bsdmainutils: CVE-2015-5218

Debian Bug report logs - #798067
bsdmainutils: CVE-2015-5218

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: bsdmainutils: CVE-2015-5218

Date: Sat, 05 Sep 2015 07:27:45 +0200

Source: bsdmainutils
Version: 8.0.13
Severity: normal
Tags: security upstream

Hi,

the following vulnerability was published for bsdmainutils.

CVE-2015-5218[0]:
buffer overflow in colcrt

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-5218
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1259322

The impact is not clear.

Regards,
Salvatore

Message #10 received at 798067-done@bugs.debian.org (full text, mbox, reply):

From: Michael Meskes <meskes@debian.org>

To: 798067-done@bugs.debian.org

Subject: Not vulnerable

Date: Wed, 9 Mar 2016 09:45:04 +0100

It appears this CVE is against colcrt from util-linux, not the one dereived
from bsd which we use. Ours does not seem to be vulnerable at all:

michael@feivel:~$ colcrt Downloads/binZ8dhbQ3bFM.bin 
colcrt: Invalid or incomplete multibyte or wide character

The file used is the one from the original bug report.

Hence, I just close the bug report. Please re-open if I missed anything.

Michael
-- 
Michael Meskes
Michael at Fam-Meskes dot De, Michael at Meskes dot (De|Com|Net|Org)
Meskes at (Debian|Postgresql) dot Org
Jabber: michael at xmpp dot meskes dot org
VfL Borussia! Força Barça! Go SF 49ers! Use Debian GNU/Linux, PostgreSQL

Message #15 received at 798067@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 798067@bugs.debian.org

Cc: Michael Meskes <meskes@debian.org>

Subject: Re: Bug#798067 closed by Michael Meskes <meskes@debian.org> (Not vulnerable)

Date: Wed, 9 Mar 2016 10:16:05 +0100

Hi,

> It appears this CVE is against colcrt from util-linux, not the one dereived
> from bsd which we use. Ours does not seem to be vulnerable at all:
> 
> michael@feivel:~$ colcrt Downloads/binZ8dhbQ3bFM.bin 
> colcrt: Invalid or incomplete multibyte or wide character
> 
> The file used is the one from the original bug report.
> 
> Hence, I just close the bug report. Please re-open if I missed anything.

You are completely right, my original report was wrong on
bsdmainutils. It is as well already fixed in 2.27 of util-linux (but
not present in the built package afaics, but I will double check that
now).

I do not think you missed anything.

Regards,
Salvatore

Send a report that this bug log contains spam.