CVE-2016-10201 CVE-2016-10202 CVE-2016-10203 CVE-2016-10204 CVE-2016-10205 CVE-2016-10206

Debian Bug report logs - #854272
CVE-2016-10201 CVE-2016-10202 CVE-2016-10203 CVE-2016-10204 CVE-2016-10205 CVE-2016-10206

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2016-10201 CVE-2016-10202 CVE-2016-10203 CVE-2016-10204 CVE-2016-10205 CVE-2016-10206

Date: Sun, 05 Feb 2017 18:17:50 +0100

Source: zoneminder
Severity: grave
Tags: security

Please see http://seclists.org/bugtraq/2017/Feb/5

Cheers,
        Moritz

Message #12 received at 854272-submitter@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 854272-submitter@bugs.debian.org

Subject: Bug#854272 tagged as pending

Date: Wed, 02 Aug 2017 19:19:17 +0000

tag 854272 pending
--

We believe that the bug #854272 you reported has been fixed in the Git
repository. You can see the commit message below and/or inspect the
commit contents at:

    http://anonscm.debian.org/cgit/collab-maint/zoneminder.git/diff/?id=b56cefe

(This message was generated automatically by
 'git-post-receive-tag-pending-commitmsg' hook).
---
commit b56cefec7cd8ec186e9662a5c5f0c3ada030d456
Author: Chris Lamb <lamby@debian.org>
Date:   Wed Aug 2 15:15:04 2017 -0400

    New upstream release. (Closes: #854272, #854733)

Message #17 received at 854272-close@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 854272-close@bugs.debian.org

Subject: Bug#854272: fixed in zoneminder 1.30.4+dfsg-1

Date: Sat, 05 Aug 2017 01:34:45 +0000

Source: zoneminder
Source-Version: 1.30.4+dfsg-1

We believe that the bug you reported is fixed in the latest version of
zoneminder, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 854272@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated zoneminder package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 04 Aug 2017 21:06:10 -0400
Source: zoneminder
Binary: zoneminder zoneminder-doc
Architecture: source amd64 all
Version: 1.30.4+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Dmitry Smirnov <onlyjob@debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Description:
 zoneminder - video camera security and surveillance solution
 zoneminder-doc - video camera security and surveillance solution (documentation)
Closes: 848455 854272 854733
Changes:
 zoneminder (1.30.4+dfsg-1) unstable; urgency=medium
 .
   * New upstream release. (Closes: #854272, #854733)
     - Drop requirement that the submodules exist in the orig tarball to
       prevent FTBFS.
     - Correct spelling errors in manpages.
 .
   * debian/*:
     - Move from packaging just the debian/ directory to a standard
       gbp-buildpackage workflow, dropping debian/gbp.conf.
     - Move all patches to gbp-pq with topic directories to split "for
       upstream" and Debian-specific patches.
     - Drop unused sections of debian/copyright.
     - Add Documentation key to systemd service file.
     - Update debian/watch.
 .
   * debian/control:
     - Move from mysql-{client,server} to default-mysql-{client,server}
       dependencies. (Closes: #848455)
     - Add missing Depends on php-gd. (Closes: #848455)
     - Use "(documentation)" suffix instead of separate short description.
     - Add missing depends on lsb-base (>= 3.0-6) for /lib/lsb/init-functions.
     - Update Homepage field to HTTPS.
     - Add myself to Uploaders.
     - Bump Standards-Version to 4.0.0.
     - wrap-and-sort -sa
 .
   * debian/rules:
     - Tidy file, including removing some unnecessary and/or superfluous
       comments.
     - Add note why we don't ship pre-generated salts.
     - Sphinx obeys the SOURCE_DATE_EPOCH environment now, so setting
       build_date manually is not necessary.
     - Use find | xargs to delete to get verbose deletion for free.
Checksums-Sha1:
 596892d6b981d9118e56c8a5870860907bf6eb18 2611 zoneminder_1.30.4+dfsg-1.dsc
 dabb139c85da8584b6c5d2a44239dfc814a2d4e9 8617600 zoneminder_1.30.4+dfsg.orig.tar.xz
 148112db056ce565af7008f182695198d5c8aff4 24976 zoneminder_1.30.4+dfsg-1.debian.tar.xz
 61ebe1c1317735b6ece00270228a056c120993ca 16982350 zoneminder-dbgsym_1.30.4+dfsg-1_amd64.deb
 4edccee16a6e70c3931f1583a652c3ca6d98ce39 5327158 zoneminder-doc_1.30.4+dfsg-1_all.deb
 d89b7f21f629e23167fb84f463fdaee8c126f4e3 15455 zoneminder_1.30.4+dfsg-1_amd64.buildinfo
 9ad02423835da1fd4803960d7072bcf9999de091 4608688 zoneminder_1.30.4+dfsg-1_amd64.deb
Checksums-Sha256:
 3953ab3304707759b1693eef12620c62db07c3915427a5e4fd35f4c084db423d 2611 zoneminder_1.30.4+dfsg-1.dsc
 c9080d24edd8b7bc0b07001a56ca6fc37da2fe50609c38d0702ec7e9942b320f 8617600 zoneminder_1.30.4+dfsg.orig.tar.xz
 a02ece73de8044469529406c62152ecf2de1f1316408b398b58b8c98a7c6541e 24976 zoneminder_1.30.4+dfsg-1.debian.tar.xz
 926bbb457d59c2abcf9e71cadfb14daf828beb55a395f2c624d6ea8b8905c0d8 16982350 zoneminder-dbgsym_1.30.4+dfsg-1_amd64.deb
 50b74ed1767b6c09878139e5d20519fc232c61d301b56b328b3c384c7a7e225c 5327158 zoneminder-doc_1.30.4+dfsg-1_all.deb
 9160f7aa86629d24439a88c2c289046d42ae858a30ae8fda7df8435b21b2592a 15455 zoneminder_1.30.4+dfsg-1_amd64.buildinfo
 8fd454263dfeb21c13611b30887fc220ed54f98bc955d0bbf2a2927e288e72ed 4608688 zoneminder_1.30.4+dfsg-1_amd64.deb
Files:
 0c4e61b1e2b2f56e470dba19de35da1c 2611 net optional zoneminder_1.30.4+dfsg-1.dsc
 139c572a25b37d2b5e381996d0af91a2 8617600 net optional zoneminder_1.30.4+dfsg.orig.tar.xz
 0d75edb1cbdf13175f015e742acae800 24976 net optional zoneminder_1.30.4+dfsg-1.debian.tar.xz
 a12c090b6b76239c32b183451e7ba769 16982350 debug extra zoneminder-dbgsym_1.30.4+dfsg-1_amd64.deb
 2401e29ad047e77c3f5ef6e4f9881592 5327158 doc optional zoneminder-doc_1.30.4+dfsg-1_all.deb
 bcde49746a3df08d322e03074eedaa30 15455 net optional zoneminder_1.30.4+dfsg-1_amd64.buildinfo
 0a6a06ddd1aa528e4cb0c551942cf944 4608688 net optional zoneminder_1.30.4+dfsg-1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAlmFHb0ACgkQHpU+J9Qx
HlhQiQ/+KXPvH/vgwp8Kgn9i/j9/l9WiP1cgmyW5wYsao9AjzMbzc4VIZuOgMJ0o
3zOG9rhZuTWoGd92WrLw3hZZudqKXL/KipHLr35wVp+M+FvnEYvHi8bq4k2yOgma
cdlPvg2gVQyN8I+8khzRqmS4vKH5341fWwhl84HwoeX45/oKZHHlr8VFB9WSBC9/
OWdkZFxVRjSVX9tEkvd999iUxkWLyUzmRBulFeZkHsJzDspnE+PrugJi1eXurVSh
2VBTxg3qsw8XSEDKXe11IWpH+vsI//xfWTs+vZsK9/8HbfnEXGqu1c+hxcT7VLP9
gxfZsxf+08HvM9taKpkU+BpLAyFujms1muPE5GqiMmBZapJHRrce8mpwEW0TFfY/
xiiccZezXrVwQv/qPJFg3tb/ZAIZ0Pcl9Sx8w1X/NyWzm+fNc5Abat9cVBBuSz13
BtsUiks5N76irKFxTEQlz7TxWuAMBulsDLCMAmpRP2ZXZjwfX3u8sEX69+zXFKK9
ziQVYFXbT26BpU2w4xLvIrVWBua0TufmvJtWT36rd+azqobxk7bcUEVbRB52GmGJ
KKNZz/B0gYA1zmYHwKGJXxwPJCVa9TpNSYnnXfCaiiDehNH/CSXnC0hRYNNbG6Lg
KYoswfC8nq32IYqOlmdsrr0Lz/ZE2191lu+Hcz+jjSvdRrSXCrE=
=ITv3
-----END PGP SIGNATURE-----

Message #22 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Chris Lamb <lamby@debian.org>

Cc: 854733@bugs.debian.org, team@security.debian.org, jmm@debian.org, 854272@bugs.debian.org

Subject: Zoneminder issues fixed? (was: Re: Bug#854733 tagged as pending)

Date: Sat, 5 Aug 2017 05:53:49 +0200

Hi Chris,

On Wed, Aug 02, 2017 at 07:19:17PM +0000, Chris Lamb wrote:
> commit b56cefec7cd8ec186e9662a5c5f0c3ada030d456
> Author: Chris Lamb <lamby@debian.org>
> Date:   Wed Aug 2 15:15:04 2017 -0400
> 
>     New upstream release. (Closes: #854272, #854733)

The recent upload to unstable claims to fix several CVEs. While for
#854733 this is the case for CVE-2017-5595, I fail to find fixing
commits for the other two CVEs from that bug. Where are they fixed?
Can you help identifying the commits?

Similarly for #854272. all of those were reported to upstream without
response. A quick search does not lead me to aany commits later than
1.30 upstream.

if so can you update the security-tracker indicating the fixing
commits for the individual CVEs?

thanks already!

Regards,
Salvatore

Message #27 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 854733@bugs.debian.org, team@security.debian.org, jmm@debian.org, 854272@bugs.debian.org

Subject: Re: Zoneminder issues fixed? (was: Re: Bug#854733 tagged as pending)

Date: Sat, 05 Aug 2017 07:40:35 -0400

found 854272 1.30.4+dfsg-1
found 854733 1.30.4+dfsg-1
thanks

Hi Salvatore,
 
> The recent upload to unstable claims to fix several CVEs. While for
> #854733 this is the case for CVE-2017-5595, I fail to find fixing
> commits for the other two CVEs from that bug. Where are they fixed?
> Can you help identifying the commits?

Oh crumbs, I was either misinformed on (or more likely I misinterpreted!)
an off-list conversation about these CVEs.

Am immediately re-opening them all for now whilst I investigate.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb, Debian Project Leader
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #34 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 854733@bugs.debian.org, team@security.debian.org, jmm@debian.org, 854272@bugs.debian.org

Subject: Re: Zoneminder issues fixed? (was: Re: Bug#854733 tagged as pending)

Date: Mon, 07 Aug 2017 22:33:06 -0400

Hi Salvatore,

> found 854272 1.30.4+dfsg-1
> found 854733 1.30.4+dfsg-1
> thanks
> 
> Hi Salvatore,
>  
> > The recent upload to unstable claims to fix several CVEs. While for
> > #854733 this is the case for CVE-2017-5595, I fail to find fixing
> > commits for the other two CVEs from that bug. Where are they fixed?
> > Can you help identifying the commits?
> 
> Oh crumbs, I was either misinformed on (or more likely I misinterpreted!)
> an off-list conversation about these CVEs.
> 
> Am immediately re-opening them all for now whilst I investigate.

Hm, so I think these were all fixed in:

   https://github.com/ZoneMinder/ZoneMinder/commit/d38bae72aeece85a20e3774c4953080e2e09e63c

What do you think?


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb, Debian Project Leader
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #39 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Chris Lamb <lamby@debian.org>

Cc: 854733@bugs.debian.org, team@security.debian.org, jmm@debian.org, 854272@bugs.debian.org

Subject: Re: Zoneminder issues fixed? (was: Re: Bug#854733 tagged as pending)

Date: Wed, 9 Aug 2017 06:41:38 +0200

Hi Chris,

On Mon, Aug 07, 2017 at 10:33:06PM -0400, Chris Lamb wrote:
> Hi Salvatore,
> 
> > found 854272 1.30.4+dfsg-1
> > found 854733 1.30.4+dfsg-1
> > thanks
> > 
> > Hi Salvatore,
> >  
> > > The recent upload to unstable claims to fix several CVEs. While for
> > > #854733 this is the case for CVE-2017-5595, I fail to find fixing
> > > commits for the other two CVEs from that bug. Where are they fixed?
> > > Can you help identifying the commits?
> > 
> > Oh crumbs, I was either misinformed on (or more likely I misinterpreted!)
> > an off-list conversation about these CVEs.
> > 
> > Am immediately re-opening them all for now whilst I investigate.
> 
> Hm, so I think these were all fixed in:
> 
>    https://github.com/ZoneMinder/ZoneMinder/commit/d38bae72aeece85a20e3774c4953080e2e09e63c
> 
> What do you think?

Will try to schedule a bit of time to check this, or if any other can
as well would be appreciated. The CSRF vulnerabilities from that list
probably yes, but not sure about all of the reported CVEs.

Regards,
Salvatore

Message #44 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 854733@bugs.debian.org, team@security.debian.org, jmm@debian.org, 854272@bugs.debian.org

Subject: Re: Zoneminder issues fixed? (was: Re: Bug#854733 tagged as pending)

Date: Thu, 17 Aug 2017 11:59:15 -0700

Hi Salvatore,

> Will try to schedule a bit of time to check this, or if any other can
> as well would be appreciated. The CSRF vulnerabilities from that list
> probably yes, but not sure about all of the reported CVEs.

Any update on this? :)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #53 received at 854272-done@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 854272-done@bugs.debian.org

Subject: Re: zoneminder: CVE-2017-5367 CVE-2017-5368 CVE-2017-5595

Date: Tue, 29 Aug 2017 21:56:19 +0100

forwarded 854272 https://github.com/ZoneMinder/ZoneMinder/pull/1764
tags 854272 + fixed-upstream
thanks

CVE-2017-5595 already addressed, the rest appear to be handled in:

  https://github.com/ZoneMinder/ZoneMinder/pull/1764


Best wishes,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #60 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Adrian Bunk <bunk@debian.org>

Cc: 854272@bugs.debian.org, 854733@bugs.debian.org

Subject: Re: Also reopen them

Date: Sat, 02 Sep 2017 09:09:01 +0100

Hi Adrian,

> reopen 854272
> reopen 854733
> thanks
>
> Re: Also reopen them

"Also" ?


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #65 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Adrian Bunk <bunk@debian.org>

To: Chris Lamb <lamby@debian.org>

Cc: 854272@bugs.debian.org, 854733@bugs.debian.org

Subject: Re: Also reopen them

Date: Sat, 2 Sep 2017 11:19:56 +0300

On Sat, Sep 02, 2017 at 09:09:01AM +0100, Chris Lamb wrote:
> Hi Adrian,
> 
> > reopen 854272
> > reopen 854733
> > thanks
> >
> > Re: Also reopen them
> 
> "Also" ?

#debian-devel: < bunk> lamby: Regarding zoneminder: Removing the fixed 
version by using found without reopening the bug does the wrong thing - 
Done without fixed version is has an INVALID/NOTABUG semantics.

> Regards,

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Message #70 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: Adrian Bunk <bunk@debian.org>

Cc: 854272@bugs.debian.org, 854733@bugs.debian.org

Subject: Re: Also reopen them

Date: Sat, 02 Sep 2017 10:24:54 +0100

Hi Adrian,

> > > Re: Also reopen them
> > 
> > "Also" ?
> 
> #debian-devel: < bunk> lamby: Regarding zoneminder: Removing the fixed 
> version by using found without reopening the bug does the wrong thing - 
> Done without fixed version is has an INVALID/NOTABUG semantics.

Ah, I didn't see that.

(Please always try to stick to either one communications channel,
preferably whichever is the canonical one which, in this case,
is the BTS...)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #75 received at 854272-done@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 854272-done@bugs.debian.org

Date: Sat, 02 Sep 2017 10:23:19 +0100

Version: 1.30.4+dfsg-1


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #80 received at 854272@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>

To: 854272@bugs.debian.org

Subject: Re: Your mail

Date: Wed, 6 Sep 2017 12:25:07 +0200

On Sat, 02 Sep 2017 10:23:19 +0100 Chris Lamb <lamby@debian.org> wrote:
> Version: 1.30.4+dfsg-1

Is this bug found or fixed in that version? I'm confused (and the bts is
confused as well) since this is now marked as both found and fixed in
this version (and treated by the bts as "not fixed"). Please remove the
wrong one.


Andreas

Send a report that this bug log contains spam.