lcms2: CVE-2016-10165: heap OOB read parsing crafted ICC profile

Debian Bug report logs - #852627
lcms2: CVE-2016-10165: heap OOB read parsing crafted ICC profile

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: lcms2: CVE-2016-10165: heap OOB read parsing crafted ICC profile

Date: Wed, 25 Jan 2017 19:15:39 +0100

Source: lcms2
Version: 2.6-3
Severity: important
Tags: upstream security patch

Hi,

the following vulnerability was published for lcms2.

CVE-2016-10165[0]:
heap OOB read parsing crafted ICC profile

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-10165
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10165
[1] https://github.com/mm2/Little-CMS/commit/5ca71a7bc18b6897ab21d815d15e218e204581e2
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1367357

Regards,
Salvatore

Message #10 received at 852627@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 852627@bugs.debian.org

Subject: Re: Bug#852627: lcms2: CVE-2016-10165: heap OOB read parsing crafted ICC profile

Date: Wed, 25 Jan 2017 19:33:12 +0100

Control: severity -1 grave

Actually raising the severity to RC, think this should go into stretch
and the patch is simple. 

Regards,
Salvatore

Message #17 received at 852627@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 852627@bugs.debian.org

Subject: lcms2: diff for NMU version 2.8-3.1

Date: Thu, 26 Jan 2017 21:44:49 +0100

[Message part 1 (text/plain, inline)]

Control: tags 852627 + pending

Dear maintainer,

I've prepared an NMU for lcms2 (versioned as 2.8-3.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.

Regards.

[lcms2-2.8-3.1-nmu.diff (text/x-diff, attachment)]

Message #24 received at 852627@bugs.debian.org (full text, mbox, reply):

From: Thomas Weber <tweber@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 852627@bugs.debian.org

Subject: Re: Bug#852627: lcms2: diff for NMU version 2.8-3.1

Date: Fri, 27 Jan 2017 07:27:43 +0100

HI Salvatore,
On Thu, Jan 26, 2017 at 09:44:49PM +0100, Salvatore Bonaccorso wrote:
> Control: tags 852627 + pending
> 
> Dear maintainer,
> 
> I've prepared an NMU for lcms2 (versioned as 2.8-3.1) and
> uploaded it to DELAYED/2. Please feel free to tell me if I
> should delay it longer.

Sorry, I just uploaded 2.8-4 without checking the bug log again (I
prepard the fix yesterday). So, your NMU will probably never hit
unstable. I am sorry for the extra work.

	Thomas

Message #29 received at 852627-close@bugs.debian.org (full text, mbox, reply):

From: Thomas Weber <tweber@debian.org>

To: 852627-close@bugs.debian.org

Subject: Bug#852627: fixed in lcms2 2.8-4

Date: Fri, 27 Jan 2017 06:34:29 +0000

Source: lcms2
Source-Version: 2.8-4

We believe that the bug you reported is fixed in the latest version of
lcms2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 852627@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Weber <tweber@debian.org> (supplier of updated lcms2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 26 Jan 2017 11:04:13 +0100
Source: lcms2
Binary: liblcms2-dev liblcms2-2 liblcms2-utils
Architecture: source amd64
Version: 2.8-4
Distribution: unstable
Urgency: medium
Maintainer: Thomas Weber <tweber@debian.org>
Changed-By: Thomas Weber <tweber@debian.org>
Description:
 liblcms2-2 - Little CMS 2 color management library
 liblcms2-dev - Little CMS 2 color management library development headers
 liblcms2-utils - Little CMS 2 color management library (utilities)
Closes: 852627
Changes:
 lcms2 (2.8-4) unstable; urgency=medium
 .
   * New patch: debian/patches/fix-CVE-2016-10165.patch.
     Fix for CVE-2016-10165. (Closes: #852627)
     Thanks to Salvatore Bonaccorso <carnil@debian.org>
Checksums-Sha1:
 db35ab89e699efac02068d89474edf51f652cab2 1997 lcms2_2.8-4.dsc
 11da097e9a5197a06586779c57c71dbdd1f98941 11036 lcms2_2.8-4.debian.tar.xz
 92a7e15cbee8740a90d71c24eedce3de8e40c035 5741 lcms2_2.8-4_amd64.buildinfo
 efb72002e269559e3931da5cbc00f24893daf860 381106 liblcms2-2-dbgsym_2.8-4_amd64.deb
 e59e9e40a115b4bf6e145e7afaf858771196e01f 142742 liblcms2-2_2.8-4_amd64.deb
 187ae16412eeaa5b4ecbdbdb6ff8038cefc74633 4865774 liblcms2-dev_2.8-4_amd64.deb
 dc32d5917baebbb1dc4b4ae420f906f9777f23bb 110252 liblcms2-utils-dbgsym_2.8-4_amd64.deb
 5faf1e7eaffafdde06424bb74a217ebba12306f9 45918 liblcms2-utils_2.8-4_amd64.deb
Checksums-Sha256:
 3b92900948848eef62fa91b78f6b6661bd84eae6c49c224248c7c48a09b5f028 1997 lcms2_2.8-4.dsc
 50c0040fc92e1f2ca27740f608ae248acdd5b21a633f34cf2fe4d66f1d05c4b4 11036 lcms2_2.8-4.debian.tar.xz
 9ac6cf56a928970b48176880e644581c8d43f37735f569ac8109c75dbcb36ac4 5741 lcms2_2.8-4_amd64.buildinfo
 7d8c49dbc1ce11a81b333df7774ec689365324186af0d6b0d9ce956f823fb0a1 381106 liblcms2-2-dbgsym_2.8-4_amd64.deb
 006c3cc918c9465e40f30135770c1df0063907f5a39ce37986d23a6f5923166a 142742 liblcms2-2_2.8-4_amd64.deb
 04aaa61a4d6c1fc3f2026fd329f8511bb02a98f0822b46eb7bd494c8096c6aad 4865774 liblcms2-dev_2.8-4_amd64.deb
 3e67277e452dc5dbe284bed7d8cf89874122a93e39021ca4a46df2cc4bf95c96 110252 liblcms2-utils-dbgsym_2.8-4_amd64.deb
 d6ce3114dcf5fbb67de377c2973a1f65a801425308b8136f0a9769d747160325 45918 liblcms2-utils_2.8-4_amd64.deb
Files:
 9e684a18706a79f898d8f78f7b7121ef 1997 libs optional lcms2_2.8-4.dsc
 d04c4a82155a18452a2a6e8cc6800892 11036 libs optional lcms2_2.8-4.debian.tar.xz
 1a971ce688832a5be17e8e4eade7bcb6 5741 libs optional lcms2_2.8-4_amd64.buildinfo
 5af3e6448485e8998b318a62fd01d73f 381106 debug extra liblcms2-2-dbgsym_2.8-4_amd64.deb
 c39491f350ff54e98afd82506bec7b0d 142742 libs optional liblcms2-2_2.8-4_amd64.deb
 aa3f20d12ade31e0aa2f4a478c6a0ffa 4865774 libdevel optional liblcms2-dev_2.8-4_amd64.deb
 92fbb57574e1598fe71c7c4266fe5a65 110252 debug extra liblcms2-utils-dbgsym_2.8-4_amd64.deb
 ab85db712385fa1ba8214d7f4c192087 45918 utils optional liblcms2-utils_2.8-4_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXcRrV8dHdlRr8Kg5x/+TixwaPkkFAliK5nsACgkQx/+Tixwa
Pkl2lA/8D7+nemJgWWWGsO0AhCv8LVJOK1VpO/bHGWE6zA+PJjonPfrkF78z3NDf
ztl2tywZAE3NOr2zs2Bc9w9hqlABADWwXKAokGo1h4ZQ7xG0FjgBxv0c7HQzaBVl
6oy/95IB4/jkmJzmXEIEnuyfKHjAq8XixW9O95Pd9JpFWTtUHg9KegFu4ssbbvGW
VKxGCIYA5/bssCYVLIUARnybAW1nO30lKNx/bN6+x3yQyLHaAT5islqhhi/VH41V
EblP9s3R+r/OX/Y0AUQRXc4xvfdrzRoeX1ieTF7pHgRxZIT9AjcQkGql5ZYno6hL
2B0UW9G1zjYeqJm6IfExy4CxpX7RI5GnVvEFpuKU9NbM5BgipKyBR080jXjgn8H2
ZKhHS5ekNYY97nNGUvADBDuD9XvYdTvGtZrgNzXSnMxJaC94M0lJvW7uN057RJXY
6+6+4CQ6Etj2wF6nJfXyewIYO9atpHX/VYdb5s+qb6DQnh/El+TBKi/pRvRFZk80
91emduUTYJlHvTaZDPYGTsYp9NbVzK7/p4hPghNzVv2S4jB2xh/NNjwVBFu/TMJQ
mRwejxjkUW1U7Qam2eI3sRR546nqqwcKAjfzBLJEoDWb0HFg8wn/NwZeO6Sjz8WZ
8RTLC0N1NcrltfNy2MCDJKFFfj7cmQ+dJ/urK50sXL+iLQaazwM=
=fMpv
-----END PGP SIGNATURE-----

Message #34 received at 852627-submitter@bugs.debian.org (full text, mbox, reply):

From: Thomas Weber <tweber@debian.org>

To: 852627-submitter@bugs.debian.org

Subject: Bug#852627 marked as pending

Date: Fri, 27 Jan 2017 06:48:45 +0000

tag 852627 pending
thanks

Hello,

Bug #852627 reported by you has been fixed in the Git repository. You can
see the changelog below, and you can check the diff of the fix at:

    http://git.debian.org/?p=collab-maint/lcms2.git;a=commitdiff;h=e16d58f

---
commit e16d58fd5eee66d96d0f31b730eca299157f109a
Author: Thomas Weber <tweber@debian.org>
Date:   Thu Jan 26 11:04:40 2017 +0100

    Debian release 2.8-4

diff --git a/debian/changelog b/debian/changelog
index 309a388..602f838 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+lcms2 (2.8-4) unstable; urgency=medium
+
+  * New patch: debian/patches/fix-CVE-2016-10165.patch.
+    Fix for CVE-2016-10165. (Closes: #852627)
+    Thanks to Salvatore Bonaccorso <carnil@debian.org> 
+
+ -- Thomas Weber <tweber@debian.org>  Thu, 26 Jan 2017 11:04:13 +0100
+
 lcms2 (2.8-3) unstable; urgency=medium
 
   * New patch: lcms2-fix-strFrom16-byte-order.patch.

Message #39 received at 852627@bugs.debian.org (full text, mbox, reply):

From: Thomas Weber <tweber@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 852627@bugs.debian.org

Subject: Re: Bug#852627: lcms2: diff for NMU version 2.8-3.1

Date: Fri, 27 Jan 2017 07:50:31 +0100

On Fri, Jan 27, 2017 at 07:27:43AM +0100, Thomas Weber wrote:
> HI Salvatore,
> On Thu, Jan 26, 2017 at 09:44:49PM +0100, Salvatore Bonaccorso wrote:
> > Control: tags 852627 + pending
> > 
> > Dear maintainer,
> > 
> > I've prepared an NMU for lcms2 (versioned as 2.8-3.1) and
> > uploaded it to DELAYED/2. Please feel free to tell me if I
> > should delay it longer.
> 
> Sorry, I just uploaded 2.8-4 without checking the bug log again (I
> prepard the fix yesterday). So, your NMU will probably never hit
> unstable. I am sorry for the extra work.

Unblock request is https://bugs.debian.org/852770

	Thomas

Message #44 received at 852627@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Thomas Weber <tweber@debian.org>, 852627@bugs.debian.org

Subject: Re: Bug#852627: lcms2: diff for NMU version 2.8-3.1

Date: Fri, 27 Jan 2017 07:59:14 +0100

Hi Thomas,

On Fri, Jan 27, 2017 at 07:27:43AM +0100, Thomas Weber wrote:
> HI Salvatore,
> On Thu, Jan 26, 2017 at 09:44:49PM +0100, Salvatore Bonaccorso wrote:
> > Control: tags 852627 + pending
> > 
> > Dear maintainer,
> > 
> > I've prepared an NMU for lcms2 (versioned as 2.8-3.1) and
> > uploaded it to DELAYED/2. Please feel free to tell me if I
> > should delay it longer.
> 
> Sorry, I just uploaded 2.8-4 without checking the bug log again (I
> prepard the fix yesterday). So, your NMU will probably never hit
> unstable. I am sorry for the extra work.

No problem! Thanks for the fix to unstable an the unblock request!

Regards,
Salvatore

Message #49 received at 852627@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 852627@bugs.debian.org

Cc: Thomas Weber <tweber@debian.org>

Subject: Re: Bug#852627: lcms2: diff for NMU version 2.8-3.1

Date: Fri, 27 Jan 2017 14:37:45 +0100

Hi Thomas,

On Fri, Jan 27, 2017 at 07:59:14AM +0100, Salvatore Bonaccorso wrote:
> Hi Thomas,
> 
> On Fri, Jan 27, 2017 at 07:27:43AM +0100, Thomas Weber wrote:
> > HI Salvatore,
> > On Thu, Jan 26, 2017 at 09:44:49PM +0100, Salvatore Bonaccorso wrote:
> > > Control: tags 852627 + pending
> > > 
> > > Dear maintainer,
> > > 
> > > I've prepared an NMU for lcms2 (versioned as 2.8-3.1) and
> > > uploaded it to DELAYED/2. Please feel free to tell me if I
> > > should delay it longer.
> > 
> > Sorry, I just uploaded 2.8-4 without checking the bug log again (I
> > prepard the fix yesterday). So, your NMU will probably never hit
> > unstable. I am sorry for the extra work.
> 
> No problem! Thanks for the fix to unstable an the unblock request!

Btw, I just prepared as well an update for jessie-security and should
be able to upload shortly.

Regards,
Salvatore

Message #54 received at 852627-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 852627-close@bugs.debian.org

Subject: Bug#852627: fixed in lcms2 2.6-3+deb8u1

Date: Sun, 29 Jan 2017 15:02:09 +0000

Source: lcms2
Source-Version: 2.6-3+deb8u1

We believe that the bug you reported is fixed in the latest version of
lcms2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 852627@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated lcms2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 27 Jan 2017 14:26:09 +0100
Source: lcms2
Binary: liblcms2-dev liblcms2-dbg liblcms2-2 liblcms2-utils
Architecture: source
Version: 2.6-3+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Oleksandr Moskalenko <malex@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 852627
Description: 
 liblcms2-2 - Little CMS 2 color management library
 liblcms2-dbg - debugging symbols for lcms2
 liblcms2-dev - Little CMS 2 color management library development headers
 liblcms2-utils - Little CMS 2 color management library (utilities)
Changes:
 lcms2 (2.6-3+deb8u1) jessie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Added an extra check to MLU bounds (CVE-2016-10165) (Closes: #852627)
Checksums-Sha1: 
 4f224392dbd873c6045719b118c0e84a069efbf5 2287 lcms2_2.6-3+deb8u1.dsc
 b0ecee5cb8391338e6c281d1c11dcae2bc22a5d2 4583389 lcms2_2.6.orig.tar.gz
 7246c59c3789eaf44153b9ddf5c7ce2edfcd653d 2416964 lcms2_2.6-3+deb8u1.debian.tar.xz
Checksums-Sha256: 
 c81475db156883e857dd6c456e8a22e6554c6fb0f8e47622915a76d716d1ee5e 2287 lcms2_2.6-3+deb8u1.dsc
 5172528839647c54c3da211837225e221be93e4733f5b5e9f57668f7107e14b1 4583389 lcms2_2.6.orig.tar.gz
 81fcf1658e51d55408143e91b1c3469a63f3b4607e92604bd8a18dd8d6435d05 2416964 lcms2_2.6-3+deb8u1.debian.tar.xz
Files: 
 7ed1522f3eb21ad3be15dcea4efe9947 2287 libs optional lcms2_2.6-3+deb8u1.dsc
 f4c08d38ceade4a664ebff7228910a33 4583389 libs optional lcms2_2.6.orig.tar.gz
 b248aaeafb724ef63686102e3a2285cf 2416964 libs optional lcms2_2.6-3+deb8u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAliLTWhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89Ef3AP/0rqMzueIkDpty4GIFiWSm5/luLxaBQl
q4/QFy+YDP2eCbRxA1U+7Tly1I4BdPb0vXlDxm70dcKKHGrKN238+z+2AvfQEuVg
r82jpi4MdEpRzJeDSdG1DaMn4uBHR7qfjMSN5HtV2iIrLLi9yCSvqN8CdK7GCseZ
ivBDONOY7im/rFOEzn11VMcw2vrS6rpFJqB+Q9h9nK4kF34PJyjz1mOjrIeHxg0y
LlptrBzMvYPGDi2xRBjlOK9T/+aJBkempHKieMAZ60bGJ9T+iyRpyY4hDRDBd4in
tzAJ2CL4w02wfyOZKNCNfQW2zW3ucPjZRJb6SFUMizO8Pw4Yk8ux05QoDNTglR9o
I0ZLajl75FkOk7nGdsPu0AL+t0vb/5hYyHzGJtkDOM+qH65ZCRBBQNrTIb/iGZaR
UGLRO17gg2BCuLaKVj6+sb4FoR3SwfI/WuOaFqXLofI4xrgocn33EroFx13qWMvF
nQwKuWxA2OO+7SXH5hCBuokF4Akv0RCA77HXddyeYOXRxRSCTs5mtgwaa0+fNrtv
msBSP8CpwoeIpYBmwCc2qewN1vlqtqoNmiYaggwrsfwMIEPBxgTrdVOceK1g3H7z
72/A92b/euYBcEjmflw0WrAVSZMUkpKMHYA0/KX4qAcWciPFmK46ehDwM1Fiq548
S4tsNmWSARyY
=bNov
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.