--- Begin Message ---
package: tla
severity: serious
tags: security
Hi,
The following CVE (Common Vulnerabilities & Exposures) ids were
published for expat. I have determined that this package embeds a
vulnerable copy of xmlparse.c and xmltok_impl.c. However, since this is
a mass bug filing (due to so many packages embedding expat), I have
not had time to determine whether the vulnerable code is actually
present in any of the binary packages derived from this source package.
Please determine whether this is the case. If the binary packages are
not affected, please feel free to close the bug with a message
containing the details of what you did to check.
CVE-2009-3560[0]:
| The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
| as used in the XML-Twig module for Perl, allows context-dependent
| attackers to cause a denial of service (application crash) via an XML
| document with malformed UTF-8 sequences that trigger a buffer
| over-read, related to the doProlog function in lib/xmlparse.c, a
| different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVE-2009-3720[1]:
| The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
| 2.0.1, as used in Python, PyXML, w3c-libwww, and other software,
| allows context-dependent attackers to cause a denial of service
| (application crash) via an XML document with crafted UTF-8 sequences
| that trigger a buffer over-read, a different vulnerability than
| CVE-2009-2625.
These issues also affect old versions of expat, so this package in etch
and lenny is very likely affected. This is a low-severity security
issue, so DSAs will not be issued to correct these problems. However,
you can optionally submit a proposed-update to the release team for
inclusion in the next stable point releases. If you plan to do this,
please open new bugs and include the security tag so we are aware that
you are working on that.
For further information see [0],[1],[2],[3]. In particular, [2] and [3]
are links to the patches for CVE-2009-3560 and CVE-2009-3720
respectively. Note that the ideal solution would be to make use of the
system expat so only one package will need to be updated for future
security issues. Preferably in your update to unstable, alter your
package to make use of the system expat.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560
http://security-tracker.debian.org/tracker/CVE-2009-3560
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720
http://security-tracker.debian.org/tracker/CVE-2009-3720
[2]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
[3]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
--- End Message ---
--- Begin Message ---
Source: tla
Source-Version: 1.3.5+dfsg-15
We believe that the bug you reported is fixed in the latest version of
tla, which is due to be installed in the Debian FTP archive:
tla-doc_1.3.5+dfsg-15_all.deb
to main/t/tla/tla-doc_1.3.5+dfsg-15_all.deb
tla_1.3.5+dfsg-15.diff.gz
to main/t/tla/tla_1.3.5+dfsg-15.diff.gz
tla_1.3.5+dfsg-15.dsc
to main/t/tla/tla_1.3.5+dfsg-15.dsc
tla_1.3.5+dfsg-15_i386.deb
to main/t/tla/tla_1.3.5+dfsg-15_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 560940@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sylvain Beucler <beuc@beuc.net> (supplier of updated tla package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 14 Dec 2009 17:27:55 +0100
Source: tla
Binary: tla tla-doc
Architecture: source all i386
Version: 1.3.5+dfsg-15
Distribution: unstable
Urgency: low
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Sylvain Beucler <beuc@beuc.net>
Description:
tla - GNU Arch revision control system
tla-doc - GNU Arch revision control system (documentation)
Closes: 560940
Changes:
tla (1.3.5+dfsg-15) unstable; urgency=low
.
* QA upload.
* Use system libexpat instead of bundled one (closes: #560940).
Checksums-Sha1:
6833f0f593dfdcfefbd11fe1f4e865fad5197296 1647 tla_1.3.5+dfsg-15.dsc
99fca620f480935297b0adfe962990d9252ee427 33359 tla_1.3.5+dfsg-15.diff.gz
0e696755b39966f0869a6caa0e90db02e5ac910c 50462 tla-doc_1.3.5+dfsg-15_all.deb
be389e59b732b80a150f71292f13991a837e81bc 348136 tla_1.3.5+dfsg-15_i386.deb
Checksums-Sha256:
b1a45d3e9f68ff1078f237ee102249f253f5b3c6abf14fc4cfa19e7860d21539 1647 tla_1.3.5+dfsg-15.dsc
544415b17f25823fd113152e8867b0a794ecd2fa2ebd595d8dceb0e675de67a0 33359 tla_1.3.5+dfsg-15.diff.gz
39f08a96422e55d98966b8e9824585c535d30502d858053c1eb8a5b52d207a06 50462 tla-doc_1.3.5+dfsg-15_all.deb
2c093cd62dd36ca73b6d4cfd2d26f42de6bc71aa1c3148fbe4fbae961486a295 348136 tla_1.3.5+dfsg-15_i386.deb
Files:
7206016e241c16d8ca931493638c4b78 1647 devel optional tla_1.3.5+dfsg-15.dsc
b57bb44c2be1ff6d59c8553e6ac91bb2 33359 devel optional tla_1.3.5+dfsg-15.diff.gz
4f2eb8e07faa93b59da5d63548ed2eef 50462 doc optional tla-doc_1.3.5+dfsg-15_all.deb
76a5950836ec9f192cd1464b598f9af6 348136 devel optional tla_1.3.5+dfsg-15_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQIVAwUBS0lgP+e/yOyVhhEJAQrYgxAAn6oJiii9W3lhiRspy+yqtEMIMzL3NPag
i7RyhnMwszWUIsGPVCUYZ7wZCOYKg+dBGAnDRenUA7Wuy3ZAyCMHuLG5AnuY1MBR
BKm0MESy1vcedFOghDEqT2FbtaFiKaYgmjxn95ueYa2bxjNhoVkRvOpPIMJu4q8v
kjizgYQSyTumsrW8aERVd/HpJJjKpJMvDfi9GI5PjLgYwwLWJUFUdUfh5USwDS5h
uik7qByjoKfX8COPpm2co7Sx5/QmrkrBwY2LKJN7KrUsAk+soEZGUkkGs6ro+fam
DAfyUe01SIW/w/MYgvQ5o+I/MHdvAC3W6/k0o+wgA1nEhIpFXOVjHchqhWuru8fh
E5AsX1XDNRkYAZpxICHhLO1khxUgz/H+j8k1GXSBab1fP6Dz7r55Qqc6EkgxIg9/
ksAjni1Nwyd3dsUlzGWeZHdlzgMqK4vjIRMT8x7adC13P6RMsE4EjxfAJSzl+UaG
J9gUILW0vD55Jhi9En/+UhufP/85R04YN5rsgGB4IovOXapYrucsF+Q1NwV/DfO0
tg7hj6pkOCTWuzWer7KKrG8oqMralPB9/EN1zkn1RKYGwhE9yVHCLG8h49BBQqVG
dInehn4H3dtCznh0eb5lc0zhG2waDvQAyRhlszoUn5fzqZTKDmxoFSEO4IIBeaW+
vIR12/EOgNo=
=o45x
-----END PGP SIGNATURE-----
--- End Message ---