python-rrdtool: CVE-2013-2131: format string vulnerability

Debian Bug report logs - #708866
python-rrdtool: CVE-2013-2131: format string vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: submit@bugs.debian.org

Subject: python-rrdtool: format string vulnerability

Date: Sun, 19 May 2013 12:59:48 +0300

[Message part 1 (text/plain, inline)]

Package: python-rrdtool
Version: 1.4.7-2
Severity: important
Tags: security

python -c "import rrdtool;rrdtool.graph('/tmp/out.png','-f','%n%n')"
Segmentation fault

Backtrace attached.

Reported in http://www.openwall.com/lists/oss-security/2013/04/18/5

-- System Information:
Debian Release: 7.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages python-rrdtool depends on:
ii  libc6    2.13-38
ii  librrd4  1.4.7-2
ii  python   2.7.3-4

python-rrdtool recommends no packages.

python-rrdtool suggests no packages.

-- no debconf information

[python-rrdtool-bt.txt (text/plain, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 708866@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: 708866@bugs.debian.org

Subject: Fixed in upstream

Date: Tue, 10 Sep 2013 19:19:37 +0300

[Message part 1 (text/plain, inline)]

https://github.com/oetiker/rrdtool-1.x/pull/397
https://github.com/yarda/rrdtool-1.x/commit/37d3050caed517538efa1f6fc28fda48aee3d53e

---
Henri Salo

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 708866-close@bugs.debian.org (full text, mbox, reply):

From: Sebastian Harl <tokkee@debian.org>

To: 708866-close@bugs.debian.org

Subject: Bug#708866: fixed in rrdtool 1.4.8-1

Date: Sat, 26 Apr 2014 21:57:08 +0000

Source: rrdtool
Source-Version: 1.4.8-1

We believe that the bug you reported is fixed in the latest version of
rrdtool, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 708866@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sebastian Harl <tokkee@debian.org> (supplier of updated rrdtool package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sat, 26 Apr 2014 21:18:20 +0200
Source: rrdtool
Binary: rrdtool rrdcached rrdtool-dbg librrd4 librrd-dev librrds-perl librrdp-perl rrdtool-tcl python-rrdtool ruby-rrd librrd-ruby librrd-ruby1.8 librrd-ruby1.9.1 liblua5.1-rrd0 liblua5.1-rrd-dev
Architecture: source amd64 all
Version: 1.4.8-1
Distribution: unstable
Urgency: medium
Maintainer: Debian RRDtool Team <rrdtool@ml.snow-crash.org>
Changed-By: Sebastian Harl <tokkee@debian.org>
Description: 
 liblua5.1-rrd-dev - time-series data storage and display system (Lua 5.1 development)
 liblua5.1-rrd0 - time-series data storage and display system (Lua 5.1 interface)
 librrd-dev - time-series data storage and display system (development)
 librrd-ruby - Transitional package to ruby-rrd
 librrd-ruby1.8 - Transitional package to ruby-rrd
 librrd-ruby1.9.1 - Transitional package to ruby-rrd
 librrd4    - time-series data storage and display system (runtime library)
 librrdp-perl - time-series data storage and display system (Perl interface, pipe
 librrds-perl - time-series data storage and display system (Perl interface, shar
 python-rrdtool - time-series data storage and display system (Python interface)
 rrdcached  - data caching daemon for RRDtool
 rrdtool    - time-series data storage and display system (programs)
 rrdtool-dbg - time-series data storage and display system (debugging symbols)
 rrdtool-tcl - time-series data storage and display system (Tcl interface)
 ruby-rrd   - time-series data storage and display system (Ruby interface)
Closes: 451852 663505 686825 708866 726159 736333 743947
Changes: 
 rrdtool (1.4.8-1) unstable; urgency=medium
 .
   [ Sebastian Harl ]
   * New upstream release; thanks to Alin Dobre for reporting this and
     providing various patches (Closes: #726159):
     - Fixed the xport JSON output format; thanks to Thomas Mainka for
       reporting this (Closes: #686825).
     - Fixed a segfault in rrdcached when using -j on non-existent directories;
       thanks to Witold Baryluk for reporting this (Closes: #663505).
     - Fixed segfault in rrdgraph caused by int32 overflows; thanks to Matej
       Kosik for reporting this (Closes: #451852).
   * Fixed changelog of 1.4.7-2 regarding the versioned build-dep on tcl-dev.
   * Merged 1.4.7-2.1 NMU; thanks to Christian Hofstaedtler (Closes: 736333).
   * debian/patches:
     - Added CVE-2013-2131; upstream patch fixing a format string vulnerability
       in rrdgraph; thanks to Henri Salo for reporting this (Closes: #708866).
       Raised urgency to medium for this.
   * debian/patches, debian/rules, debian/control:
     - Added build_ldadd; patch Makefile to pass $ALL_LIBS to rrdcached's
       linker flags to ensure it's going to be linked against libglib.
     - Build-depend on and use dh-autoreconf to manage the build_ldadd patch.
   * debian/control:
     - Optionally recommend fonts-dejavu-core as (the preferred) alternative to
       ttf-dejavu-core; thanks to Martin-Éric Racine for reporting this
       (Closes: #743947).
     - Updated standards-version to 3.9.5 -- no changes.
   * debian/rules:
     - Clean up bindings/perl-shared/MYMETA.json.
     - Added INSTALL_BASE= to the perl options; else, the Perl libs end up in
       $HOME.
 .
   [ Alin Dobre ]
   * debian/patches:
     - Removed bts664724-rrdcached-j-segfault, ruby_bindings_format_string,
       and tcl-8.5 which were applied upstream.
Checksums-Sha1: 
 23642e746e7116473f60a78087e275da2804f5a6 2424 rrdtool_1.4.8-1.dsc
 56d68857f39e70bfa32360947614d8220702ed02 1379482 rrdtool_1.4.8.orig.tar.gz
 a9ce1feaf8b333e9784bda0132a98296a2a96037 27681 rrdtool_1.4.8-1.diff.gz
 746ffa52bd2befe483f16c321b004dfc744a71eb 433814 rrdtool_1.4.8-1_amd64.deb
 89457234a068d337f919222224e43c16b3b40900 146062 rrdcached_1.4.8-1_amd64.deb
 58d61f8e771ee0a7c0499426ae4071d2d2774d5e 476488 rrdtool-dbg_1.4.8-1_amd64.deb
 8b96a29a3d9cffc245eb8df27da40bb67eded236 220554 librrd4_1.4.8-1_amd64.deb
 adc141a2e8e37e203db375a47dc834b4a55313ce 222890 librrd-dev_1.4.8-1_amd64.deb
 d2d6aaf8175e56054b0f98cd1fd4a11c722ac150 117066 librrds-perl_1.4.8-1_amd64.deb
 740b470a74ed3a16ed49905122e419f05381daab 109608 rrdtool-tcl_1.4.8-1_amd64.deb
 12d2a9f3277eb10df35d29c71bb26d654fc7a329 110292 python-rrdtool_1.4.8-1_amd64.deb
 ce43c1cd8f66e432b13c9bc0160a2fa5fddca464 110250 ruby-rrd_1.4.8-1_amd64.deb
 338f1b1c00955aa1b4e24e14175ef7a7e0a007eb 107974 liblua5.1-rrd0_1.4.8-1_amd64.deb
 33e24e868eb50e8bb4632b1330404e52c756c43f 112820 liblua5.1-rrd-dev_1.4.8-1_amd64.deb
 a79f6c22150473fadb0536350e5f81a47b516b21 109614 librrdp-perl_1.4.8-1_all.deb
 08e50f1c999471e59261fe48112b6a6aa9907495 103748 librrd-ruby_1.4.8-1_all.deb
 c9d0828c2231b6b1a1beb7fed974fd1af1c31317 103764 librrd-ruby1.8_1.4.8-1_all.deb
 f868b41e222d07c03ebce2ed771bf2ba8847ecf3 103768 librrd-ruby1.9.1_1.4.8-1_all.deb
Checksums-Sha256: 
 15e99959d83331f74f288bf2db8f4e0eb047bb81c972d2115ff7396477ad195f 2424 rrdtool_1.4.8-1.dsc
 de95b9f5aa488b0683600aad5a07c316f8d98cbe8d00aa0a1c87e2b2ef89f3d6 1379482 rrdtool_1.4.8.orig.tar.gz
 b58aae276825e68f46529020102e4ebd2b846fcf6e83a95aaa823cd578ea60a2 27681 rrdtool_1.4.8-1.diff.gz
 b5f3f9bab30b4530f58dc13091b29886bf03e8d6a31ef933fa409a0b7fd43e48 433814 rrdtool_1.4.8-1_amd64.deb
 a89ce777ab1feb0d6efa4d9aba9d044208cc15cfceaba4152f85bf8b79010574 146062 rrdcached_1.4.8-1_amd64.deb
 4458b51ee51eaf5abf18c3ffa99dcfafc24031abec67f7ebc642051f97491e8f 476488 rrdtool-dbg_1.4.8-1_amd64.deb
 3b0b8559bb68fb7f4088d428a9ee181293f7ea1b0f08eca548a44e797b3a13ad 220554 librrd4_1.4.8-1_amd64.deb
 c74c6ed8440f532de7111c9e388126311ef9ca6227ed588efeddf35d42603729 222890 librrd-dev_1.4.8-1_amd64.deb
 20a627dd2a2c629f660cb7081a044f1826d870940b51c7a3892538c889e0aeb6 117066 librrds-perl_1.4.8-1_amd64.deb
 bdb07bdbe192323bfcd5de6a7a836a6a088e3151279b3c2baa556a2701ad9b79 109608 rrdtool-tcl_1.4.8-1_amd64.deb
 8c19f617f2fe63705ae14d9b861186faff4e9c358ee1c08edbf5789e83a15fc6 110292 python-rrdtool_1.4.8-1_amd64.deb
 b26347b3ea9781995400130f310c2a2ec8a3c41178192dc4645d6b2718aaee6e 110250 ruby-rrd_1.4.8-1_amd64.deb
 52e7c83220ed877af5993227dcab0f703d4845834d3c79f59de7ee66b75a5575 107974 liblua5.1-rrd0_1.4.8-1_amd64.deb
 86980af554eb54c2659effa4a76222c3b72162df52a2bf4a92f26971233414c5 112820 liblua5.1-rrd-dev_1.4.8-1_amd64.deb
 9e5c37ebebee4c8ad6ecda3ca15d7817d279c883a596e779d5054eb092186baa 109614 librrdp-perl_1.4.8-1_all.deb
 ae72d07014a3b71b85009a2000e19f8f2b2e13549d90e821cbaf2363e6301a54 103748 librrd-ruby_1.4.8-1_all.deb
 f8f7259f2a52d49e85006611fa30d19f95415a0021c9a7fb0b2fce90d66d03af 103764 librrd-ruby1.8_1.4.8-1_all.deb
 ebcae733a9888282ae4f2f06c5236bcc9d99f524c5714242d8a42f11c990db8b 103768 librrd-ruby1.9.1_1.4.8-1_all.deb
Files: 
 0c5b85dcf789eedb7c2dffbb4c636f60 433814 utils optional rrdtool_1.4.8-1_amd64.deb
 b2948a3aa971454752d4b297ff754b72 146062 utils optional rrdcached_1.4.8-1_amd64.deb
 ecbb12c01d96c527e803f7ff61b84bc5 476488 debug extra rrdtool-dbg_1.4.8-1_amd64.deb
 430ab99db2ba010ca55254b35c88e178 220554 libs optional librrd4_1.4.8-1_amd64.deb
 25ae07574db9db5bb0d1d76533c76e35 222890 libdevel optional librrd-dev_1.4.8-1_amd64.deb
 db50df15d39ca86260987b130b4b0ad2 117066 perl optional librrds-perl_1.4.8-1_amd64.deb
 4b0b2d1e9ded11ee176d8e3a5e9e6db6 109608 utils optional rrdtool-tcl_1.4.8-1_amd64.deb
 90c0b911493cd411546b820a10106190 110292 python optional python-rrdtool_1.4.8-1_amd64.deb
 8d1c5c95bc2e3ef30192e96b71f635ec 110250 ruby optional ruby-rrd_1.4.8-1_amd64.deb
 b028cc7642e64379b2296117f595c78c 107974 interpreters optional liblua5.1-rrd0_1.4.8-1_amd64.deb
 cd5979920def9fe883cf9d6852575be2 112820 libdevel optional liblua5.1-rrd-dev_1.4.8-1_amd64.deb
 d17c548a120327d658638a1d1c39cbd3 109614 perl optional librrdp-perl_1.4.8-1_all.deb
 823f82ff850f15ebe15b9351481e01e5 103748 oldlibs extra librrd-ruby_1.4.8-1_all.deb
 e2ac3216feb486b41eec825dd020526f 103764 oldlibs extra librrd-ruby1.8_1.4.8-1_all.deb
 84f8878d96f7e28257bb8abd90f20ebd 103768 oldlibs extra librrd-ruby1.9.1_1.4.8-1_all.deb
 56c8a8a3941b1db104d19fec5763cf4a 2424 utils optional rrdtool_1.4.8-1.dsc
 dbe59386db97fd2f2216729facd74ca8 1379482 utils optional rrdtool_1.4.8.orig.tar.gz
 be3dd2c7b38197a56a80d0a7d461ee71 27681 utils optional rrdtool_1.4.8-1.diff.gz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAlNcDrcACgkQEFEKc4UBx/yPVwCePWfjx5TzWz5awoFDWULkZ4sV
RM4AoIUfx85HbRwtrwFcFsdblgdJ+B9h
=2tDv
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.