libarchive: CVE-2013-0211

Debian Bug report logs - #703957
libarchive: CVE-2013-0211

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libarchive: CVE-2013-0211

Date: Tue, 26 Mar 2013 09:01:44 +0100

Package: libarchive
Severity: grave
Tags: security

Please see here for details and a link to the upstream commit:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0211

Cheers,
        Moritz

Message #10 received at 703957@bugs.debian.org (full text, mbox, reply):

From: Prach Pongpanich <prachpub@gmail.com>

To: 703957@bugs.debian.org

Cc: control@bugs.debian.org

Date: Tue, 26 Mar 2013 17:02:49 +0700

[Message part 1 (text/plain, inline)]

tags 703957 + patch
thanks

Dear maintainer,

 I have prepared a patch (DEP-3 format) from upstream, which solves
the this bug (libarchive-3.0.4).

Regards,

-- 
 Prach Pongpanich

[fix-CVE-2013-0211.patch (application/octet-stream, attachment)]

Message #17 received at 703957@bugs.debian.org (full text, mbox, reply):

From: Andreas Henriksson <andreas@fatal.se>

To: Prach Pongpanich <prachpub@gmail.com>, 703957@bugs.debian.org

Subject: Re: Bug#703957:

Date: Wed, 27 Mar 2013 17:30:56 +0100

Hello!

On Tue, Mar 26, 2013 at 05:02:49PM +0700, Prach Pongpanich wrote:
> tags 703957 + patch
> thanks
> 
> Dear maintainer,
> 
>  I have prepared a patch (DEP-3 format) from upstream, which solves
> the this bug (libarchive-3.0.4).

Thanks for preparing a prettified patch.....

It deviates from https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4 and doesn't build though....

Where did you get the patch from or why did you modify it?

Should I be worried?


-- 
Andreas Henriksson

Message #22 received at 703957-close@bugs.debian.org (full text, mbox, reply):

From: Andreas Henriksson <andreas@fatal.se>

To: 703957-close@bugs.debian.org

Subject: Bug#703957: fixed in libarchive 3.0.4-3

Date: Wed, 27 Mar 2013 16:47:35 +0000

Source: libarchive
Source-Version: 3.0.4-3

We believe that the bug you reported is fixed in the latest version of
libarchive, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 703957@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Henriksson <andreas@fatal.se> (supplier of updated libarchive package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 27 Mar 2013 16:20:36 +0100
Source: libarchive
Binary: libarchive-dev libarchive12 bsdtar bsdcpio
Architecture: source amd64
Version: 3.0.4-3
Distribution: unstable
Urgency: low
Maintainer: Debian Libarchive Maintainers <ah-libarchive@debian.org>
Changed-By: Andreas Henriksson <andreas@fatal.se>
Description: 
 bsdcpio    - Implementation of the 'cpio' program from FreeBSD
 bsdtar     - Implementation of the 'tar' program from FreeBSD
 libarchive-dev - Multi-format archive and compression library (development files)
 libarchive12 - Multi-format archive and compression library (shared library)
Closes: 703957
Changes: 
 libarchive (3.0.4-3) unstable; urgency=low
 .
   * Add patch that fixes CVE-2013-0211. (Closes: #703957)
Checksums-Sha1: 
 8779cb5de0b33cdeed326c8a1d16df95e0c64ab7 1612 libarchive_3.0.4-3.dsc
 75d22645a3d7cec37493a3f98ee6ba62096ef540 10485 libarchive_3.0.4-3.debian.tar.gz
 80695edf2f8eb59ac6481d8e595414535573521f 472080 libarchive-dev_3.0.4-3_amd64.deb
 6fd2bbb4ce0da534dde1513850e8e07a7fc226be 303302 libarchive12_3.0.4-3_amd64.deb
 a53624f9ccdc83b92039f2c587fc38bcef1ee3e6 54464 bsdtar_3.0.4-3_amd64.deb
 d4c2f2606ec2adb019c83d03ddfad46c4494c33b 40920 bsdcpio_3.0.4-3_amd64.deb
Checksums-Sha256: 
 a77c593331a3297d7ddd4e163b47cac8df1e4e4186e18d5285f5abbd739c9291 1612 libarchive_3.0.4-3.dsc
 f02a4732419611d8408b56e4b0bb0599b11b51fe7a486510cea0a2598c6418f1 10485 libarchive_3.0.4-3.debian.tar.gz
 e88f23a7c353b02c3a42a108c45c47c5cb44917a9e3259c48d8c11373c95a28c 472080 libarchive-dev_3.0.4-3_amd64.deb
 04a2cd31bdb55aa92f2a1397f23afb75206961d5409ef35515536b2584753743 303302 libarchive12_3.0.4-3_amd64.deb
 c4edb84294dbd1ef29bcb12ac90638ec9942406e2c404524dcc94725830c5c72 54464 bsdtar_3.0.4-3_amd64.deb
 d685078862097671873298def027079a33e0a1f836a33709b6666d8e2853ab63 40920 bsdcpio_3.0.4-3_amd64.deb
Files: 
 f7140c88c796b9c6a30b0d75e3afc307 1612 libs optional libarchive_3.0.4-3.dsc
 5976b01ba059e84275d61ddcaf734aee 10485 libs optional libarchive_3.0.4-3.debian.tar.gz
 1fd4f80bc06255544495c3f42de3e9e7 472080 libdevel optional libarchive-dev_3.0.4-3_amd64.deb
 b71d9a0730764de352ffd38c70911fc4 303302 libs optional libarchive12_3.0.4-3_amd64.deb
 41031b90dad3c53e039d5e7e0ccef96c 54464 utils optional bsdtar_3.0.4-3_amd64.deb
 9cb778371675459d448d5ab66dbfa329 40920 utils optional bsdcpio_3.0.4-3_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlFTH6oACgkQcgQ2cL3l8e730ACgqWy5msPksM3e1A8k7FbsNs4d
PhIAoLBqtwT4/9IcdQtBK07ghcohTb0M
=teum
-----END PGP SIGNATURE-----

Message #27 received at 703957@bugs.debian.org (full text, mbox, reply):

From: Prach Pongpanich <prachpub@gmail.com>

To: Andreas Henriksson <andreas@fatal.se>

Cc: 703957@bugs.debian.org

Subject: Re: Bug#703957:

Date: Wed, 27 Mar 2013 23:59:57 +0700

Hi Andreas,

On Wed, Mar 27, 2013 at 11:30 PM, Andreas Henriksson <andreas@fatal.se> wrote:
> It deviates from https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4 and doesn't build though....
>
> Where did you get the patch from or why did you modify it?

 I got it from https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4

 I fail to build from source: libarchive_3.0.4-2

 dget http://http.debian.net/debian/pool/main/liba/libarchive/libarchive_3.0.4-2.dsc
 pbuilder build  libarchive_3.0.4-2.dsc
-------------------
configure: exit 77
dh_auto_configure: ./configure --build=x86_64-linux-gnu --prefix=/usr
--includedir=${prefix}/include --mandir=${prefix}/share/man
--infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var
--libdir=${prefix}/lib/x86_64-linux-gnu
--libexecdir=${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode
--disable-dependency-tracking --without-openssl --with-nettle
--enable-bsdtar=shared --enable-bsdcpio=shared returned exit code 77
make[1]: *** [override_dh_auto_configure] Error 255
make[1]: Leaving directory `/tmp/buildd/libarchive-3.0.4'
make: *** [build] Error 2
dpkg-buildpackage: error: debian/rules build gave error exit status 2


Regrads,

-- 
 Prach Pongpanich

Send a report that this bug log contains spam.