[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#848942: marked as done (jessie-pu: package most/5.0.0a-2.3)

Your message dated Sat, 14 Jan 2017 12:37:03 +0000
with message-id <1484397423.1091.25.camel@adam-barratt.org.uk>
and subject line Closing requests included in today's point release
has caused the Debian Bug report #848942,
regarding jessie-pu: package most/5.0.0a-2.3
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
848942: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848942
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
Tags: jessie
User: release.debian.org@packages.debian.org
Usertags: pu

There was a recent non-critical CVE issued for most:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848132
https://security-tracker.debian.org/tracker/CVE-2016-1253

The fix (a debdiff is attached) is this on-liner that changes single quotes to
double quotes.

Regards,
Mako


-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.8.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

diff -u most-5.0.0a/debian/changelog most-5.0.0a/debian/changelog
--- most-5.0.0a/debian/changelog
+++ most-5.0.0a/debian/changelog
@@ -1,3 +1,11 @@
+most (5.0.0a-2.3+deb8u1) stable-proposed-updates; urgency=high
+
+  * lzma-support.patch:
+    - Fix CVE-2016-1253: shell injection attack when opening
+      lzma-compressed files (Closes: #848132)
+ 
+ -- Benjamin Mako Hill <mako@debian.org>  Tue, 20 Dec 2016 16:52:16 -0800
+
 most (5.0.0a-2.3) unstable; urgency=low
 
   * Non-maintainer upload.
diff -u most-5.0.0a/src/file.h most-5.0.0a/src/file.h
--- most-5.0.0a/src/file.h
+++ most-5.0.0a/src/file.h
@@ -22,7 +22,7 @@
 #define MOST_MAX_FILES 4096
 #define MOST_GUNZIP_POPEN_FORMAT "gzip -dc \"%s\""
 #define MOST_BZIP2_POPEN_FORMAT "bzip2 -dc \"%s\""
-#define MOST_LZMA_POPEN_FORMAT "lzma -dc '%s'"
+#define MOST_LZMA_POPEN_FORMAT "lzma -dc \"%s\""
 
 extern void most_reread_file (void);
 extern void most_read_to_line (int);

--- End Message ---
--- Begin Message --- 
Version: 8.7

Hi,

Each of these bugs refers to an update that was included in today's 8.7
point release.

Regards,

Adam

--- End Message ---
Reply to: