xdelta3: CVE-2014-9765: buffer overflow in main_get_appheader

Related Vulnerabilities: CVE-2014-9765  

Debian Bug report logs - #814067
xdelta3: CVE-2014-9765: buffer overflow in main_get_appheader

version graph

Package: xdelta3; Maintainer for xdelta3 is A Mennucc1 <mennucc1@debian.org>; Source for xdelta3 is src:xdelta3 (PTS, buildd, popcon).

Reported by: Stepan Golosunov <stepan@golosunov.pp.ru>

Date: Mon, 8 Feb 2016 07:03:01 UTC

Severity: grave

Tags: fixed-upstream, jessie, patch, security, sid, stretch, upstream, wheezy

Found in versions xdelta3/0y.dfsg-1, xdelta3/3.0.0.dfsg-1

Fixed in versions xdelta3/3.0.8-dfsg-1.1, xdelta3/0y.dfsg-1+deb6u1, xdelta3/3.0.8-dfsg-1+deb8u1, xdelta3/3.0.0.dfsg-1+deb7u1

Done: Salvatore Bonaccorso <carnil@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, security@debian.org, A Mennucc1 <mennucc1@debian.org>:
Bug#814067; Package xdelta3. (Mon, 08 Feb 2016 07:03:06 GMT) (full text, mbox, link).


Acknowledgement sent to Stepan Golosunov <stepan@golosunov.pp.ru>:
New Bug report received and forwarded. Copy sent to security@debian.org, A Mennucc1 <mennucc1@debian.org>. (Mon, 08 Feb 2016 07:03:06 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stepan Golosunov <stepan@golosunov.pp.ru>
To: submit@bugs.debian.org
Subject: Buffer overflow in xdelta3
Date: Mon, 8 Feb 2016 11:00:23 +0400
Package: xdelta3
Severity: grave
Tags: security upstream fixed-upstream

xdelta3 before 3.0.9 contains buffer overflow which allows arbitrary
code execution from input files at least on some systems.

3.0.0.dfsg-1 and 3.0.8-dfsg-1 are definitly affected.

08.02.2016 в 06:57:12 +0100 Salvatore Bonaccorso написал:
> On Sun, Feb 07, 2016 at 07:05:12PM +0400, Stepan Golosunov wrote:
> > This appears to be fixed in xdelta3 3.0.9 and later via
> > https://github.com/jmacd/xdelta-devel/commit/ef93ff74203e030073b898c05e8b4860b5d09ef2
> > but not in Debian.
> > 
> > What should be done next? Should I open a bug?
> 
> Yes, since the commit is in the public git repo I think it is best to
> open a bug in the Debian BTS.

> p.s.: Just noticed there seem to be two git repositories by jmacd, the
>       commit is as well in
>       https://github.com/jmacd/xdelta/commit/969e65d3a5d70442f5bafd726bcef47a0b48edd8

README.md says that this repository contains old data from
https://code.google.com/p/xdelta. Newer code and releases are
currently only in xdelta-devel.



Marked as found in versions xdelta3/3.0.0.dfsg-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Mon, 08 Feb 2016 07:54:09 GMT) (full text, mbox, link).


Changed Bug title to 'xdelta3: CVE-2014-9765: buffer overflow in main_get_appheader' from 'Buffer overflow in xdelta3' Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Mon, 08 Feb 2016 16:27:08 GMT) (full text, mbox, link).


Information forwarded to debian-bugs-dist@lists.debian.org, A Mennucc1 <mennucc1@debian.org>:
Bug#814067; Package xdelta3. (Wed, 10 Feb 2016 20:45:10 GMT) (full text, mbox, link).


Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
Extra info received and forwarded to list. Copy sent to A Mennucc1 <mennucc1@debian.org>. (Wed, 10 Feb 2016 20:45:10 GMT) (full text, mbox, link).


Message #14 received at 814067@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 814067@bugs.debian.org
Subject: xdelta3: diff for NMU version 3.0.8-dfsg-1.1
Date: Wed, 10 Feb 2016 21:42:36 +0100
[Message part 1 (text/plain, inline)]
Control: tags 814067 + patch
Control: tags 814067 + pending

Hi Andrea,

I've prepared an NMU for xdelta3 (versioned as 3.0.8-dfsg-1.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.

Regards,
Salvatore
[xdelta3-3.0.8-dfsg-1.1-nmu.diff (text/x-diff, attachment)]

Added tag(s) patch. Request was from Salvatore Bonaccorso <carnil@debian.org> to 814067-submit@bugs.debian.org. (Wed, 10 Feb 2016 20:45:10 GMT) (full text, mbox, link).


Added tag(s) pending. Request was from Salvatore Bonaccorso <carnil@debian.org> to 814067-submit@bugs.debian.org. (Wed, 10 Feb 2016 20:45:11 GMT) (full text, mbox, link).


Reply sent to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility. (Fri, 12 Feb 2016 22:09:18 GMT) (full text, mbox, link).


Notification sent to Stepan Golosunov <stepan@golosunov.pp.ru>:
Bug acknowledged by developer. (Fri, 12 Feb 2016 22:09:18 GMT) (full text, mbox, link).


Message #23 received at 814067-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 814067-close@bugs.debian.org
Subject: Bug#814067: fixed in xdelta3 3.0.8-dfsg-1.1
Date: Fri, 12 Feb 2016 22:07:46 +0000
Source: xdelta3
Source-Version: 3.0.8-dfsg-1.1

We believe that the bug you reported is fixed in the latest version of
xdelta3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 814067@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated xdelta3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 10 Feb 2016 21:33:10 +0100
Source: xdelta3
Binary: xdelta3
Architecture: source
Version: 3.0.8-dfsg-1.1
Distribution: unstable
Urgency: high
Maintainer: A Mennucc1 <mennucc1@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 814067
Description: 
 xdelta3    - Diff utility which works with binary files
Changes:
 xdelta3 (3.0.8-dfsg-1.1) unstable; urgency=high
 .
   * Non-maintainer upload.
   * CVE-2014-9765: buffer overflow in main_get_appheader (Closes: #814067)
Checksums-Sha1: 
 28a0399b228bf6ad82a67ae7876f7bb59de18963 1716 xdelta3_3.0.8-dfsg-1.1.dsc
 8cc5ec9c6fe6a3ebd82cb5dbb38b6456ef46223a 13016 xdelta3_3.0.8-dfsg-1.1.debian.tar.xz
Checksums-Sha256: 
 564c83da43e18383b4bf72bbd9696710826ce708734629f6cd2af819486505a3 1716 xdelta3_3.0.8-dfsg-1.1.dsc
 174fd57b6831fdec40e29420382d673dc50570b9eb6d5d47f820bc87574d67ad 13016 xdelta3_3.0.8-dfsg-1.1.debian.tar.xz
Files: 
 e7e2ef82a058b96dec7fc34fcf819a15 1716 utils optional xdelta3_3.0.8-dfsg-1.1.dsc
 edc5fad98529aa56043d40fda1250fc6 13016 utils optional xdelta3_3.0.8-dfsg-1.1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWu580AAoJEAVMuPMTQ89ELI4P/1jdEq93oa55UcxJuz0uSw/N
bfV9m7j0A5LBlX0EFHn/8eqHeMJtNQoM802B2zjhAPj7rrkntCjoirCOWMaff3g/
q6u3RLt85gQJIHfFgQMdcJvgNpEkOC3FPOAuFsZYhX+qenP7RbALgofPG3XNyEb7
A5AUj6vHNdqAMKNURyXHWl8wlW3udJ+qCD1s1IfTUzpFQjflqpIO9dmGpwPThH+5
FSjH9xAajPccAR+TK6lDdLDr9OsxUbvjRXJgL5lTWbbkKa2U1IhKCeY06/OSZxKY
eeRNl8I53yFtelK7BCRpgf18+8VUGnHccZgvY5zCg0OJmyAoamL3x9E9QIW7fSnb
C1/dGOy3fTE3clyB5FursNvki0PxeEE4tE0ItVoZr3Rc+9Uz9SgpKVUos/huBWQE
/STuEWVwncEGwpcOnyupayYsusl5SibsTxXgGD4erDrv9SiBpYe+95eiZRvCtmhu
sBWIp3Rx1kup3UWiorLD9yLUX5iw+L9kPijitls7lXbmjOFix5/sY78AR99MJpV3
5C3vP/3zT6upi2pOiFVfqJJM/zCIyadf4kO3Udr1pBn25CBMcFOseHWGEN+CfIjf
n5tplp4UcDBwYsekDK8ZFRfnX6c+L6fHR64DENf29Bjmy/Dvj2fdz2NVyBvkDHJJ
CSSrvs5utlj2EK5qWe82
=ObMv
-----END PGP SIGNATURE-----




Reply sent to Chris Lamb <lamby@debian.org>:
You have taken responsibility. (Tue, 16 Feb 2016 22:48:11 GMT) (full text, mbox, link).


Notification sent to Stepan Golosunov <stepan@golosunov.pp.ru>:
Bug acknowledged by developer. (Tue, 16 Feb 2016 22:48:11 GMT) (full text, mbox, link).


Message #28 received at 814067-close@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>
To: 814067-close@bugs.debian.org
Subject: Bug#814067: fixed in xdelta3 0y.dfsg-1+deb6u1
Date: Tue, 16 Feb 2016 22:46:26 +0000
Source: xdelta3
Source-Version: 0y.dfsg-1+deb6u1

We believe that the bug you reported is fixed in the latest version of
xdelta3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 814067@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <lamby@debian.org> (supplier of updated xdelta3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 16 Feb 2016 11:21:13 +0100
Source: xdelta3
Binary: xdelta3 python-xdelta3
Architecture: source amd64
Version: 0y.dfsg-1+deb6u1
Distribution: squeeze-lts
Urgency: high
Maintainer: A Mennucc1 <mennucc1@debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Description: 
 python-xdelta3 - Xdelta3 python module
 xdelta3    - A diff utility which works with binary files
Closes: 814067
Changes: 
 xdelta3 (0y.dfsg-1+deb6u1) squeeze-lts; urgency=high
 .
   * CVE-2014-9765: Fix buffer overflow in main_get_appheader (Closes: #814067)
Checksums-Sha1: 
 22b314bfc5ed9ca04020e1d1d3c6d20ed7fe3c56 1717 xdelta3_0y.dfsg-1+deb6u1.dsc
 26ef850455d19754d5bf57d383801064facadc68 211476 xdelta3_0y.dfsg.orig.tar.gz
 89854bec61407a9318921c52dd766b5bb4323242 9170 xdelta3_0y.dfsg-1+deb6u1.debian.tar.gz
 523ee3232b98d87ffb7602a3643b9f7e2a6d359d 90374 xdelta3_0y.dfsg-1+deb6u1_amd64.deb
 205afb377807acca42921ff56679a98ed8ef95f9 151784 python-xdelta3_0y.dfsg-1+deb6u1_amd64.deb
Checksums-Sha256: 
 a16adbe636b2e0c0e9a77c63287e0631e88bb4d6f910d6727c5fc0f1698b4556 1717 xdelta3_0y.dfsg-1+deb6u1.dsc
 c81f78cd9116015788442cbdf28e53b22850495c2b53cd5c77cb5b81d2537148 211476 xdelta3_0y.dfsg.orig.tar.gz
 3165af99ebe51d14162b5cb61a94f24c4dce5524da1caeecddcbfc1e89cf32e1 9170 xdelta3_0y.dfsg-1+deb6u1.debian.tar.gz
 774074bb62687805c8e8e7f05f1dde62df10fd77776dd78a5f099e58b584b48e 90374 xdelta3_0y.dfsg-1+deb6u1_amd64.deb
 44aed8093ed08d27b431afcd163f7b242113210489a2fe25ac8988722d947c55 151784 python-xdelta3_0y.dfsg-1+deb6u1_amd64.deb
Files: 
 cd68d18ee41fbe7466fd24627a367cad 1717 utils optional xdelta3_0y.dfsg-1+deb6u1.dsc
 7681d456828c6f114de7535df3a8ebd2 211476 utils optional xdelta3_0y.dfsg.orig.tar.gz
 99f3d5b88cdff28c28e13b2ad35aa367 9170 utils optional xdelta3_0y.dfsg-1+deb6u1.debian.tar.gz
 1eec344bb84f1d8249bbe9c30cccf97a 90374 utils optional xdelta3_0y.dfsg-1+deb6u1_amd64.deb
 19a47c23e5c88af3cc82f9085eccfd10 151784 python optional python-xdelta3_0y.dfsg-1+deb6u1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWwvmRAAoJEB6VPifUMR5Y0TgP/0KMz2ihZ431Uj31TDiFphsB
bcbQN/Z9z0WZubwr3KiVOptlFifkVeHiMYxQ4WLTQoKpJV92a55NFNtzzkTt0J0S
DPniGOl1C23E5h9JI+VSIj+zf7r3WpuxJUh4I8Ev5aI6Ei2ReYrQy7ddOgfazf2m
kw4QnJZNgGodde5lq78cg1CH6OkotSBvfI+gZAAiOE9iwr0pHZoVtiwZI7y2lUxm
o9t5BSvFL0KRLWI58Fo7+nEURMYLnKjkv2+V/WLG7stvoZHylD+zYRn3t0ChcZCQ
8jVkj8BoUaozgeGNtdlQtKXmg+fFzmiAC8cZv/Ss4BDtBt0c5s9F8AytGNYeNGnN
Mqzd4Iy/tb3wqGrMyiBeomOLnYLBNWVhbQo0iK6yqILQ01V8G9af5SKP6BLDXe/I
O1ujIdrMEKPToqwEXrkfuGnwEnGrO235pjbEbxDs3Vwynke3vPTU65YDqNnBniMK
kBaLS/Oyj8yMXdgX6Y8eAW6UYxi8z0qvN3TSCDrreVOLgF6gvmwDca4fzLlDLC50
6X+kyZYv+YzfUDGqVwNQ5yFoCPzvz/EK//me9akCZZxSujurK4gtKa2lfePOGUVe
wG42tGbggFi2kQKwPiFFw/o66QUbtofqyxyByObFtH1ufO9ct2AG1nVqqF3cP9US
GXW+qgGLfY7b+kSVY5P5
=QPXe
-----END PGP SIGNATURE-----




Marked as found in versions xdelta3/0y.dfsg-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 17 Feb 2016 16:09:03 GMT) (full text, mbox, link).


Added tag(s) stretch, sid, jessie, and wheezy. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Wed, 17 Feb 2016 16:09:04 GMT) (full text, mbox, link).


Reply sent to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility. (Sat, 20 Feb 2016 18:57:16 GMT) (full text, mbox, link).


Notification sent to Stepan Golosunov <stepan@golosunov.pp.ru>:
Bug acknowledged by developer. (Sat, 20 Feb 2016 18:57:16 GMT) (full text, mbox, link).


Message #37 received at 814067-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 814067-close@bugs.debian.org
Subject: Bug#814067: fixed in xdelta3 3.0.8-dfsg-1+deb8u1
Date: Sat, 20 Feb 2016 18:52:38 +0000
Source: xdelta3
Source-Version: 3.0.8-dfsg-1+deb8u1

We believe that the bug you reported is fixed in the latest version of
xdelta3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 814067@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated xdelta3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 19 Feb 2016 12:41:53 +0100
Source: xdelta3
Binary: xdelta3
Architecture: source
Version: 3.0.8-dfsg-1+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: A Mennucc1 <mennucc1@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 740284 814067
Description: 
 xdelta3    - Diff utility which works with binary files
Changes:
 xdelta3 (3.0.8-dfsg-1+deb8u1) jessie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Fix LZMA tests (Closes: #740284)
   * CVE-2014-9765: buffer overflow in main_get_appheader (Closes: #814067)
Checksums-Sha1: 
 c78ccd49f5e4eb791515f553b4d7fe7f0a9ba950 1736 xdelta3_3.0.8-dfsg-1+deb8u1.dsc
 e4a1c3a4a650c1a44032391bfd6fbe80022c78a6 416036 xdelta3_3.0.8-dfsg.orig.tar.xz
 b4917eec708aa4b64cee7489cbf24f25fe8008bd 14232 xdelta3_3.0.8-dfsg-1+deb8u1.debian.tar.xz
Checksums-Sha256: 
 65de963b5dc37512a5f41cdc26bf66852d48fbd2ce23af6626a23ce4e29fed59 1736 xdelta3_3.0.8-dfsg-1+deb8u1.dsc
 c00128a290ff922894206ad56ab0ca2cff9d29dd8ab992726b7d314f0a1a4345 416036 xdelta3_3.0.8-dfsg.orig.tar.xz
 d8358f03d20bc1f63940a6a4b23e5e6fdb995eec6d33c4511eb9a3d58c1bba84 14232 xdelta3_3.0.8-dfsg-1+deb8u1.debian.tar.xz
Files: 
 88e83e2862dc9c144b3add39b72c5c2b 1736 utils optional xdelta3_3.0.8-dfsg-1+deb8u1.dsc
 712bcf8532a0c7aaa827200918e60e9e 416036 utils optional xdelta3_3.0.8-dfsg.orig.tar.xz
 59d806097d5d756c6d1228c8c1653148 14232 utils optional xdelta3_3.0.8-dfsg-1+deb8u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWxwNOAAoJEAVMuPMTQ89E/bIP/idVOoexbmBq4f71W0dUobSh
YoAe2sqJYNehCBKPCSqggt79gTwewfCuOUpOxSGEZP8PJRGprWaea5IlV1iJjmon
MSh/v/qsMAf2iSyV1ARtUV4o/yMu/VYdy58WZrH3Y1UFfGI9dgPH8z351VL+yotu
a5Dqo1NQSaRj4TUwduuz5XFzT3TYTxJFXq/Wf56bWlKTKEBCuKUk2RKEcoR+fuHr
IiYv0lOx9kL0NNwkeG+EYeLaSySjNwQ0taZ7c00aChMtgWBftCZMD2ykKp66g03E
BR9AwZ9e+MhHEOlAM2dZYS1RAWfoWuksERyrV1f4/TXvPB1rtyNFylZhR/377yLo
Fugt+qecqc2mKk6H40re4VQG+G8uw7ZT3vKOvs8PhXEmq+ZoQfm0ap+Gp2u21KhV
iyM/Vzc/9RRtgnUmARKNfhHexEL7TK6Lfz1rREY3YINu2fJksJNJgG/Ts756itWH
7dnOdtlJN/vYYHLSOQ/ObqO5o2sKTcQqRUUemlBll64dRUPf+sKPcrijTm3CXiYL
b274mIuD0JdJd8j1UKJSeodD0GqtKQl0HsRBIIVyflY02FE5gCbubcPlOy+byrqu
7FQDOAHTA01NPMWw2f5mSmgM5N62kgHWB4wze5e8Jt+qW7+1PgoUx+M8wpOwqtZF
RBDSLB9Zm5Q+2DPmOX1a
=C+m0
-----END PGP SIGNATURE-----




Reply sent to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility. (Sun, 21 Feb 2016 12:21:30 GMT) (full text, mbox, link).


Notification sent to Stepan Golosunov <stepan@golosunov.pp.ru>:
Bug acknowledged by developer. (Sun, 21 Feb 2016 12:21:30 GMT) (full text, mbox, link).


Message #42 received at 814067-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 814067-close@bugs.debian.org
Subject: Bug#814067: fixed in xdelta3 3.0.0.dfsg-1+deb7u1
Date: Sun, 21 Feb 2016 12:17:49 +0000
Source: xdelta3
Source-Version: 3.0.0.dfsg-1+deb7u1

We believe that the bug you reported is fixed in the latest version of
xdelta3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 814067@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated xdelta3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 19 Feb 2016 14:35:03 +0100
Source: xdelta3
Binary: xdelta3 python-xdelta3
Architecture: source amd64
Version: 3.0.0.dfsg-1+deb7u1
Distribution: wheezy-security
Urgency: high
Maintainer: A Mennucc1 <mennucc1@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description: 
 python-xdelta3 - Xdelta3 python module
 xdelta3    - A diff utility which works with binary files
Closes: 814067
Changes: 
 xdelta3 (3.0.0.dfsg-1+deb7u1) wheezy-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2014-9765: buffer overflow in main_get_appheader (Closes: #814067)
Checksums-Sha1: 
 9e9f261d46bdb773d803a9c47ca0bfb74ef4462b 1806 xdelta3_3.0.0.dfsg-1+deb7u1.dsc
 ca8ffc1a74f5808411d3abb3f83bb1f978725295 173789 xdelta3_3.0.0.dfsg.orig.tar.bz2
 7c3f6f2ee0d205860eba8a1a4c91823494972b8b 10596 xdelta3_3.0.0.dfsg-1+deb7u1.debian.tar.gz
 651ae3d1adf288e899a019f134c215eafaad3788 83974 xdelta3_3.0.0.dfsg-1+deb7u1_amd64.deb
 c86fe011c356dc2048d675276c3139eb37972de7 153034 python-xdelta3_3.0.0.dfsg-1+deb7u1_amd64.deb
Checksums-Sha256: 
 88cfe5ea7249c852216fb8dfca66f0298aa0d6d6b5251e2d06d3adb9ce62ca21 1806 xdelta3_3.0.0.dfsg-1+deb7u1.dsc
 dc486b24600aa21a40e5bf28308fdfecd54c2fd64d5ca78a81c9036521fd2fc3 173789 xdelta3_3.0.0.dfsg.orig.tar.bz2
 05a41e80749c043541ba4a3a7ac86d9fca737cf19a8b2e6417931312e2b84b65 10596 xdelta3_3.0.0.dfsg-1+deb7u1.debian.tar.gz
 388de74707c1cb66b551cb4291dd75c1b20a9df456207ddf6de22844f492a931 83974 xdelta3_3.0.0.dfsg-1+deb7u1_amd64.deb
 3088cb2914a5a6ae95f0c2f5358d21c4a95b1bac9118c10512f1d4f545c63ab3 153034 python-xdelta3_3.0.0.dfsg-1+deb7u1_amd64.deb
Files: 
 a4523f5be7635241b335eef605c9b843 1806 utils optional xdelta3_3.0.0.dfsg-1+deb7u1.dsc
 a0753ef32a6aac97caf718e193b83172 173789 utils optional xdelta3_3.0.0.dfsg.orig.tar.bz2
 509dfbb7e3de524dc7db2b81a8d20ee2 10596 utils optional xdelta3_3.0.0.dfsg-1+deb7u1.debian.tar.gz
 6007260866bdd289a78fa3ccd05f9395 83974 utils optional xdelta3_3.0.0.dfsg-1+deb7u1_amd64.deb
 ed404f90df8ead673abefde19e02dd6a 153034 python optional python-xdelta3_3.0.0.dfsg-1+deb7u1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWxxpoAAoJEAVMuPMTQ89El/sP/RbhVcGxIgUHlRp3qIRfdb9D
C2YI8nNxfXXFXfkgpMFIZL2Fl9LecrplbBcmSlIk2waMD32naxl2T6GWlW55o7SR
38oHFS3Te2QeM8s4rAh/Z1rghDbdoG18dqy1iAd1doB/nS317yt9KfuEAFKUmzIZ
d9QSCciYhFX1arkeAxpz0Q+Xp9MA2ZdxSqpNwbYBxLtrnsEHo+lfSHIf/9JlfuWM
b7TTGbGVPbAfd2nSMRC/I3sRAymBg5ZPdD6YbswJH+hUvkAeclVDgUAInoC2Sn7h
pPrWApZChCy/V14+wxzQ2/BJZaKVyayrsP/Jo3kn5wLSu9rSEF95zySFy/WQsf5r
/az5m+EX5K6lGWvJuW0ql231sCQU34T/u2RDlrD0REMUkIBJa7/0D0oSIplagVHv
evpEH/OW6IlsGPwjHdtq5+YQL8NYrO5u9i6Fm8/QhAvCre8x6Ibhf+zJzUikWOg7
/Sqvr21i0aYJiYGp1agoDHx0iH0IqK4sslm4Pug+1Ya3VSujt/J449peR9ZK+9A5
LFvCQViVFulOIyRWtlTaYC16G3AW1QR8tK8a6z1MVA2sZA3RpqN+bE/s/9qbkul4
ikEH4v4GAd7gce50n6PVtnVPKbuRyeeQ0iBkwFRjFdc80d6nk9pBdodtSNvEmsGB
cJtiq2Q7Ahd9frCtaFwv
=zi/j
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 03 Apr 2016 07:37:48 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 14:40:33 2019; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.