CVE-2010-2812 and CVE-2010-2934

Debian Bug report logs - #599708
CVE-2010-2812 and CVE-2010-2934

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2010-2812 and CVE-2010-2934

Date: Sun, 10 Oct 2010 13:19:11 +0200

Package: znc
Severity: grave
Tags: security

CVE-2010-2812 and CVE-2010-2934 are currently only
fixed in experimental, but not sid and Squeeze. The
Red Hat bug contains references to the patches:
https://bugzilla.redhat.com/show_bug.cgi?id=622600

Cheers,
        Moritz

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-5-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Versions of packages znc depends on:
ii  libc6                         2.11.2-2   Embedded GNU C Library: Shared lib
ii  libgcc1                       1:4.4.4-9  GCC support library
ii  libperl5.10                   5.10.1-14  shared Perl library
ii  libssl0.9.8                   0.9.8o-1   SSL shared libraries
ii  libstdc++6                    4.4.4-9    The GNU Standard C++ Library v3

znc recommends no packages.

znc suggests no packages.

Message #10 received at 599708@bugs.debian.org (full text, mbox, reply):

From: Patrick Matthäi <pmatthaei@debian.org>

To: Moritz Muehlenhoff <jmm@debian.org>, 599708@bugs.debian.org

Subject: Re: Bug#599708: CVE-2010-2812 and CVE-2010-2934

Date: Sun, 10 Oct 2010 13:30:39 +0200

Hm?
This is patched since 0.092-2 with 01-out-of-range-error.diff
At the time where I patched it, there was no CVE ID available

Am 10.10.2010 13:19, schrieb Moritz Muehlenhoff:
> Package: znc
> Severity: grave
> Tags: security
>
> CVE-2010-2812 and CVE-2010-2934 are currently only
> fixed in experimental, but not sid and Squeeze. The
> Red Hat bug contains references to the patches:
> https://bugzilla.redhat.com/show_bug.cgi?id=622600
>
> Cheers,
>          Moritz
>
> -- System Information:
> Debian Release: squeeze/sid
>    APT prefers unstable
>    APT policy: (500, 'unstable')
> Architecture: i386 (i686)
>
> Kernel: Linux 2.6.32-5-686 (SMP w/1 CPU core)
> Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro (charmap=ISO-8859-15)
> Shell: /bin/sh linked to /bin/bash
>
> Versions of packages znc depends on:
> ii  libc6                         2.11.2-2   Embedded GNU C Library: Shared lib
> ii  libgcc1                       1:4.4.4-9  GCC support library
> ii  libperl5.10                   5.10.1-14  shared Perl library
> ii  libssl0.9.8                   0.9.8o-1   SSL shared libraries
> ii  libstdc++6                    4.4.4-9    The GNU Standard C++ Library v3
>
> znc recommends no packages.
>
> znc suggests no packages.
>
>

Message #15 received at 599708@bugs.debian.org (full text, mbox, reply):

From: Uli Schlachter <psychon@znc.in>

To: Moritz Muehlenhoff <jmm@debian.org>, 599708@bugs.debian.org

Subject: Re: Bug#599708: CVE-2010-2812 and CVE-2010-2934

Date: Sun, 10 Oct 2010 13:47:21 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Am 10.10.2010 13:19, Moritz Muehlenhoff wrote:
> Package: znc
> Severity: grave
> Tags: security
> 
> CVE-2010-2812 and CVE-2010-2934 are currently only
> fixed in experimental, but not sid and Squeeze. The
> Red Hat bug contains references to the patches:
> https://bugzilla.redhat.com/show_bug.cgi?id=622600
> 
> Cheers,
>         Moritz

- From a quick look at the source package, the included patch
"01-out-of-range-error.diff" seems to fix exactly this.[1]
According to the patch description this would be a dupe of bug #592064.

Cheers,
Uli

[1]
http://patch-tracker.debian.org/patch/series/view/znc/0.092-3/01-out-of-range-error.diff

- -- 
- - Buck, when, exactly, did you lose your mind?
- - Three months ago. I woke up one morning married to a pineapple.
  An ugly pineapple... But I loved her
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBCAAGBQJMsae+AAoJECLkKOvLj8sGqWwH/A49dSZCnA9VNlSUap/9QVq6
ADSSicKT6qc6mmZHW2rixzI5FLLIscaLOA6BqtE+S8jyyiLsJD1nfeO45sbxoRTX
N0AeB6pJgL5kS65VgttGbynwU67pUYy27O5ipoHYeMUNQwnl64Z1hfuo0JSnH7gD
2VrgPiIxVFBAfP6VQk2ZxDNKg+6Ehrhpfpajav6rDqiuPlQA+KmxovHxNRzp2eXG
iYT3QdJfN3A5WHUOsPh4+flB4+cNd9VtDMfkACK5zNZwSV+OltGy0605txl6pBMm
T+cXlPM+Z18StQJsdhSpwABrINlflQLBGX0NIAhSFljwtXLnLv7rhRr9JlfZb0c=
=zCX6
-----END PGP SIGNATURE-----

Message #20 received at 599708-done@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Uli Schlachter <psychon@znc.in>

Cc: 599708-done@bugs.debian.org

Subject: Re: Bug#599708: CVE-2010-2812 and CVE-2010-2934

Date: Sun, 10 Oct 2010 19:09:26 +0200

Version: 0.092-2

On Sun, Oct 10, 2010 at 01:47:21PM +0200, Uli Schlachter wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> Am 10.10.2010 13:19, Moritz Muehlenhoff wrote:
> > Package: znc
> > Severity: grave
> > Tags: security
> > 
> > CVE-2010-2812 and CVE-2010-2934 are currently only
> > fixed in experimental, but not sid and Squeeze. The
> > Red Hat bug contains references to the patches:
> > https://bugzilla.redhat.com/show_bug.cgi?id=622600
> > 
> > Cheers,
> >         Moritz
> 
> - From a quick look at the source package, the included patch
> "01-out-of-range-error.diff" seems to fix exactly this.[1]
> According to the patch description this would be a dupe of bug #592064.

Ok, marking as fixed in the Security Tracker.

Cheers,
        Moritz

Send a report that this bug log contains spam.