_amd64.deb
 c10f2df5cbf65780d337d4481729620e4e295de94e083a0dbb46979b87bdd1f3 163050 xscreensaver-screensaver-bsod_5.30-1+deb8u1_amd64.deb
Files:
 89e39ea1c9d0f1ac260b6dc87305a66c 3457 x11 optional xscreensaver_5.30-1+deb8u1.dsc
 b71e3a78db1ae14291cc9ff4c5e10911 9555281 x11 optional xscreensaver_5.30.orig.tar.gz
 8d521eb1ea44691439a3449fa62397bf 79746 x11 optional xscreensaver_5.30-1+deb8u1.diff.gz
 c8da0fb583fc48057e77b8ef8786f997 560478 x11 optional xscreensaver_5.30-1+deb8u1_amd64.deb
 481b5bc78e0e2f269dca3eeea407ee8b 300214 x11 optional xscreensaver-data_5.30-1+deb8u1_amd64.deb
 410c08b0d7f67788c9c93b19e9a52fea 1009906 x11 optional xscreensaver-data-extra_5.30-1+deb8u1_amd64.deb
 eb7841f06bd4d039ce35afdec4ac9727 1062864 x11 optional xscreensaver-gl_5.30-1+deb8u1_amd64.deb
 b43ed8413dd80a213bd5cf6af9a6590d 1623296 x11 optional xscreensaver-gl-extra_5.30-1+deb8u1_amd64.deb
 a238906fea04bdfa7c49ad84924a2af5 61604 x11 optional xscreensaver-screensaver-webcollage_5.30-1+deb8u1_amd64.deb
 85b1b8b2d705f46549c00b5f1f2be788 163050 x11 optional xscreensaver-screensaver-bsod_5.30-1+deb8u1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQQcBAEBCgAGBQJWkclsAAoJELjWss0C1vRzetYgAIFFxPvSlynX3CrRk1+DQHkV
6Qh+uLkKlB8UD/2/LcWx49lyYrsmDnkP2C/V07dHc9y6Zvi0GyadB6eHW1gBtYmf
eKPlxD48JjJyj/A60KOt3mDer7biAGoqjzkXp0zVa9lgFlqCx0jomEjPzAyHQqs8
0C3pb8Fnaw05UcwnHbvJ7VI57W0KgVOiy91aMf0LDbyj6/w+2xGIJlwMbwVhjqk8
6ruCdrjSSRJxAe59McJr+gOUh40mpjQ1T9MzTN3GS3gd5Qt7svPiwa0oo8MGZhXe
FGUsQkbfRGJCJkKoGkk6ThAwCNuhm089CJRE88t2bWmB8dHtiLYbtZ6vidJlBPMa
ychyCkmNMjiLzgjmaSndhUX/yylK98Gt+PwvPldEhioQqdQNmETfyYs2NbFIBBh4
mJPfFYwehhu9z5ck8FXaDkYWtfowUdzrmamNUXfMRFhl4jFX8MpBFUa9/NBXj5zh
YvYcfZpxOvcjITd7XkkCvJ551blT+IMGlNgvaO+ovDzaIo5NbuDb2tPTG2ITOf2v
IigLhF6Ys0Fq7cy9GB5m+POjH/AVJysX0hxRnOTzE/jiRJQsLaUXev10DAsBKEDr
BamjOfICHD3nbFRbhsJuyVsGzfSvbP+Zxxe3ihfvZkfU3OtrZfiq/fAWM5XfGaxZ
ymMBXOEeLx9nFFAoOAhsBZarK+OLWVhybl88bLX5i9q0OaxITAIyCQwL+QuZZs9Q
X67jNTpvrEAwXiIG+VwtamRf6K0bG7zFmRyLq30hW4mOrNHQp9SK6VQcWg6001oa
0ZoUqnmrb1V6T+6mu5yG0uT/4iW4wQa4IS48dZy3iS3yU/3rmoEuUgDAy+yJX6Hj
fKH1jMlPS80II/QSO/HVC9SO+aDE6xlUFeC9So8I11XrS/44PBGYHfQcHUMJbsqe
Xo72DeMOxHHdAl830tcxr0JK9cuURP+dNmA6s34dR9ud1wi784mp/OUjX8HlbvWU
hHHNC/iWhGTeaczCWGkRHEqa2HQIYzsdc5kTpIIIauh+qQyCfcSGIg5lQ9Lr5pTu
H07Pd1GUNCVnLZ9iJIkeSZdrbrfAHK4DlMNcw06OLj88OJrwWgvzTbsdRVVzhkmE
OO0qy2SkrOhW78rRtyzqoWbWYXvrUVQp3jMZLKVI0IlNLzBE3rqvrrGP5QtydnGI
q/13OgVG2GXmp6m5KLHfvvAiP+bvjdg36TWYch4DcgnXtwvwtWB8M8mzGmFK84oN
d8l4WC5C+LTgaxNB5+JPL/DcXCQP7YfEgJianczhobZ9mIobW49Qr0piF5T/oGP8
2le8vJmABMPhAMt3ezxBXgdOFX8mXeaYdgakutyN4a53zcWjdNbjlTNby5+pmNQ=
=vSBZ
-----END PGP SIGNATURE-----

Message #64 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupré <anarcat@debian.org>

To: 802914-close@bugs.debian.org

Subject: Bug#802914: fixed in xscreensaver 5.15-3+deb7u1

Date: Tue, 12 Jan 2016 06:32:51 +0000

Source: xscreensaver
Source-Version: 5.15-3+deb7u1

We believe that the bug you reported is fixed in the latest version of
xscreensaver, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 802914@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Antoine Beaupré <anarcat@debian.org> (supplier of updated xscreensaver package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 05 Jan 2016 15:46:50 -0500
Source: xscreensaver
Binary: xscreensaver xscreensaver-data xscreensaver-data-extra xscreensaver-gl xscreensaver-gl-extra xscreensaver-screensaver-webcollage xscreensaver-screensaver-bsod
Architecture: source i386
Version: 5.15-3+deb7u1
Distribution: wheezy-security
Urgency: high
Maintainer: Tormod Volden <debian.tormod@gmail.com>
Changed-By: Antoine Beaupré <anarcat@debian.org>
Description: 
 xscreensaver - Automatic screensaver for X
 xscreensaver-data - data files to be shared among screensaver frontends
 xscreensaver-data-extra - data files to be shared among screensaver frontends
 xscreensaver-gl - GL(Mesa) screen hacks for xscreensaver
 xscreensaver-gl-extra - GL(Mesa) screen hacks for xscreensaver
 xscreensaver-screensaver-bsod - BSOD hack from XScreenSaver
 xscreensaver-screensaver-webcollage - Webcollage hack from XScreenSaver
Closes: 802914
Changes: 
 xscreensaver (5.15-3+deb7u1) wheezy-security; urgency=high
 .
   * Port squeeze LTS patch for "xscreensaver aborts when unplugging second
     monitor" security issue, CVE-2015-8025 (Closes: #802914)
Checksums-Sha1: 
 e70cc32d2834a93b0b374384b298c60b760ff555 3365 xscreensaver_5.15-3+deb7u1.dsc
 5653e8162ef41c5a799dec33dc4573fee351dc68 5995992 xscreensaver_5.15.orig.tar.gz
 10b64a59f4e9b8eb2553386cfef0b5813a467f3a 76027 xscreensaver_5.15-3+deb7u1.diff.gz
 2e7a824c4b367254c4a77aab82d5b369b4ddbfe6 867152 xscreensaver_5.15-3+deb7u1_i386.deb
 9b2cd8a26c14b1a4eafbbc31e2031529593dae1f 542580 xscreensaver-data_5.15-3+deb7u1_i386.deb
 5547fde268ccce7d8e1d0bd3ef0bef15ac9989e5 2666194 xscreensaver-data-extra_5.15-3+deb7u1_i386.deb
 62d9eac80c019230ae91daaad22d28413d3162a5 2211446 xscreensaver-gl_5.15-3+deb7u1_i386.deb
 ee8d30b30f95131bcbe7b8c1d3bf428461de6f55 2464380 xscreensaver-gl-extra_5.15-3+deb7u1_i386.deb
 728353c227f5df8858ff1b55c5c35459070a74db 65546 xscreensaver-screensaver-webcollage_5.15-3+deb7u1_i386.deb
 51990febf5005bdbce3dec487049b82e164111b8 164948 xscreensaver-screensaver-bsod_5.15-3+deb7u1_i386.deb
Checksums-Sha256: 
 41e949fb128895bffd9e427ffab28c888182b232cab13d6dfe173732b80a9da6 3365 xscreensaver_5.15-3+deb7u1.dsc
 ef158cb9b49664748a1e35f895338c658dbb854bbea345f9e5f6ca28191050b0 5995992 xscreensaver_5.15.orig.tar.gz
 82922f10c1a77e1d675e395b573daf6f9ccc81bb9c38a49d46a2656deb6903e8 76027 xscreensaver_5.15-3+deb7u1.diff.gz
 d81ee728851281455ca593f424ac4183e46a1a1096e5f64e569d4995ded1ee0f 867152 xscreensaver_5.15-3+deb7u1_i386.deb
 0579c347a1e4329ef8d27a57da462a892b72d7d27ce39ee166e1decdd36013b4 542580 xscreensaver-data_5.15-3+deb7u1_i386.deb
 cc1ca1044a539929d46caa807cdaaf7405aa306028911306ddb0092c95fa6f5c 2666194 xscreensaver-data-extra_5.15-3+deb7u1_i386.deb
 bdadc649a80783d20536c9f9ee4816d3e3959e39ee7767802fba66898bc00daa 2211446 xscreensaver-gl_5.15-3+deb7u1_i386.deb
 7541665668bbe5b238e7ffce78b8984e4fd0c6627f25d5e5eca9b8e2cf51e4c0 2464380 xscreensaver-gl-extra_5.15-3+deb7u1_i386.deb
 b2f53134ff4417cf11ba12d7d203fa8f4c521972d9c25588bfaf937e71ce3baa 65546 xscreensaver-screensaver-webcollage_5.15-3+deb7u1_i386.deb
 cb4682eb720f550445890e6076d1e4dfe2bbf931d95724081f1976d45bf4e3d2 164948 xscreensaver-screensaver-bsod_5.15-3+deb7u1_i386.deb
Files: 
 cb2f1e28a0ce7688b43a56b01b64bf6b 3365 x11 optional xscreensaver_5.15-3+deb7u1.dsc
 075a362119444338206950f2435dedb6 5995992 x11 optional xscreensaver_5.15.orig.tar.gz
 9698047d78f817222b4e07c8cd5e9b9b 76027 x11 optional xscreensaver_5.15-3+deb7u1.diff.gz
 44363d4599b70fea5765e550183f03cc 867152 x11 optional xscreensaver_5.15-3+deb7u1_i386.deb
 2a71597ffbc4c282ea35817fe3419c3c 542580 x11 optional xscreensaver-data_5.15-3+deb7u1_i386.deb
 8f02ae7999caae8a764fb4777972b9de 2666194 x11 optional xscreensaver-data-extra_5.15-3+deb7u1_i386.deb
 eb8a9765e04d2c10456240af6877f85d 2211446 x11 optional xscreensaver-gl_5.15-3+deb7u1_i386.deb
 efc3db0af68afa35df576b7133b2fe28 2464380 x11 optional xscreensaver-gl-extra_5.15-3+deb7u1_i386.deb
 fefd4d32e3649c9495ff4cdb93cd4693 65546 x11 optional xscreensaver-screensaver-webcollage_5.15-3+deb7u1_i386.deb
 a245abcc1ab4139f24b45a2c5a07c6d2 164948 x11 optional xscreensaver-screensaver-bsod_5.15-3+deb7u1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQQcBAEBCgAGBQJWkcmCAAoJELjWss0C1vRzT+of/2K1KdiTB6dpOwyqtiX2ayuy
w553VvgXaA1sV6grKvuz2DLc6afyGfZPEBJp0SMa5mzO8VmQ/r7Mfwdn2aO8b3Gw
4RZ5cDhxuW4lNYLsOu1izXkkSSb9FDDvL4gjkLGXF1G0tXZPSUIn8kCECm5PluxT
jQZTrmJ2QrSLdLlzefRs3BXzedQCxGRm8TUpFI34DerN6bhFN4AZEOtPowP14c2C
vcbufdAJsEdXxm3QbnpH2krdeyG+lZ39CCu7kWZBSCeWaIEZkq7Q+IslGIpCXzxW
239E1bznPOKUiRgYfb33g+eD8xSN0Ib0p6eH6nduHSKzpcQUyVjmph479zX7pVCl
1L5Hmf0M6H3vXqKtGZ+Mh4GxtM33dBv1kdr35rx3RIEEs0ZKESgGl6C9hRQCxoJ4
oY84+sCWC/0QzgBLTzH74/BgwHP5+ULUkdCnznzrqs3QkVX/kw2y0SnPnTczuNzG
BwrDurGh+oMdLBBUkCngbMScU9M7gi5OzTbj2abniYRlnHehFTDNMX9uSjo9TyLK
HvyUfwG9dAfdnQ8jgd5ALJPms2ptnSJYjb0GXq/V+mHR0IOP6McPB71Q2eTEfZU3
sZQJizZaar6ZH1tr1LJsHZGA/hkX40X6RrfwWMPhi7ynbI8mkEzCmqLmIOOPcYqT
Hu6PuTyr6Cjuk+0GW2hWc98iOjkpkJ3H5MSYaS1R7rw2Nr7La7OK+2++1UBmyObE
uS9N9wSaG9tM13Xb4DJEUd4HT8lzTZhEOo2JC9j9vy2xULjpBQIkzbuN8Ao8cS1A
IGwC3j9yKuWs7N5CRZjsUVkdVIu12q1ZxKLeo+pDUSDvyziRU/HuMjlhQurpMmdA
cxaDQg9mn6bvUt5NhIXE+6R00p1hgTgamcmmKiTIZJd3LkVV2oTpaa2FfEpI/keo
Kuw6DxzrlsHToe5z+8rxqVoHTSt0BP6J967hiXY7a3RGaK8omLNt1US54ZMu2awn
+r/BH8/HlyK8hzDQMI1XMcW8+WUglqTaux20KgIAhFlrFbNHBRTJeikMKrN1gsAK
wxbJQsDQzyVmunBXt/z3PvgfbvDuO3ADsSOQ40o8Md7EM4iazFR0Bpoq7+wmc5VI
zw4cgyhKC6pVNdGODcDq4qJK2mB5GDURVwdYaX+AaPQu6q69ANSV6hjLS9zIf/Xz
93b1yu81VLnFQJir/vNg7W8+A3yXy4XGXoP/TCv0V5cKCSito3CBvsP12XxKpQlk
yZXr12+re5wl+vY3tY1XylLWEUDal8BIzxXv/B4CO5Uzhbj8ka7UdDIL+KLhKEv7
RwtfHV+XegFh5aRRHnfV805GY4tACwVHvAuna1Bnuv5pW0z9Tt9apwKcLzLQlXw=
=9pP8
-----END PGP SIGNATURE-----

Message #69 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: FedEx Standard Overnight <leslie.mcgrath@tsp-consultancy.com>

To: <802914-close@bugs.debian.org>

Subject: We could not deliver your parcel, #000433685

Date: Thu, 13 Oct 2016 01:05:25 +0200

[Message part 1 (text/plain, inline)]

Dear Customer,

This is to confirm that one or more of your parcels has been shipped.
Shipment Label is attached to email.

Sincerely,
Leslie Mcgrath,
FedEx Operation Manager.

[Malware Alert Text.txt (application/octet-stream, attachment)]

Message #70 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: "FedEx International Economy" <glen.nolan@celebs1.com>

To: 802914-close@bugs.debian.org

Subject: Problem with parcel shipping, ID:00634689

Date: Sat, 15 Oct 2016 03:23:00 +0000

[Message part 1 (text/plain, inline)]

Dear Customer,

We could not deliver your parcel.
Delivery Label is attached to this email.

Kind regards,
Glen Nolan,
Operation Manager.

[Label_00634689.zip (application/zip, attachment)]

Message #71 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: "FedEx Ground" <glenn.parsons@shayaribooks.com>

To: 802914-close@bugs.debian.org

Subject: Delivery Notification, ID 00405854

Date: Mon, 24 Oct 2016 10:44:30 -0500

[Message part 1 (text/plain, inline)]

Dear Customer,

This is to confirm that one or more of your parcels has been shipped.
You can review complete details of your order in the find attached.

Yours trully,
Glenn Parsons,
Sr. Support Manager.

[FedEx_ID_00405854.zip (application/zip, attachment)]

Message #72 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: "FedEx International Ground" <charles.garrett@maichau-vietnam.com>

To: 802914-close@bugs.debian.org

Subject: Delivery Notification, ID 000283005

Date: Fri, 28 Oct 2016 15:53:13 +0100

[Message part 1 (text/plain, inline)]

Dear Customer,

Courier was unable to deliver the parcel to you.
Please, open email attachment to print shipment label.

Warm regards,
Charles Garrett,
Sr. Delivery Manager.

[FedEx_000283005.zip (application/zip, attachment)]

Message #73 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: "FedEx International MailService" <mitchell.dotson@hkmusictherapy.com>

To: 802914-close@bugs.debian.org

Subject: Problem with parcel shipping, ID:0000943937

Date: Tue, 1 Nov 2016 17:44:31 +0000

[Message part 1 (text/plain, inline)]

Dear Customer,

Courier was unable to deliver the parcel to you.
You can review complete details of your order in the find attached.

Kind regards,
Mitchell Dotson,
FedEx Support Manager.

[FedEx_ID_0000943937.zip (application/zip, attachment)]

Message #74 received at 802914-close@bugs.debian.org (full text, mbox, reply):

From: "FedEx 2Day A.M." <images@bbs.sonyue.com>

To: <802914-close@bugs.debian.org>

Subject: Problem with parcel shipping, ID:234666282

Date: Sun, 20 Nov 2016 08:00:52 +0300

[Message part 1 (text/plain, inline)]

Hello,
Courier was unable to deliver the parcel to you. Shipment Label is attached to email.
Ede Carbin - Area Manager FedEx , CA
Thank you for choosing FedEx

[FedEx.doc (application/msword, attachment)]

Send a report that this bug log contains spam.