libpodofo: CVE-2017-6847

Debian Bug report logs - #861564
libpodofo: CVE-2017-6847

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Multiple security issues

Date: Thu, 02 Mar 2017 19:28:23 +0100

Source: libpodofo
Severity: grave
Tags: security

New podofo issues (no CVEs yet):

http://www.openwall.com/lists/oss-security/2017/03/02/10
http://www.openwall.com/lists/oss-security/2017/03/02/9
http://www.openwall.com/lists/oss-security/2017/03/02/8
http://www.openwall.com/lists/oss-security/2017/03/02/7
http://www.openwall.com/lists/oss-security/2017/03/02/6
http://www.openwall.com/lists/oss-security/2017/03/02/5
http://www.openwall.com/lists/oss-security/2017/03/02/4
http://www.openwall.com/lists/oss-security/2017/03/02/3
http://www.openwall.com/lists/oss-security/2017/03/02/2

Cheers,
        Moritz

Message #10 received at 856592@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 856592@bugs.debian.org

Subject: Re: Bug#856592: Multiple security issues

Date: Fri, 3 Mar 2017 06:43:03 +0100

Hello,

On Thu, Mar 02, 2017 at 07:28:23PM +0100, Moritz Muehlenhoff wrote:
> Source: libpodofo
> Severity: grave
> Tags: security
> 
> New podofo issues (no CVEs yet):
> 
> http://www.openwall.com/lists/oss-security/2017/03/02/10
> http://www.openwall.com/lists/oss-security/2017/03/02/9
> http://www.openwall.com/lists/oss-security/2017/03/02/8
> http://www.openwall.com/lists/oss-security/2017/03/02/7
> http://www.openwall.com/lists/oss-security/2017/03/02/6
> http://www.openwall.com/lists/oss-security/2017/03/02/5
> http://www.openwall.com/lists/oss-security/2017/03/02/4
> http://www.openwall.com/lists/oss-security/2017/03/02/3
> http://www.openwall.com/lists/oss-security/2017/03/02/2

And http://www.openwall.com/lists/oss-security/2017/03/02/1 in the
above list.

I'm not sure if Agostino Sarubbo has already requested CVEs (I hope
so). Otherwise it's not going to be easy to track those issues, apart
from opening individual bugs for each item.

Regards,
Salvatore

Message #13 received at 856592@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 856592@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#856592: Multiple security issues

Date: Fri, 3 Mar 2017 08:40:37 +0100

[Message part 1 (text/plain, inline)]

On Fri, Mar 03, 2017 at 06:43:03AM +0100, Salvatore Bonaccorso wrote:
> in the above list.

aheam, what a list.
Anyway, you (Moritz) opened this bug as RC, but is it fine to downgrade
to important if I deem the issues not grave enough to be RC?
They are all crashes, with maliciously crafted PDFs…

> I'm not sure if Agostino Sarubbo has already requested CVEs (I hope
> so).

I hope so too, if he read that email about the move to that web form.

> Otherwise it's not going to be easy to track those issues, apart
> from opening individual bugs for each item.

which I would have preferred anyway :)
I think I will clone+retitle this bug appropriately (and take care of
updating CVE/list if/when I'll do so).

-- 
regards,
                        Mattia Rizzolo

GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540      .''`.
more about me:  https://mapreri.org                             : :'  :
Launchpad user: https://launchpad.net/~mapreri                  `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia  `-

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 856592@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Mattia Rizzolo <mattia@debian.org>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 856592@bugs.debian.org

Subject: Re: Bug#856592: Multiple security issues

Date: Sun, 12 Mar 2017 22:07:32 +0100

On Fri, Mar 03, 2017 at 08:40:37AM +0100, Mattia Rizzolo wrote:
> On Fri, Mar 03, 2017 at 06:43:03AM +0100, Salvatore Bonaccorso wrote:
> > in the above list.
> 
> aheam, what a list.
> Anyway, you (Moritz) opened this bug as RC, but is it fine to downgrade
> to important if I deem the issues not grave enough to be RC?
> They are all crashes, with maliciously crafted PDFs…

Which is the most common attack vector on desktop systems...

If there's no upstream (or failing that, maintainer) activity in
fixing these security issues in the forthcoming months towards the
stretch release, stretch is better off without it.

Cheers,
        Moritz

Message #25 received at 856592@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 856592@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#856592: Multiple security issues

Date: Mon, 13 Mar 2017 12:21:24 +0100

Hi,

On Fri, Mar 03, 2017 at 06:43:03AM +0100, Salvatore Bonaccorso wrote:
> Hello,
> 
> On Thu, Mar 02, 2017 at 07:28:23PM +0100, Moritz Muehlenhoff wrote:
> > Source: libpodofo
> > Severity: grave
> > Tags: security
> > 
> > New podofo issues (no CVEs yet):
> > 
> > http://www.openwall.com/lists/oss-security/2017/03/02/10
> > http://www.openwall.com/lists/oss-security/2017/03/02/9
> > http://www.openwall.com/lists/oss-security/2017/03/02/8
> > http://www.openwall.com/lists/oss-security/2017/03/02/7
> > http://www.openwall.com/lists/oss-security/2017/03/02/6
> > http://www.openwall.com/lists/oss-security/2017/03/02/5
> > http://www.openwall.com/lists/oss-security/2017/03/02/4
> > http://www.openwall.com/lists/oss-security/2017/03/02/3
> > http://www.openwall.com/lists/oss-security/2017/03/02/2
> 
> And http://www.openwall.com/lists/oss-security/2017/03/02/1 in the
> above list.

FTR, for all of those CVEs have been assigned.

Regards,
Salvatore

Message #38 received at 861564-submitter@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: 861564-submitter@bugs.debian.org

Subject: Bug#861564 in libpodofo marked as pending

Date: Wed, 17 May 2017 13:01:35 +0000

Control: tag 861564 pending

Hello,

Bug #861564 in libpodofo reported by you has been fixed in the Git repository. You can
see the commit message below, and you can check the diff of the fix at:

    https://anonscm.debian.org/git/collab-maint/libpodofo.git/commit/?id=8c2a55f

(this message was generated automatically based on the git commit message)
---
commit 8c2a55fba83169795faa0c6cc7c033055d3d5af3
Author: Mattia Rizzolo <mattia@debian.org>
Date:   Wed May 17 14:36:55 2017 +0200

    Add upstream patch for CVE-2017-6847 and CVE-2017-6848
    
    Closes: #861564
    Closes: #861565
    Signed-off-by: Mattia Rizzolo <mattia@debian.org>

Message #45 received at 861564-close@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: 861564-close@bugs.debian.org

Subject: Bug#861564: fixed in libpodofo 0.9.4-6

Date: Wed, 17 May 2017 15:05:38 +0000

Source: libpodofo
Source-Version: 0.9.4-6

We believe that the bug you reported is fixed in the latest version of
libpodofo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 861564@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mattia Rizzolo <mattia@debian.org> (supplier of updated libpodofo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 17 May 2017 14:54:40 +0200
Source: libpodofo
Binary: libpodofo-dev libpodofo-utils libpodofo0.9.4
Architecture: source
Version: 0.9.4-6
Distribution: unstable
Urgency: high
Maintainer: Mattia Rizzolo <mattia@debian.org>
Changed-By: Mattia Rizzolo <mattia@debian.org>
Description:
 libpodofo-dev - PoDoFo development files
 libpodofo-utils - PoDoFo utilities
 libpodofo0.9.4 - PoDoFo - library to work with the PDF file format
Closes: 854603 859329 859330 861557 861559 861560 861564 861565
Changes:
 libpodofo (0.9.4-6) unstable; urgency=high
 .
   * Add upstream patches for security issues:
     + CVE-2017-5855 Closes: #854603
     + CVE-2017-6840 Closes: #861557
     + CVE-2017-6842 Closes: #861559
     + CVE-2017-6843 Closes: #861560
     + CVE-2017-6847 Closes: #861564
     + CVE-2017-6848 Closes: #861565
     + CVE-2017-7378 Closes: #859330
     + CVE-2017-7380 CVE-2017-7381 CVE-2017-7382 CVE-2017-7383 Closes: #859329
Checksums-Sha1:
 a0141f73e16d353888dfb632826662ec66cc548c 2119 libpodofo_0.9.4-6.dsc
 93562112a91591e5c6b9c948a9aa066bad8c4f1a 14512 libpodofo_0.9.4-6.debian.tar.xz
 f1cd3ed5a17a27a0104ef4c119260df641d8301d 8322 libpodofo_0.9.4-6_amd64.buildinfo
Checksums-Sha256:
 1d96e62e5dc05c3da75b27c119f38059632a4b38b449a09f261609c658ac6501 2119 libpodofo_0.9.4-6.dsc
 2d93ad73a0a76fb8c81bf8d8e4e28295521b2201de75bf43921c56fdde184ada 14512 libpodofo_0.9.4-6.debian.tar.xz
 378cbccde338b4d202fb9d0e3ffd4db6d236d8afbc3afd555a710096baa8be8c 8322 libpodofo_0.9.4-6_amd64.buildinfo
Files:
 616f6d73552c644f07f9aac81c68d586 2119 libdevel extra libpodofo_0.9.4-6.dsc
 69ed783b68d73ee280d264db44b0be2b 14512 libdevel extra libpodofo_0.9.4-6.debian.tar.xz
 3b44532d73422eca5c039607ce5be072 8322 libdevel extra libpodofo_0.9.4-6_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAlkcSacACgkQCBa54Yx2
K60wIA//Srh+elVV8U5HZ+/WygzwNsd4fCZdpvsTxgesLM5HCl80M3adaSZsHyFJ
zBiD5n/Xkgtc/fr4nLU3X2k++rkyiBulIuB2+vT/qDwa1oYgyQDWTH/DTJ+Y363d
9Bb6gI4LqytsgYgvDU2ZEEq73DYeQa5P7bGB4Bt+XYOlfKjd+xLAuVU6srWNuXSA
/sBshQhWDzvC+WAgXF0AW6Qe+Nz2g0LS4mw2qO80eZ5Tu0vLofpMvC+w7PssdPlK
RfPAngL9uEy28s6DFKf/GcAfCkd2CYfVQTU2QGoGeQei/GyTXXFzrDBK9UOXeMlz
XZuYfhBqwj6AYo1W7freJBzrOw5haTrGkZKUipcWUD7qlJRP0Sa54IOV9cr/R+3D
PljaLbIZQXrIO/z8xtVs3Yu6mKHgWPciPwu/nvs8U9Z4h7XSfHCVOM+vYyjW7imG
gkYR2G/2VnBI0wbs6+gepafSzZ60q9GNMAsMin1dllpRGEOiPpln/5ZFYHksZwDF
rqbNsYLOov/bNbgHKpy4Erf/qtKoa6QLrojN0vNQFjLiioTc3E1C667CvKH/hwn0
qwdQR4KUrG55lVJEAf4B707xeibU0i6oad59jxO0rK9YKXBac1zHyBcobU3hluhv
lp+AK8MgSrzwYwteG28eAfPEzRAz7CeK0KW6mVTRo696l5k7S0U=
=8FKk
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.