libsdl1.2: Multiple security issues

Debian Bug report logs - #924609
libsdl1.2: Multiple security issues

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libsdl1.2: Multiple security issues

Date: Thu, 14 Mar 2019 22:32:28 +0100

Source: libsdl1.2
Severity: grave
Tags: security

Hi,
a number of security issues were found in SDL, please see the following
links for references.

https://security-tracker.debian.org/tracker/CVE-2019-7638
https://security-tracker.debian.org/tracker/CVE-2019-7637
https://security-tracker.debian.org/tracker/CVE-2019-7636
https://security-tracker.debian.org/tracker/CVE-2019-7635
https://security-tracker.debian.org/tracker/CVE-2019-7578
https://security-tracker.debian.org/tracker/CVE-2019-7577
https://security-tracker.debian.org/tracker/CVE-2019-7576
https://security-tracker.debian.org/tracker/CVE-2019-7575
https://security-tracker.debian.org/tracker/CVE-2019-7574
https://security-tracker.debian.org/tracker/CVE-2019-7573
https://security-tracker.debian.org/tracker/CVE-2019-7572

Some bugs have links to upstream fixes, I think we can go ahead and
merge those. The others have proposed patches, but let's not rush
any upload and wait until these are properly reviewed/merged by
upstream.

Cheers,
        Moritz

Message #16 received at 924609@bugs.debian.org (full text, mbox, reply):

From: Kari Pahula <kaol@debian.org>

To: 924609@bugs.debian.org

Subject: Ports of CVE patches from Debian LTS for libsdl1.2

Date: Wed, 24 Apr 2019 19:15:44 +0300

[Message part 1 (text/plain, inline)]

Hi.

I've ported the CVE patches from Debian LTS for libsdl1.2 in unstable.

[libsdl1.2-0001-Port-patches-from-Debian-LTS-release-for-CVE-bugs.patch (text/x-diff, attachment)]

Message #23 received at 924609@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Kari Pahula <kaol@debian.org>

Cc: 924609@bugs.debian.org, 924610@bugs.debian.org, jmm@debian.org, team@security.debian.org

Subject: Re: Bug#924609: Ports of CVE patches from Debian LTS for libsdl1.2

Date: Wed, 24 Apr 2019 21:33:55 +0200

Hi Kari,

On Wed, Apr 24, 2019 at 07:15:44PM +0300, Kari Pahula wrote:
> Hi.
> 
> I've ported the CVE patches from Debian LTS for libsdl1.2 in unstable.

First thanks for working on the issues!

I have not reviewed your patches, but just a remark. Never just
forward-port a patchset from an older suite to newer (although the
version is identical here).

Furthermore as Moritz pointed out, at time of writing the bugreport,
only some of the bugs got patches, but not all were merged upstream,
several of the CVEs got later on upstream patches rather then
previously linked ones from the bugzilla.  We should base the upload
based on the current upstream patches which by now should be complete
(but double check the updated references in the security-tracker).

Regards,
Salvatore

Message #28 received at 924609@bugs.debian.org (full text, mbox, reply):

From: Felix Geyer <fgeyer@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 924610@bugs.debian.org, Kari Pahula <kaol@debian.org>

Cc: jmm@debian.org, team@security.debian.org, 924609@bugs.debian.org

Subject: Re: Bug#924610: Bug#924609: Ports of CVE patches from Debian LTS for libsdl1.2

Date: Mon, 29 Apr 2019 16:56:27 +0200

Hi,

On 24.04.19 21:33, Salvatore Bonaccorso wrote:
> Hi Kari,
>
> On Wed, Apr 24, 2019 at 07:15:44PM +0300, Kari Pahula wrote:
>> Hi.
>>
>> I've ported the CVE patches from Debian LTS for libsdl1.2 in unstable.
> First thanks for working on the issues!
>
> I have not reviewed your patches, but just a remark. Never just
> forward-port a patchset from an older suite to newer (although the
> version is identical here).
>
> Furthermore as Moritz pointed out, at time of writing the bugreport,
> only some of the bugs got patches, but not all were merged upstream,
> several of the CVEs got later on upstream patches rather then
> previously linked ones from the bugzilla.  We should base the upload
> based on the current upstream patches which by now should be complete
> (but double check the updated references in the security-tracker).


Unfortunately there are still some bug reports without merged fixes.
I've kept the Debian security tracker up-to-date in this regard
(the CVEs with committed patches have a link to them).

Felix

Message #33 received at 924609@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Felix Geyer <fgeyer@debian.org>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 924610@bugs.debian.org, Kari Pahula <kaol@debian.org>, team@security.debian.org, 924609@bugs.debian.org

Subject: Re: Bug#924610: Bug#924609: Ports of CVE patches from Debian LTS for libsdl1.2

Date: Mon, 29 Apr 2019 22:30:21 +0200

On Mon, Apr 29, 2019 at 04:56:27PM +0200, Felix Geyer wrote:
> Hi,
> 
> On 24.04.19 21:33, Salvatore Bonaccorso wrote:
> > Hi Kari,
> > 
> > On Wed, Apr 24, 2019 at 07:15:44PM +0300, Kari Pahula wrote:
> > > Hi.
> > > 
> > > I've ported the CVE patches from Debian LTS for libsdl1.2 in unstable.
> > First thanks for working on the issues!
> > 
> > I have not reviewed your patches, but just a remark. Never just
> > forward-port a patchset from an older suite to newer (although the
> > version is identical here).
> > 
> > Furthermore as Moritz pointed out, at time of writing the bugreport,
> > only some of the bugs got patches, but not all were merged upstream,
> > several of the CVEs got later on upstream patches rather then
> > previously linked ones from the bugzilla.  We should base the upload
> > based on the current upstream patches which by now should be complete
> > (but double check the updated references in the security-tracker).
> 
> 
> Unfortunately there are still some bug reports without merged fixes.
> I've kept the Debian security tracker up-to-date in this regard
> (the CVEs with committed patches have a link to them).

For sdl-image1.2 we can already go ahead with an unstable upload, right?
The only issue affecting it, was merged.

Cheers,
        Moritz

Send a report that this bug log contains spam.