[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#559829: marked as done (CVE-2009-3736 local privilege escalation)

Your message dated Sun, 24 Jan 2010 00:38:04 +0000
with message-id <E1NYqUO-0003dS-W2@ries.debian.org>
and subject line Bug#559829: fixed in synfig 0.62.00-1
has caused the Debian Bug report #559829,
regarding CVE-2009-3736 local privilege escalation
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org

559829: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559829
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: synfig
Severity: grave
Tags: security


The following CVE (Common Vulnerabilities & Exposures) id was
published for libtool.  I have determined that this package embeds a
vulnerable copy of the libtool source code.  However, since this is a
mass bug filing (due to so many packages embedding libtool), I have not
had time to determine whether the vulnerable code is actually present
in any of the binary packages. Please determine whether this is the
case. If the binary packages are not affected, please feel free to close
the bug with a message containing the details of what you did to check.

| ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b,
| attempts to open a .la file in the current working directory, which
| allows local users to gain privileges via a Trojan horse file.

Note that this problem also affects etch and lenny, so if your package
is affected, please coordinate with the security team to release the
DSA for the affected packages.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3736

--- End Message ---
--- Begin Message ---
Source: synfig
Source-Version: 0.62.00-1

We believe that the bug you reported is fixed in the latest version of
synfig, which is due to be installed in the Debian FTP archive:

  to main/s/synfig/libsynfig-dev_0.62.00-1_amd64.deb
  to main/s/synfig/libsynfig0_0.62.00-1_amd64.deb
  to main/s/synfig/synfig-dbg_0.62.00-1_amd64.deb
  to main/s/synfig/synfig-examples_0.62.00-1_all.deb
  to main/s/synfig/synfig_0.62.00-1.diff.gz
  to main/s/synfig/synfig_0.62.00-1.dsc
  to main/s/synfig/synfig_0.62.00-1_amd64.deb
  to main/s/synfig/synfig_0.62.00.orig.tar.gz

A summary of the changes between this version and the previous one is

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 559829@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
Stefano Zacchiroli <zack@debian.org> (supplier of updated synfig package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

Hash: SHA1

Format: 1.8
Date: Sun, 24 Jan 2010 00:01:27 +0100
Source: synfig
Binary: synfig libsynfig0 libsynfig-dev synfig-dbg synfig-examples
Architecture: source all amd64
Version: 0.62.00-1
Distribution: unstable
Urgency: low
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Stefano Zacchiroli <zack@debian.org>
 libsynfig-dev - synfig library development files
 libsynfig0 - render library and plugins for synfig 2D animation
 synfig     - vector-based 2D animation renderer
 synfig-dbg - synfig debugging symbols
 synfig-examples - synfig animation examples
Closes: 559829
 synfig (0.62.00-1) unstable; urgency=low
   * QA upload.
   * New upstream release.
   * Upgrade to a non-vulnerable version of ltdl and link against system
     library libltdl3; add build-dep on libltdl3-dev and force configure to
     use system library. Fix for CVE-2009-3736. (Closes: #559829)
   * Bump dep on etl-dev to >= 0.04.13 (needed since this version)
   * Bump standards-version to 3.8.3 (no changes needed)
   * Ship libsynfig.a, which was not installed before (not even by upstream)
   * Set section for package synfig-dbg to "debug" (thanks, lintian)
 e8320ca4b6c4d8bf494b930fec4f9a724a9eb464 1480 synfig_0.62.00-1.dsc
 10c5ffcffac0a3d2d2290a98fde2bc079aaaaca3 2916586 synfig_0.62.00.orig.tar.gz
 6be9909ee1663d37c4d410ed73159ddde36f67fa 368054 synfig_0.62.00-1.diff.gz
 7cca370e343c074a71136beaaafedb2df549c9d2 1380408 synfig-examples_0.62.00-1_all.deb
 42d5ed5dc4a5d7be63f01fd83a4c49c6dc7f5165 234562 synfig_0.62.00-1_amd64.deb
 c9ca752eb8de54a975678ccd6a461fa31b81c178 2784622 libsynfig0_0.62.00-1_amd64.deb
 eeaed37014aea2a5f023b1e736ce1ddac33e6903 1447070 libsynfig-dev_0.62.00-1_amd64.deb
 bdcc5e69a513a8ffa4ac792bbf73691744c05fd8 8688610 synfig-dbg_0.62.00-1_amd64.deb
 40742b4bd7b4098f97c35fa65211f432badc714f2560918d6b83652a561b90a9 1480 synfig_0.62.00-1.dsc
 982a2c86b4eaa807e4dfd410020771bd84f6f4ca4b3088c7f71bb19b649280a8 2916586 synfig_0.62.00.orig.tar.gz
 712c36573dfa105406f09a849fff235ecc3a480ae2ffc2d697a65bfbad8d75b0 368054 synfig_0.62.00-1.diff.gz
 a5e9fd856f6a93f35fbe8d0b9a6dbc6850d4c884639dd0426664d5ad773bd44f 1380408 synfig-examples_0.62.00-1_all.deb
 22ccd0fbb2ed77b5f65fa363bc564af16899a20c0fe2df7f25bcf4ff4c5ffd10 234562 synfig_0.62.00-1_amd64.deb
 b42d613a8accc4e95012238bb28e5f785ed289ecea107f4a59ba70669cf1aba6 2784622 libsynfig0_0.62.00-1_amd64.deb
 e188efed0bed0a0a27b91fc63624f32c6c212274d4c3f7a8ddfe9e66cb755930 1447070 libsynfig-dev_0.62.00-1_amd64.deb
 0606afb07064d5da24fe8e1caf896c797d960a5a48759a9c12fd61c8cfb25dda 8688610 synfig-dbg_0.62.00-1_amd64.deb
 0e2664171f5397db0e8dd72cda0307dc 1480 graphics optional synfig_0.62.00-1.dsc
 773f3507c9fa5dfc084ad7e38a08a33f 2916586 graphics optional synfig_0.62.00.orig.tar.gz
 fc8abe0f841c7a4a4e640a6400800bb9 368054 graphics optional synfig_0.62.00-1.diff.gz
 ec00b1d6b08e67576c298ef0ea580c46 1380408 graphics optional synfig-examples_0.62.00-1_all.deb
 879bee6fa80e61eb957fbc3dbf13fe63 234562 graphics optional synfig_0.62.00-1_amd64.deb
 ba2a7cf4cada67b687f416b74be5964a 2784622 libs optional libsynfig0_0.62.00-1_amd64.deb
 898f2db439193e5ee9b6e2f67fc50794 1447070 libdevel optional libsynfig-dev_0.62.00-1_amd64.deb
 fdc91484db7bc2f43bb7d98417d9e8ca 8688610 debug extra synfig-dbg_0.62.00-1_amd64.deb

Version: GnuPG v1.4.10 (GNU/Linux)


--- End Message ---

Reply to: