Debian Bug report logs -
#858546
CVE-2017-5029: Integer overflow in xsltAddTextString
Reported by: Raphael Hertzog <hertzog@debian.org>
Date: Thu, 23 Mar 2017 10:36:01 UTC
Severity: grave
Tags: fixed-upstream, patch, security, upstream
Found in versions libxslt/1.1.28-2, libxslt/1.1.29-1
Fixed in versions libxslt/1.1.29-2.1, libxslt/1.1.28-2+deb8u3
Done: Salvatore Bonaccorso <carnil@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
:
Bug#858546
; Package src:libxslt
.
(Thu, 23 Mar 2017 10:36:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Raphael Hertzog <hertzog@debian.org>
:
New Bug report received and forwarded. Copy sent to Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
.
(Thu, 23 Mar 2017 10:36:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: libxslt
Severity: important
Tags: security patch
Hi,
the following vulnerability was published for libxslt. The issue can be
exploited to trigger an out of bounds write on 64-bit systems.
CVE-2017-5029[0]:
Integer overflow in xsltAddTextString
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
Upstream has committed a patch here:
https://git.gnome.org/browse/libxslt/commit/?id=08ab2774b870de1c7b5a48693df75e8154addae5
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-5029
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5029
Please adjust the affected versions in the BTS as needed.
--
Raphaël Hertzog ◈ Debian Developer
Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/
Added tag(s) upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Thu, 23 Mar 2017 11:09:03 GMT) (full text, mbox, link).
Added tag(s) fixed-upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Thu, 23 Mar 2017 11:09:05 GMT) (full text, mbox, link).
Marked as found in versions libxslt/1.1.29-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Thu, 23 Mar 2017 18:18:02 GMT) (full text, mbox, link).
Marked as found in versions libxslt/1.1.28-2.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Thu, 23 Mar 2017 18:18:05 GMT) (full text, mbox, link).
Severity set to 'grave' from 'important'
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Thu, 23 Mar 2017 18:30:02 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
:
Bug#858546
; Package src:libxslt
.
(Sun, 26 Mar 2017 18:00:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Extra info received and forwarded to list. Copy sent to Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
.
(Sun, 26 Mar 2017 18:00:03 GMT) (full text, mbox, link).
Message #20 received at 858546@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
Control: tags 858546 + pending
Dear maintainer,
I've prepared an NMU for libxslt (versioned as 1.1.29-2.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.
Regards,
Salvatore
[libxslt-1.1.29-2.1-nmu.diff (text/x-diff, attachment)]
Added tag(s) pending.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to 858546-submit@bugs.debian.org
.
(Sun, 26 Mar 2017 18:00:03 GMT) (full text, mbox, link).
Reply sent
to Salvatore Bonaccorso <carnil@debian.org>
:
You have taken responsibility.
(Tue, 28 Mar 2017 18:06:03 GMT) (full text, mbox, link).
Notification sent
to Raphael Hertzog <hertzog@debian.org>
:
Bug acknowledged by developer.
(Tue, 28 Mar 2017 18:06:03 GMT) (full text, mbox, link).
Message #27 received at 858546-close@bugs.debian.org (full text, mbox, reply):
Source: libxslt
Source-Version: 1.1.29-2.1
We believe that the bug you reported is fixed in the latest version of
libxslt, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 858546@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libxslt package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 26 Mar 2017 19:44:01 +0200
Source: libxslt
Binary: libxslt1.1 libxslt1-dev libxslt1-dbg xsltproc python-libxslt1 python-libxslt1-dbg
Architecture: source
Version: 1.1.29-2.1
Distribution: unstable
Urgency: high
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 858546
Description:
libxslt1-dbg - XSLT 1.0 processing library - debugging symbols
libxslt1-dev - XSLT 1.0 processing library - development kit
libxslt1.1 - XSLT 1.0 processing library - runtime library
python-libxslt1 - Python bindings for libxslt1
python-libxslt1-dbg - Python bindings for libxslt1 (debug extension)
xsltproc - XSLT 1.0 command line processor
Changes:
libxslt (1.1.29-2.1) unstable; urgency=high
.
* Non-maintainer upload.
* Check for integer overflow in xsltAddTextString (CVE-2017-5029)
(Closes: #858546)
Checksums-Sha1:
4306ce120f020510fa7dd457353ea5890a01daa5 2535 libxslt_1.1.29-2.1.dsc
3951962a90bb54ee21f56b130287b0510f192a1b 28548 libxslt_1.1.29-2.1.debian.tar.xz
Checksums-Sha256:
8823c0cb209943fb1a3f6761b9a1b3c49c0348da3aa7a67ff9e09760c0976410 2535 libxslt_1.1.29-2.1.dsc
93ef76669dae1bdfdd5f60418e29ccda60c7b693b67d0da81e7d12ffb6d25085 28548 libxslt_1.1.29-2.1.debian.tar.xz
Files:
497c9817c9d8758e46a3aa8e2f577536 2535 text optional libxslt_1.1.29-2.1.dsc
1ec61a61983c71cc2a34b8bc348b02ee 28548 text optional libxslt_1.1.29-2.1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAljX/tpfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89ERGcP/069NxPjhkV2ZyYbcnl04qH+U01mm5I+
MZnv9Ho42r+na6zpp8Ex1jTJHELbq6SwG3ADtZKGMuHhuuL7T/bPa7ivdKpyeEYn
wuUacx6CIEWr+oyFJiuBuQw9MlJy3JuHBH06G8gIltxJj8dvuFUrvCnVwRWL63jJ
QYZtGLBLiF/RcFXdF0rl/jBl2TVXVGgYGKz3/O1GkPUknKJm9bf7UYj/hxqjGu/9
DSNBSKNxgGRKoi8JmiYCP0shRv7qzRX+IU0FEtlWb3dUfkRLFJSL5PGG17pCnuOM
Y0p3f30SXs9VNr6aDGAC0Kd7oVShAEgnaliwa4iAe/iJYxF2rwpGKshHBxVx16yo
qyiFHi4SASmVCfUhgI0cvCSQjlnW6ythFe1Y2uHywVa44/lL0Udh4m0s494CrUKy
JS+ypUvI3D15yxm4uQkID3JROt5EH2mLvyWp+z2spURa665Bqqi/NxrcaN4pOivZ
PQhaV0AlUMUZTbRhegtwCVIUnP4HkV8YYPZ05vdNtYNNFAowdX/RMQtOG1m4e8bf
LvkAp26rWdhBckFG2tTIOkZuSWHhjGhJDkIfaGrth9RzzSt9nhmkkS+/Gg0IOhki
QfT5qxtAlobGMaQ5jc8Ro5OHibmmcA1h6m4y6qjnSc2qq/PSYocqUPsO9GHsz1zG
mqp97sRW3iR4
=X5Od
-----END PGP SIGNATURE-----
Reply sent
to Salvatore Bonaccorso <carnil@debian.org>
:
You have taken responsibility.
(Tue, 25 Apr 2017 19:51:09 GMT) (full text, mbox, link).
Notification sent
to Raphael Hertzog <hertzog@debian.org>
:
Bug acknowledged by developer.
(Tue, 25 Apr 2017 19:51:09 GMT) (full text, mbox, link).
Message #32 received at 858546-close@bugs.debian.org (full text, mbox, reply):
Source: libxslt
Source-Version: 1.1.28-2+deb8u3
We believe that the bug you reported is fixed in the latest version of
libxslt, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 858546@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libxslt package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 14 Apr 2017 08:28:09 +0200
Source: libxslt
Binary: libxslt1.1 libxslt1-dev libxslt1-dbg xsltproc python-libxslt1 python-libxslt1-dbg
Architecture: source
Version: 1.1.28-2+deb8u3
Distribution: jessie
Urgency: medium
Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 858546
Description:
libxslt1-dbg - XSLT 1.0 processing library - debugging symbols
libxslt1-dev - XSLT 1.0 processing library - development kit
libxslt1.1 - XSLT 1.0 processing library - runtime library
python-libxslt1 - Python bindings for libxslt1
python-libxslt1-dbg - Python bindings for libxslt1 (debug extension)
xsltproc - XSLT 1.0 command line processor
Changes:
libxslt (1.1.28-2+deb8u3) jessie; urgency=medium
.
* Non-maintainer upload.
* Check for integer overflow in xsltAddTextString (CVE-2017-5029)
(Closes: #858546)
Checksums-Sha1:
109d85f493c890b4f678beed3a1eed2112482ca6 2558 libxslt_1.1.28-2+deb8u3.dsc
f1970082becafde3a887caefb1052f2e4592aaa7 38232 libxslt_1.1.28-2+deb8u3.debian.tar.xz
Checksums-Sha256:
3f6ef4e304e36b1cc6d07747bca5d3ae960829a816afaf33612b9e49ec4aa32a 2558 libxslt_1.1.28-2+deb8u3.dsc
cd29e58484bae65a6bbd755db32fe5201d5ed9ddbbc39c6068b6264f9c3d9545 38232 libxslt_1.1.28-2+deb8u3.debian.tar.xz
Files:
f65e05803ce50dff13576bbb7da03b69 2558 text optional libxslt_1.1.28-2+deb8u3.dsc
13f99638f7814df18409b7928e0e9351 38232 text optional libxslt_1.1.28-2+deb8u3.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAljwbTFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EdzIQAJDaDtE3LYu0/5IFtfvm3sVfTai9qnrS
eL8xk/ujA64DVHq/nRVjTY8BTk13KAASYsGk9msQ59sOTTNNIQIOFuQT145KSyjT
iUc7nuaHoGYody8Lq45daNOUV/MNoAFINAdYWpWYQ+c2jbBbYEiq7ZXvYMtn6W8t
6MUegF3BXv9H8IxBOJdC/72FMbQaSGnlvOUD6thMEFGmfjICsMq3KtIEUaIkK+ai
GhMQJjp5N0WlSIGFsydfbsZCKUwbGHSCCH2Tb748zr/nneHqElB91TYETtS4RmOe
8BWJkZNRrQJwrPcb5My+mXY8DvEHwhaMFRR0Wb7+tqnXOkvcWDsl5vdrJ1eMNIpu
+I1Hn9P/6eGejUJBPnVu7Ri7f09RRKyyMGHaCgcsrOTuYVYCsYY+5LNKRI2joGP5
dqb6Tm55ITBqvnYKM8qCJRpWXXNBFfPU10GlTvYCzf+C7VAJOh9auDHRrdhsdG84
/SIguod52ohTjQbpWRRZmv/S57Rek0au5IbrwioZ7oByB9+kUfBqD2gHHpXoOmk7
+2y4Kq6FNHD37BRLv4v3afsA4t0wd701giU6X6tgRTdSsRpeqnl+uaBFiDxH40xK
2AK2cfjBak7SxkeZSNx7iaKBfHthm2Sw5QnxtW3uZwizz5vN8U4VOL5y0hXjyX9/
bvM2uQmRIAdd
=I0uh
-----END PGP SIGNATURE-----
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org
.
(Sun, 04 Jun 2017 07:29:30 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 15:17:30 2019;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.