Your message dated Sat, 22 Jan 2011 19:35:59 +0100 with message-id <4D3B238F.30104@dogguy.org> and subject line Re: Bug#610780: unblock: pcsc-lite/1.5.5-4 (Fixes CVE-2010-4531) has caused the Debian Bug report #610780, regarding unblock: pcsc-lite/1.5.5-4 (Fixes CVE-2010-4531) to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 610780: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=610780 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
--- Begin Message ---
- To: Debian Bug Tracking System <submit@bugs.debian.org>
- Subject: unblock: pcsc-lite/1.5.5-4 (Fixes CVE-2010-4531)
- From: Ludovic Rousseau <rousseau@debian.org>
- Date: Sat, 22 Jan 2011 13:08:10 +0100
- Message-id: <[🔎] 20110122120810.2620.19117.reportbug@localhost.localdomain>
Package: release.debian.org Severity: normal User: release.debian.org@packages.debian.org Usertags: unblock Please unblock package pcsc-lite This version fixes a security bug. I also contacted the security team for the stable distribution. debdiff pcsc-lite_1.5.5-3.dsc pcsc-lite_1.5.5-4.dsc diff -u pcsc-lite-1.5.5/debian/changelog pcsc-lite-1.5.5/debian/changelog --- pcsc-lite-1.5.5/debian/changelog +++ pcsc-lite-1.5.5/debian/changelog @@ -1,3 +1,11 @@ +pcsc-lite (1.5.5-4) unstable; urgency=high + + * Fix CVE-2010-4531: buffer overflow in the ATRDecodeAtr function in the + Answer-to-Reset (ATR) Handler (atrhandler.c) + * Closes: #607781 "pcsc-lite: buffer overflow" + + -- Ludovic Rousseau <rousseau@debian.org> Wed, 19 Jan 2011 20:31:43 +0100 + pcsc-lite (1.5.5-3) unstable; urgency=low * debian/update-reader.conf: store the generated configuration file in only in patch2: unchanged: --- pcsc-lite-1.5.5.orig/src/atrhandler.c +++ pcsc-lite-1.5.5/src/atrhandler.c @@ -239,6 +239,9 @@ if (psExtension->CardCapabilities.AvailableProtocols & SCARD_PROTOCOL_T1) TCK = pucAtr[p++]; + if (p > MAX_ATR_SIZE) + return 0; /** @retval 0 Maximum attribute size */ + memcpy(psExtension->ATR.Value, pucAtr, p); psExtension->ATR.Length = p; /* modified from p-1 */ unblock pcsc-lite/1.5.5-4 -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash
--- End Message ---
--- Begin Message ---
- To: Ludovic Rousseau <rousseau@debian.org>, 610780-done@bugs.debian.org
- Subject: Re: Bug#610780: unblock: pcsc-lite/1.5.5-4 (Fixes CVE-2010-4531)
- From: Mehdi Dogguy <mehdi@dogguy.org>
- Date: Sat, 22 Jan 2011 19:35:59 +0100
- Message-id: <4D3B238F.30104@dogguy.org>
- In-reply-to: <[🔎] 20110122120810.2620.19117.reportbug@localhost.localdomain>
- References: <[🔎] 20110122120810.2620.19117.reportbug@localhost.localdomain>
On 01/22/2011 01:08 PM, Ludovic Rousseau wrote: > Package: release.debian.org Severity: normal User: > release.debian.org@packages.debian.org Usertags: unblock > > Please unblock package pcsc-lite > Unblocked. Please note that "I don't plan to fix the problem in squeeze" is not a valid reason to downgrade the severity. -- Mehdi Dogguy مهدي الدڤي http://dogguy.org/
--- End Message ---