enscript: Buffer overflows

Debian Bug report logs - #506261
enscript: Buffer overflows

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: enscript: Buffer overflows

Date: Wed, 19 Nov 2008 23:29:21 +0100

[Message part 1 (text/plain, inline)]

Package: enscript
Version: 1.6.4-12
Severity: grave
Tags: security
Justification: user security hole

Hi, 
buffer overflows have been discovered in enscript:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4306

I'm attaching a patch by Werner Fink of SuSE covering these
issues.

Cheers,
        Moritz

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Versions of packages enscript depends on:
ii  libc6                        2.7-15      GNU C Library: Shared libraries
ii  libpaper1                    1.1.23+nmu1 library for handling paper charact

enscript recommends no packages.

Versions of packages enscript suggests:
ii  ghostscript [postscript- 8.62.dfsg.1-3.1 The GPL Ghostscript PostScript/PDF
ii  lpr                      1:2008.05.17    BSD lpr/lpd line printer spooling 

-- no debconf information

[enscript-security.patch (text/x-c, attachment)]

Message #10 received at 506261@bugs.debian.org (full text, mbox, reply):

From: Florian Weimer <fw@deneb.enyo.de>

To: 506261@bugs.debian.org

Subject: Re: Bug#506261: enscript: Buffer overflows

Date: Wed, 19 Nov 2008 23:42:20 +0100

* Moritz Muehlenhoff:

> Hi, 
> buffer overflows have been discovered in enscript:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4306
>
> I'm attaching a patch by Werner Fink of SuSE covering these
> issues.

While you are at it, please update the manpage regarding the espf
special escape (command execution is no longer possible).

Message #15 received at 506261@bugs.debian.org (full text, mbox, reply):

From: Tim Retout <tim@retout.co.uk>

To: Moritz Muehlenhoff <jmm@debian.org>, 506261@bugs.debian.org

Cc: Florian Weimer <fw@deneb.enyo.de>

Subject: Re: Bug#506261: enscript: Buffer overflows

Date: Wed, 19 Nov 2008 22:53:22 +0000

On Wed, 2008-11-19 at 23:29 +0100, Moritz Muehlenhoff wrote:
> Package: enscript
> Version: 1.6.4-12
> Severity: grave
> Tags: security
> Justification: user security hole
> 
> Hi, 
> buffer overflows have been discovered in enscript:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4306
> 
> I'm attaching a patch by Werner Fink of SuSE covering these
> issues.

Thanks. There go my hopes for a quiet lenny release. :)

I'm just building a patched package. I can look at the manpage issue as
well, but it's quite late here.

-- 
Tim Retout <tim@retout.co.uk>

Message #20 received at 506261@bugs.debian.org (full text, mbox, reply):

From: Tim Retout <tim@retout.co.uk>

To: Moritz Muehlenhoff <jmm@debian.org>, 506261@bugs.debian.org

Subject: Re: Bug#506261: enscript: Buffer overflows

Date: Wed, 19 Nov 2008 23:03:53 +0000

[Message part 1 (text/plain, inline)]

On Wed, 2008-11-19 at 23:29 +0100, Moritz Muehlenhoff wrote:
> I'm attaching a patch by Werner Fink of SuSE covering these
> issues.

How does this debdiff look?

-- 
Tim Retout <tim@retout.co.uk>

[enscript.diff (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #25 received at 506261@bugs.debian.org (full text, mbox, reply):

From: Tim Retout <tim@retout.co.uk>

To: Moritz Muehlenhoff <jmm@debian.org>, 506261@bugs.debian.org

Subject: Re: Bug#506261: enscript: Buffer overflows

Date: Thu, 20 Nov 2008 23:18:36 +0000

On Wed, 2008-11-19 at 23:29 +0100, Moritz Muehlenhoff wrote:
> Package: enscript
> Version: 1.6.4-12
> Severity: grave
> Tags: security
> Justification: user security hole
> 
> Hi, 
> buffer overflows have been discovered in enscript:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3863
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4306
> 
> I'm attaching a patch by Werner Fink of SuSE covering these
> issues.

Right, lamby is sponsoring this for me. I added the CVE numbers to the
changelog entry and the patch header.

Would you like a package for stable-security?

-- 
Tim Retout <tim@retout.co.uk>

Message #30 received at 506261-close@bugs.debian.org (full text, mbox, reply):

From: Tim Retout <tim@retout.co.uk>

To: 506261-close@bugs.debian.org

Subject: Bug#506261: fixed in enscript 1.6.4-13

Date: Thu, 20 Nov 2008 23:32:04 +0000

Source: enscript
Source-Version: 1.6.4-13

We believe that the bug you reported is fixed in the latest version of
enscript, which is due to be installed in the Debian FTP archive:

enscript_1.6.4-13.diff.gz
  to pool/main/e/enscript/enscript_1.6.4-13.diff.gz
enscript_1.6.4-13.dsc
  to pool/main/e/enscript/enscript_1.6.4-13.dsc
enscript_1.6.4-13_amd64.deb
  to pool/main/e/enscript/enscript_1.6.4-13_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 506261@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tim Retout <tim@retout.co.uk> (supplier of updated enscript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 19 Nov 2008 22:45:35 +0000
Source: enscript
Binary: enscript
Architecture: source amd64
Version: 1.6.4-13
Distribution: unstable
Urgency: high
Maintainer: Tim Retout <tim@retout.co.uk>
Changed-By: Tim Retout <tim@retout.co.uk>
Description: 
 enscript   - Converts ASCII text to Postscript, HTML, RTF or Pretty-Print
Closes: 506261
Changes: 
 enscript (1.6.4-13) unstable; urgency=high
 .
   * debian/patches/506261-buffer-overflows: New patch by Werner Fink to fix
     buffer overflows: CVE-2008-3863, CVE-2008-4306. (Closes: #506261)
   * Urgency set to "high" for RC security bugfix.
Checksums-Sha1: 
 b426e990a686dce46781fc3f8cce27016352f1c4 1010 enscript_1.6.4-13.dsc
 024a1cf82af439963f71974947333a75ac090b26 93092 enscript_1.6.4-13.diff.gz
 f7878a4a6155de1740eea8eb1c75afe37557783a 536804 enscript_1.6.4-13_amd64.deb
Checksums-Sha256: 
 a09d3f6db4ddf87bfdd9a65d149700b8abc1e999766978db80e8459aef7791c2 1010 enscript_1.6.4-13.dsc
 b9721fe5435d6f1fa6113313738a549e580dd59d2319ad1d8d4af52d62a89892 93092 enscript_1.6.4-13.diff.gz
 dc59c254b96540e9fb631ad72cb716827e81505dc6554c430a1243623d46a93e 536804 enscript_1.6.4-13_amd64.deb
Files: 
 47bc977491f403de90ff249249d339e9 1010 text optional enscript_1.6.4-13.dsc
 45124974a746d0bef4cbf0b6e9523257 93092 text optional enscript_1.6.4-13.diff.gz
 ef9291593d4dd06bb305602e624f6057 536804 text optional enscript_1.6.4-13_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkl8OQACgkQ5/8uW2NPmiAOUgCfUfql//D6kC/rw0L/YZJEYHKw
srsAn3iziP+l+OdrCfe4cjXyh4nHXSkF
=7hpo
-----END PGP SIGNATURE-----

Message #35 received at 506261-close@bugs.debian.org (full text, mbox, reply):

From: Tim Retout <tim@retout.co.uk>

To: 506261-close@bugs.debian.org

Subject: Bug#506261: fixed in enscript 1.6.4-11.1

Date: Thu, 04 Dec 2008 19:52:37 +0000

Source: enscript
Source-Version: 1.6.4-11.1

We believe that the bug you reported is fixed in the latest version of
enscript, which is due to be installed in the Debian FTP archive:

enscript_1.6.4-11.1.diff.gz
  to pool/main/e/enscript/enscript_1.6.4-11.1.diff.gz
enscript_1.6.4-11.1.dsc
  to pool/main/e/enscript/enscript_1.6.4-11.1.dsc
enscript_1.6.4-11.1_i386.deb
  to pool/main/e/enscript/enscript_1.6.4-11.1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 506261@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tim Retout <tim@retout.co.uk> (supplier of updated enscript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun, 23 Nov 2008 18:10:35 +0000
Source: enscript
Binary: enscript
Architecture: source i386
Version: 1.6.4-11.1
Distribution: stable-security
Urgency: high
Maintainer: Christoph Berg <myon@debian.org>
Changed-By: Tim Retout <tim@retout.co.uk>
Description: 
 enscript   - Converts ASCII text to Postscript, HTML, RTF or Pretty-Print
Closes: 506261
Changes: 
 enscript (1.6.4-11.1) stable-security; urgency=high
 .
   * debian/patches/506261-buffer-overflows: New patch by Werner Fink to fix
     buffer overflows: CVE-2008-3863, CVE-2008-4306. (Closes: #506261)
   * Urgency set to "high" for RC security bugfix.
Files: 
 b5e8009c5ef20c0bf2089e3c43881daf 631 text optional enscript_1.6.4-11.1.dsc
 b5174b59e4a050fb462af5dbf28ebba3 1036734 text optional enscript_1.6.4.orig.tar.gz
 87e85119b278fa214b29f84eda3944a4 91162 text optional enscript_1.6.4-11.1.diff.gz
 a2d60b314df3903c55d427f6c30aa0b4 487696 text optional enscript_1.6.4-11.1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkpvtsACgkQXm3vHE4uylrWzQCeLrwrvtf9tFcIOI5ibcDoHJUg
eWkAoJ6cr1Hk/DRLVb+UBMpDzhZD2UDn
=65V2
-----END PGP SIGNATURE-----

Message #40 received at 506261-close@bugs.debian.org (full text, mbox, reply):

From: Tim Retout <tim@retout.co.uk>

To: 506261-close@bugs.debian.org

Subject: Bug#506261: fixed in enscript 1.6.4-11.1

Date: Wed, 17 Dec 2008 21:02:56 +0000

Source: enscript
Source-Version: 1.6.4-11.1

We believe that the bug you reported is fixed in the latest version of
enscript, which is due to be installed in the Debian FTP archive:

enscript_1.6.4-11.1.diff.gz
  to pool/main/e/enscript/enscript_1.6.4-11.1.diff.gz
enscript_1.6.4-11.1.dsc
  to pool/main/e/enscript/enscript_1.6.4-11.1.dsc
enscript_1.6.4-11.1_i386.deb
  to pool/main/e/enscript/enscript_1.6.4-11.1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 506261@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tim Retout <tim@retout.co.uk> (supplier of updated enscript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun, 23 Nov 2008 18:10:35 +0000
Source: enscript
Binary: enscript
Architecture: source i386
Version: 1.6.4-11.1
Distribution: stable-security
Urgency: high
Maintainer: Christoph Berg <myon@debian.org>
Changed-By: Tim Retout <tim@retout.co.uk>
Description: 
 enscript   - Converts ASCII text to Postscript, HTML, RTF or Pretty-Print
Closes: 506261
Changes: 
 enscript (1.6.4-11.1) stable-security; urgency=high
 .
   * debian/patches/506261-buffer-overflows: New patch by Werner Fink to fix
     buffer overflows: CVE-2008-3863, CVE-2008-4306. (Closes: #506261)
   * Urgency set to "high" for RC security bugfix.
Files: 
 b5e8009c5ef20c0bf2089e3c43881daf 631 text optional enscript_1.6.4-11.1.dsc
 b5174b59e4a050fb462af5dbf28ebba3 1036734 text optional enscript_1.6.4.orig.tar.gz
 87e85119b278fa214b29f84eda3944a4 91162 text optional enscript_1.6.4-11.1.diff.gz
 a2d60b314df3903c55d427f6c30aa0b4 487696 text optional enscript_1.6.4-11.1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkkpvtsACgkQXm3vHE4uylrWzQCeLrwrvtf9tFcIOI5ibcDoHJUg
eWkAoJ6cr1Hk/DRLVb+UBMpDzhZD2UDn
=65V2
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.