[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Unblock roundcube



Hi!

Due to CVE-2008-5620, a new  upload of roundcube is currently sitting in
unstable. Here is the changelog:

roundcube (0.1.1-10) unstable; urgency=high

  * Fix a vulnerability in quota image generation. This fixes
    CVE-2008-5620. Thanks to Nico Golde for reporting it. Closes: #509596.
  * Add description to all patches.
  * Add missing ${misc:Depends} to debian/control.
  * Add missing dependency on php5-gd, used for quota bar.

 -- Vincent Bernat <bernat@debian.org>  Tue, 23 Dec 2008 20:52:39 +0100

The diffstat :

changelog                                  |   10 ++++++
 control                                    |   10 +++---
 control.in                                 |   10 +++---
 patches/correct-magic-path.patch           |    2 +
 patches/correct_install_path.patch         |    2 +
 patches/cve-2008-5620.patch                |   45 +++++++++++++++++++++++++++++
 patches/dbconfig-common_support.patch      |    2 +
 patches/disable-tinymce-spellchecker.patch |    2 +
 patches/dont-use-preg-e-option.patch       |    2 +
 patches/messageid-headers-ordering.patch   |    2 +
 patches/mysql-update-fix.patch             |    2 +
 patches/series                             |    1 
 patches/use-db-backend.patch               |    2 +
 patches/use_packaged_tinymce.patch         |    2 +

And I attach the real diff.

Index: debian/control
===================================================================
--- debian/control	(.../0.1.1-9)	(révision 189)
+++ debian/control	(.../0.1.1-10)	(révision 189)
@@ -11,7 +11,7 @@
 
 Package: roundcube-core
 Architecture: all
-Depends: dbconfig-common, debconf | debconf-2.0, apache2 | lighttpd | httpd, php5, php5-mcrypt, roundcube-db, php-db, php-auth, php-net-smtp, php-net-socket, php-mail-mime (>= 1.5.0), ucf, tinymce2 | tinymce (<< 3), ${misc:Depends}, libmagic1
+Depends: dbconfig-common, debconf | debconf-2.0, apache2 | lighttpd | httpd, php5, php5-mcrypt, php5-gd, roundcube-db, php-db, php-auth, php-net-smtp, php-net-socket, php-mail-mime (>= 1.5.0), ucf, tinymce2 | tinymce (<< 3), ${misc:Depends}, libmagic1
 Replaces: roundcube
 Conflicts: roundcube (<< 0.1~rc2-2)
 Description: skinnable AJAX based webmail solution for IMAP servers
@@ -27,7 +27,7 @@
 
 Package: roundcube
 Architecture: all
-Depends: roundcube-sqlite | roundcube-db, roundcube-core (= ${source:Version})
+Depends: roundcube-sqlite | roundcube-db, roundcube-core (= ${source:Version}), ${misc:Depends}
 Description: skinnable AJAX based webmail solution for IMAP servers
  RoundCube Webmail is a browser-based multilingual IMAP client with an
  application-like user interface. It provides full functionality
@@ -40,7 +40,7 @@
 
 Package: roundcube-mysql
 Architecture: all
-Depends: php5-mysql, mysql-client | virtual-mysql-client
+Depends: php5-mysql, mysql-client | virtual-mysql-client, ${misc:Depends}
 Suggests: mysql-server
 Provides: roundcube-db
 Description: metapackage providing MySQL dependencies for RoundCube
@@ -50,7 +50,7 @@
 
 Package: roundcube-pgsql
 Architecture: all
-Depends: php5-pgsql, postgresql-client-8.1 | postgresql-client 
+Depends: php5-pgsql, postgresql-client-8.1 | postgresql-client, ${misc:Depends}
 Suggests: postgresql-server
 Provides: roundcube-db
 Description: metapackage providing PostgreSQL dependencies for RoundCube
@@ -60,7 +60,7 @@
 
 Package: roundcube-sqlite
 Architecture: all
-Depends: php5-sqlite, sqlite
+Depends: php5-sqlite, sqlite, ${misc:Depends}
 Provides: roundcube-db
 Description: metapackage providing sqlite dependencies for RoundCube
  This package provides sqlite dependencies for RoundCube Webmail, a
Index: debian/control.in
===================================================================
--- debian/control.in	(.../0.1.1-9)	(révision 189)
+++ debian/control.in	(.../0.1.1-10)	(révision 189)
@@ -11,7 +11,7 @@
 
 Package: roundcube-core
 Architecture: all
-Depends: dbconfig-common, debconf | debconf-2.0, apache2 | lighttpd | httpd, php5, php5-mcrypt, roundcube-db, php-db, php-auth, php-net-smtp, php-net-socket, php-mail-mime (>= 1.5.0), ucf, tinymce2 | tinymce (<< 3), ${misc:Depends}, libmagic1
+Depends: dbconfig-common, debconf | debconf-2.0, apache2 | lighttpd | httpd, php5, php5-mcrypt, php5-gd, roundcube-db, php-db, php-auth, php-net-smtp, php-net-socket, php-mail-mime (>= 1.5.0), ucf, tinymce2 | tinymce (<< 3), ${misc:Depends}, libmagic1
 Replaces: roundcube
 Conflicts: roundcube (<< 0.1~rc2-2)
 Description: skinnable AJAX based webmail solution for IMAP servers
@@ -27,7 +27,7 @@
 
 Package: roundcube
 Architecture: all
-Depends: roundcube-sqlite | roundcube-db, roundcube-core (= ${source:Version})
+Depends: roundcube-sqlite | roundcube-db, roundcube-core (= ${source:Version}), ${misc:Depends}
 Description: skinnable AJAX based webmail solution for IMAP servers
  RoundCube Webmail is a browser-based multilingual IMAP client with an
  application-like user interface. It provides full functionality
@@ -40,7 +40,7 @@
 
 Package: roundcube-mysql
 Architecture: all
-Depends: php5-mysql, mysql-client | virtual-mysql-client
+Depends: php5-mysql, mysql-client | virtual-mysql-client, ${misc:Depends}
 Suggests: mysql-server
 Provides: roundcube-db
 Description: metapackage providing MySQL dependencies for RoundCube
@@ -50,7 +50,7 @@
 
 Package: roundcube-pgsql
 Architecture: all
-Depends: php5-pgsql, postgresql-client-8.1 | postgresql-client 
+Depends: php5-pgsql, postgresql-client-8.1 | postgresql-client, ${misc:Depends}
 Suggests: postgresql-server
 Provides: roundcube-db
 Description: metapackage providing PostgreSQL dependencies for RoundCube
@@ -60,7 +60,7 @@
 
 Package: roundcube-sqlite
 Architecture: all
-Depends: php5-sqlite, sqlite
+Depends: php5-sqlite, sqlite, ${misc:Depends}
 Provides: roundcube-db
 Description: metapackage providing sqlite dependencies for RoundCube
  This package provides sqlite dependencies for RoundCube Webmail, a
Index: debian/patches/dont-use-preg-e-option.patch
===================================================================
--- debian/patches/dont-use-preg-e-option.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/dont-use-preg-e-option.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+Fix a vulnerability due to the use of "e" option of preg_replace.
+
 --- roundcube/program/lib/html2text.inc	2008-04-12 15:54:45.000000000 +0200
 +++ roundcube/program/lib/html2text.inc	2008-12-13 14:21:44.000000000 +0100
 @@ -99,6 +99,22 @@
Index: debian/patches/messageid-headers-ordering.patch
===================================================================
--- debian/patches/messageid-headers-ordering.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/messageid-headers-ordering.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+Fix ordering of Message-ID headers to avoid to be reported as spam.
+
 --- roundcubemail/program/steps/mail/sendmail.inc (revision 1232)
 +++ roundcubemail/program/steps/mail/sendmail.inc (revision 1261)
 @@ -211,7 +211,4 @@
Index: debian/patches/correct_install_path.patch
===================================================================
--- debian/patches/correct_install_path.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/correct_install_path.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+Install path is /var/lib/roundcube for Debian. Don't try to guess it.
+
 --- roundcubemail-0.1~rc1~dfsg.orig/index.php~	2007-05-18 15:11:22.000000000 +0200
 +++ roundcubemail-0.1~rc1~dfsg.orig/index.php	2007-05-20 14:12:35.000000000 +0200
 @@ -47,7 +47,7 @@
Index: debian/patches/use_packaged_tinymce.patch
===================================================================
--- debian/patches/use_packaged_tinymce.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/use_packaged_tinymce.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+Use tinymce from tinycme package instead of the shipped one.
+
 Index: roundcube-0.1~rc2/program/steps/mail/sendmail.inc
 ===================================================================
 --- roundcube-0.1~rc2.orig/program/steps/mail/sendmail.inc	2007-11-26 11:42:36.000000000 +0100
Index: debian/patches/use-db-backend.patch
===================================================================
--- debian/patches/use-db-backend.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/use-db-backend.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+Use db backend since mdb2 is not yet available in Debian.
+
 --- roundcubemail-0.1-dep/config/db.inc.php.dist~	2008-03-03 22:32:15.000000000 +0100
 +++ roundcubemail-0.1-dep/config/db.inc.php.dist	2008-03-05 21:07:28.000000000 +0100
 @@ -27,7 +27,7 @@
Index: debian/patches/correct-magic-path.patch
===================================================================
--- debian/patches/correct-magic-path.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/correct-magic-path.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+On Debian, the magic file is in /usr/share/file/magic.
+
 --- roundcube-0.1/config/main.inc.php.dist~	2008-02-21 11:27:19.000000000 +0100
 +++ roundcube-0.1/config/main.inc.php.dist	2008-03-06 14:04:53.000000000 +0100
 @@ -277,7 +277,7 @@
Index: debian/patches/mysql-update-fix.patch
===================================================================
--- debian/patches/mysql-update-fix.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/mysql-update-fix.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+Fix a typo in MySQL update file.
+
 --- roundcubemail-0.1.1-dep/SQL/mysql.update.sql~	2008-04-05 14:49:21.000000000 +0200
 +++ roundcubemail-0.1.1-dep/SQL/mysql.update.sql	2008-04-05 18:09:10.000000000 +0200
 @@ -5,7 +5,7 @@
Index: debian/patches/disable-tinymce-spellchecker.patch
===================================================================
--- debian/patches/disable-tinymce-spellchecker.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/disable-tinymce-spellchecker.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+Don't use tinymce spellchecker, this plugin is not available in Debian package.
+
 --- roundcube-0.1/program/js/editor.js~	2008-02-13 04:31:05.000000000 +0100
 +++ roundcube-0.1/program/js/editor.js	2008-03-07 09:53:39.000000000 +0100
 @@ -21,7 +21,7 @@
Index: debian/patches/series
===================================================================
--- debian/patches/series	(.../0.1.1-9)	(révision 189)
+++ debian/patches/series	(.../0.1.1-10)	(révision 189)
@@ -7,3 +7,4 @@
 mysql-update-fix.patch
 messageid-headers-ordering.patch
 dont-use-preg-e-option.patch
+cve-2008-5620.patch
Index: debian/patches/dbconfig-common_support.patch
===================================================================
--- debian/patches/dbconfig-common_support.patch	(.../0.1.1-9)	(révision 189)
+++ debian/patches/dbconfig-common_support.patch	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,5 @@
+The default db.inc.php is modified to adapt it to the use of dbconfig-common package.
+
 --- roundcube_0.1~beta2.2/config/db.inc.php.dist        2006-03-20 23:08:51.000000000 +0100
 +++ roundcube_0.1~beta2.2/config/db.inc.php.dist  2007-03-13 14:33:38.000000000 +0100
 @@ -14,13 +14,20 @@
Index: debian/patches/cve-2008-5620.patch
===================================================================
--- debian/patches/cve-2008-5620.patch	(.../0.1.1-9)	(révision 0)
+++ debian/patches/cve-2008-5620.patch	(.../0.1.1-10)	(révision 189)
@@ -0,0 +1,45 @@
+Fix CVE-2008-5620 which was caused by insufficient input sanitizing for quota bar.
+
+diff --git a/bin/quotaimg.php b/bin/quotaimg.php
+index 354f4eb..4e73c21 100644
+--- a/bin/quotaimg.php
++++ b/bin/quotaimg.php
+@@ -18,10 +18,10 @@
+ 
+ */
+ 
+-$used   = ((isset($_GET['u']) && !empty($_GET['u'])) || $_GET['u']=='0')?(int)$_GET['u']:'??';
+-$quota  = ((isset($_GET['q']) && !empty($_GET['q'])) || $_GET['q']=='0')?(int)$_GET['q']:'??';
+-$width  = empty($_GET['w']) ? 100 : (int)$_GET['w'];
+-$height = empty($_GET['h']) ? 14 : (int)$_GET['h'];
++$used   = isset($_GET['u']) ? intval($_GET['u']) : '??';
++$quota  = isset($_GET['q']) ? intval($_GET['q']) : '??';
++$width  = empty($_GET['w']) ? 100 : min(300, intval($_GET['w']));
++$height = empty($_GET['h']) ? 14  : min(50,  intval($_GET['h']));
+ 
+ /**
+  * Quota display
+@@ -159,7 +159,7 @@ function genQuota($used, $total, $width, $height)
+ 		}
+ 
+ 		$quota_width = $quota / 100 * $width;
+-		imagefilledrectangle($im, $border, 0, $quota, $height-2*$border, $fill);
++		imagefilledrectangle($im, $border, 0, $quota_width, $height-2*$border, $fill);
+ 
+ 		$string = $quota . '%';
+ 		$mid    = floor(($width-(strlen($string)*imagefontwidth($font)))/2)+1;
+@@ -178,6 +178,12 @@ function genQuota($used, $total, $width, $height)
+ 	imagedestroy($im);
+ }
+ 
+-genQuota($used, $quota, $width, $height);
++if ($width > 1 && $height > 1) {
++	genQuota($used, $quota, $width, $height);
++}
++else {
++	header("HTTP/1.0 404 Not Found");
++}
++
+ exit;
+ ?>
+\ No newline at end of file
Index: debian/changelog
===================================================================
--- debian/changelog	(.../0.1.1-9)	(révision 189)
+++ debian/changelog	(.../0.1.1-10)	(révision 189)
@@ -1,3 +1,13 @@
+roundcube (0.1.1-10) unstable; urgency=high
+
+  * Fix a vulnerability in quota image generation. This fixes
+    CVE-2008-5620. Thanks to Nico Golde for reporting it. Closes: #509596.
+  * Add description to all patches.
+  * Add missing ${misc:Depends} to debian/control.
+  * Add missing dependency on php5-gd, used for quota bar.
+
+ -- Vincent Bernat <bernat@debian.org>  Tue, 23 Dec 2008 20:52:39 +0100
+
 roundcube (0.1.1-9) unstable; urgency=high
 
   * Fix a vulnerability in preg_replace() use. Thanks to Andreas
Thanks.
-- 
panic("aha1740.c"); /* Goodbye */
	2.2.16 /usr/src/linux/drivers/scsi/aha1740.c

Attachment: pgpy7e2G003GZ.pgp
Description: PGP signature


Reply to: