Bug#560940: marked as done (CVE-2009-3560 and CVE-2009-3720 denial-of-services)
Your message dated Fri, 16 Apr 2010 19:57:49 +0000
with message-id <E1O2rfh-0007ir-AK@ries.debian.org>
and subject line Bug#560940: fixed in tla 1.3.5+dfsg-14+lenny1
has caused the Debian Bug report #560940,
regarding CVE-2009-3560 and CVE-2009-3720 denial-of-services
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact email@example.com
Debian Bug Tracking System
Contact firstname.lastname@example.org with problems
--- Begin Message ---
The following CVE (Common Vulnerabilities & Exposures) ids were
published for expat. I have determined that this package embeds a
vulnerable copy of xmlparse.c and xmltok_impl.c. However, since this is
a mass bug filing (due to so many packages embedding expat), I have
not had time to determine whether the vulnerable code is actually
present in any of the binary packages derived from this source package.
Please determine whether this is the case. If the binary packages are
not affected, please feel free to close the bug with a message
containing the details of what you did to check.
| The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
| as used in the XML-Twig module for Perl, allows context-dependent
| attackers to cause a denial of service (application crash) via an XML
| document with malformed UTF-8 sequences that trigger a buffer
| over-read, related to the doProlog function in lib/xmlparse.c, a
| different vulnerability than CVE-2009-2625 and CVE-2009-3720.
| The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
| 2.0.1, as used in Python, PyXML, w3c-libwww, and other software,
| allows context-dependent attackers to cause a denial of service
| (application crash) via an XML document with crafted UTF-8 sequences
| that trigger a buffer over-read, a different vulnerability than
These issues also affect old versions of expat, so this package in etch
and lenny is very likely affected. This is a low-severity security
issue, so DSAs will not be issued to correct these problems. However,
you can optionally submit a proposed-update to the release team for
inclusion in the next stable point releases. If you plan to do this,
please open new bugs and include the security tag so we are aware that
you are working on that.
For further information see ,,,. In particular,  and 
are links to the patches for CVE-2009-3560 and CVE-2009-3720
respectively. Note that the ideal solution would be to make use of the
system expat so only one package will need to be updated for future
security issues. Preferably in your update to unstable, alter your
package to make use of the system expat.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
--- End Message ---
--- Begin Message ---
We believe that the bug you reported is fixed in the latest version of
tla, which is due to be installed in the Debian FTP archive:
A summary of the changes between this version and the previous one is
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to email@example.com,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
Sylvain Beucler <firstname.lastname@example.org> (supplier of updated tla package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing email@example.com)
-----BEGIN PGP SIGNED MESSAGE-----
Date: Tue, 13 Apr 2010 17:55:51 +0200
Binary: tla tla-doc
Architecture: source all i386
Maintainer: Debian QA Group <firstname.lastname@example.org>
Changed-By: Sylvain Beucler <email@example.com>
tla - GNU Arch revision control system
tla-doc - GNU Arch revision control system (documentation)
tla (1.3.5+dfsg-14+lenny1) stable; urgency=low
* QA upload.
* Fix CVE-2009-3560 and CVE-2009-3720 denial-of-services by patching
bundled libexpat (closes: #560940).
66add203ec04b2c7914d0021f55af3eb5f55e85a 1663 tla_1.3.5+dfsg-14+lenny1.dsc
7d1cbfe4a1eab9316dc4f11f3b7c53bf7f96b227 368092 tla_1.3.5+dfsg-14+lenny1.diff.gz
adc55825fe575569cc072a6c18691dfda8ec4e27 44864 tla-doc_1.3.5+dfsg-14+lenny1_all.deb
1b962b68fab671a6874750dec73cbd5c111cc697 399790 tla_1.3.5+dfsg-14+lenny1_i386.deb
a68565a885d3f84e28f4575f8faa2910edadab51e310b0853081853eae102538 1663 tla_1.3.5+dfsg-14+lenny1.dsc
e76a0afe09294cf5e205e6aa99e08d008e03414da88d771c1be806f10d65a2ec 368092 tla_1.3.5+dfsg-14+lenny1.diff.gz
7bbb6c692428c271b8d0c82f95e8cdd25f31dc75a2f38dfdd6c7e7d82b6bee1a 44864 tla-doc_1.3.5+dfsg-14+lenny1_all.deb
d03459263508f4db4505b7405206207c4bb1290553e86bd15d86f0b6f00e2e6a 399790 tla_1.3.5+dfsg-14+lenny1_i386.deb
c2e4273185130b6f9f29581448261da8 1663 devel optional tla_1.3.5+dfsg-14+lenny1.dsc
7d841cdc13ac1decdf7ffa21fc458699 368092 devel optional tla_1.3.5+dfsg-14+lenny1.diff.gz
02c6da50a9bed56de80fd57c636b7415 44864 doc optional tla-doc_1.3.5+dfsg-14+lenny1_all.deb
4c18338be72c6e1bb782c032f77d8eb9 399790 devel optional tla_1.3.5+dfsg-14+lenny1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
-----END PGP SIGNATURE-----
--- End Message ---