Bug#989623: buster-pu: package scrollz/2.2.3-1+deb10u1
Package: release.debian.org
Severity: normal
Tags: buster
User: release.debian.org@packages.debian.org
Usertags: pu
Version 2.2.3-2 of this package fixed a grave bug (#986215, a remote crash) in
this package for unstable with the smallest set of changes possible, by
applying an upstream PR targeting the specific issue. The fix was tested in
that version, and is now also in bullseye.
Version 2.2.3-1+deb10u1 is a rebuild of the same package targeted for buster.
I spoke with the security team and they did not feel a DSA was warranted, but
as it is a fairly serious issue with the client, I'm hoping this fix can be
included in a point release of buster.
--
Mike Markley <mike@markley.org>
diff -Nru scrollz-2.2.3/debian/changelog scrollz-2.2.3/debian/changelog
--- scrollz-2.2.3/debian/changelog 2014-11-05 17:37:01.000000000 -0700
+++ scrollz-2.2.3/debian/changelog 2021-06-06 10:16:54.000000000 -0600
@@ -1,3 +1,12 @@
+scrollz (2.2.3-1+deb10u1) buster; urgency=high
+
+ * Applied patch to ctcp.c to fix CVE-2021-29376 from
+ https://github.com/ScrollZ/ScrollZ/pull/26 (Closes: #986215)
+ * Applied minor patch from upstream to the above fix
+ * Rebuild for buster
+
+ -- Mike Markley <mike@markley.org> Sun, 06 Jun 2021 10:16:54 -0600
+
scrollz (2.2.3-1) unstable; urgency=low
* New release.
diff -Nru scrollz-2.2.3/debian/patches/CVE-2021-29376.patch scrollz-2.2.3/debian/patches/CVE-2021-29376.patch
--- scrollz-2.2.3/debian/patches/CVE-2021-29376.patch 1969-12-31 17:00:00.000000000 -0700
+++ scrollz-2.2.3/debian/patches/CVE-2021-29376.patch 2021-06-06 10:12:06.000000000 -0600
@@ -0,0 +1,46 @@
+diff --git a/source/ctcp.c b/source/ctcp.c
+index b977f9b..32a496a 100644
+--- a/source/ctcp.c
++++ b/source/ctcp.c
+@@ -31,7 +31,7 @@
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+- * $Id: ctcp.c,v 1.56 2009-12-21 14:39:21 f Exp $
++ * $Id: ctcp.c,v 1.56 2021-04-26 19:57:28 t Exp $
+ */
+
+ #include "irc.h"
+@@ -1629,14 +1629,29 @@ do_utc(ctcp, from, to, args)
+ *to,
+ *args;
+ {
+- time_t tm;
++ time_t tm = time(NULL),
++ curtime = time(NULL);
+ char *date = NULL;
+
+ if (!args || !*args)
+ return NULL;
+ tm = atol(args);
+- malloc_strcpy(&date, ctime(&tm));
+- date[strlen(date)-1] = '\0';
++ curtime = ctime(&tm);
++
++ if (curtime)
++ {
++ u_char *s = index(curtime, '\n');
++ if (s)
++ {
++ *s = '\0';
++ }
++ malloc_strcpy(&date, UP(curtime));
++ }
++ else
++ {
++ /* if we can't find a time, just return the number */
++ malloc_strcpy(&date, args);
++ }
+ return date;
+ }
+
diff -Nru scrollz-2.2.3/debian/patches/CVE-2021-29376-update.patch scrollz-2.2.3/debian/patches/CVE-2021-29376-update.patch
--- scrollz-2.2.3/debian/patches/CVE-2021-29376-update.patch 1969-12-31 17:00:00.000000000 -0700
+++ scrollz-2.2.3/debian/patches/CVE-2021-29376-update.patch 2021-06-06 10:12:06.000000000 -0600
@@ -0,0 +1,13 @@
+diff --git a/source/ctcp.c b/source/ctcp.c
+index 32a496a..2b661bd 100644
+--- a/source/ctcp.c
++++ b/source/ctcp.c
+@@ -1630,7 +1630,7 @@ do_utc(ctcp, from, to, args)
+ *args;
+ {
+ time_t tm = time(NULL),
+- curtime = time(NULL);
++ curtime;
+ char *date = NULL;
+
+ if (!args || !*args)
diff -Nru scrollz-2.2.3/debian/patches/series scrollz-2.2.3/debian/patches/series
--- scrollz-2.2.3/debian/patches/series 2014-10-22 16:08:28.000000000 -0600
+++ scrollz-2.2.3/debian/patches/series 2021-06-06 10:12:06.000000000 -0600
@@ -4,3 +4,5 @@
spelling-errors.patch
rijndael-prototypes.patch
sys-stat-h.patch
+CVE-2021-29376.patch
+CVE-2021-29376-update.patch
Reply to: