[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1006493: marked as done (bullseye-pu: htmldoc/1.9.11-4+deb11u2)

Your message dated Sat, 26 Mar 2022 11:59:13 +0000
with message-id <c4d20274f6d76a43fb574d2177f6e3af4235e4be.camel@adam-barratt.org.uk>
and subject line Closing p-u requests for updates in 11.3
has caused the Debian Bug report #1006493,
regarding bullseye-pu: htmldoc/1.9.11-4+deb11u2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1006493: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006493
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
Tags: bulleye
User: release.debian.org@packages.debian.org
Usertags: pu


The attached debdiff for htmldoc fixes CVE-2022-0534 in Bullseye. This
CVE has been marked as uninportant by the security team, yet it is a bug.

  Thorsten

diff -Nru htmldoc-1.9.11/debian/changelog htmldoc-1.9.11/debian/changelog
--- htmldoc-1.9.11/debian/changelog	2021-11-15 17:13:36.000000000 +0100
+++ htmldoc-1.9.11/debian/changelog	2022-02-25 22:03:02.000000000 +0100
@@ -1,3 +1,12 @@
+htmldoc (1.9.11-4+deb11u2) bullseye; urgency=medium
+
+  * Non-maintainer upload by the LTS Team.
+  * CVE-2022-0534
+    A crafted GIF file could lead to a stack out-of-bounds read,
+    which could result in a crash (segmentation fault).
+
+ -- Thorsten Alteholz <debian@alteholz.de>  Fri, 25 Feb 2022 22:03:02 +0100
+
 htmldoc (1.9.11-4+deb11u1) bullseye; urgency=medium
 
   * Add patch from upstream to fix CVEs:
diff -Nru htmldoc-1.9.11/debian/patches/CVE-2022-0534-1.patch htmldoc-1.9.11/debian/patches/CVE-2022-0534-1.patch
--- htmldoc-1.9.11/debian/patches/CVE-2022-0534-1.patch	1970-01-01 01:00:00.000000000 +0100
+++ htmldoc-1.9.11/debian/patches/CVE-2022-0534-1.patch	2022-02-25 22:03:02.000000000 +0100
@@ -0,0 +1,38 @@
+commit 776cf0fc4c760f1fb7b966ce28dc92dd7d44ed50
+Author: Michael R Sweet <michael.r.sweet@gmail.com>
+Date:   Fri Jan 7 10:21:58 2022 -0500
+
+    Fix potential stack overflow with GIF images (Issue #463)
+
+Index: htmldoc-1.9.11/htmldoc/image.cxx
+===================================================================
+--- htmldoc-1.9.11.orig/htmldoc/image.cxx	2022-02-26 01:11:08.773261658 +0100
++++ htmldoc-1.9.11/htmldoc/image.cxx	2022-02-26 01:11:08.773261658 +0100
+@@ -213,8 +213,7 @@
+ 
+     if (done)
+     {
+-      progress_error(HD_ERROR_READ_ERROR,
+-                     "Not enough data left to read GIF compression code.");
++      progress_error(HD_ERROR_READ_ERROR, "Not enough data left to read GIF compression code.");
+       return (-1);	/* Sorry, no more... */
+     }
+ 
+@@ -238,7 +237,7 @@
+     * Read in another buffer...
+     */
+ 
+-    if ((count = gif_get_block (fp, buf + last_byte)) <= 0)
++    if ((count = gif_get_block(fp, buf + last_byte)) <= 0)
+     {
+      /*
+       * Whoops, no more data!
+@@ -252,7 +251,7 @@
+     * Update buffer state...
+     */
+ 
+-    curbit    = (curbit - lastbit) + 8 * last_byte;
++    curbit    = curbit + 8 * last_byte - lastbit;
+     last_byte += (unsigned)count;
+     lastbit   = last_byte * 8;
+   }
diff -Nru htmldoc-1.9.11/debian/patches/CVE-2022-0534-2.patch htmldoc-1.9.11/debian/patches/CVE-2022-0534-2.patch
--- htmldoc-1.9.11/debian/patches/CVE-2022-0534-2.patch	1970-01-01 01:00:00.000000000 +0100
+++ htmldoc-1.9.11/debian/patches/CVE-2022-0534-2.patch	2022-02-25 22:03:02.000000000 +0100
@@ -0,0 +1,32 @@
+commit 312f0f9c12f26fbe015cd0e6cefa40e4b99017d9
+Author: Michael R Sweet <michael.r.sweet@gmail.com>
+Date:   Fri Jan 7 18:21:53 2022 -0500
+
+    Block GIF images with a code size > 12 (Issue #463)
+
+Index: htmldoc-1.9.11/htmldoc/image.cxx
+===================================================================
+--- htmldoc-1.9.11.orig/htmldoc/image.cxx	2022-02-26 01:11:13.177259451 +0100
++++ htmldoc-1.9.11/htmldoc/image.cxx	2022-02-26 01:11:13.173259454 +0100
+@@ -293,6 +293,12 @@
+   pass      = 0;
+   code_size = (uchar)getc(fp);
+ 
++  if (code_size > 12)
++  {
++    progress_error(HD_ERROR_READ_ERROR, "Bad GIF file \"%s\" - invalid code size %d.", img->filename, code_size);
++    return (-1);
++  }
++
+   if (gif_read_lzw(fp, 1, code_size) < 0)
+     return (-1);
+ 
+@@ -420,7 +426,7 @@
+   if (sp > stack)
+     return (*--sp);
+ 
+-  while ((code = gif_get_code (fp, code_size, 0)) >= 0)
++  while ((code = gif_get_code(fp, code_size, 0)) >= 0)
+   {
+     if (code == clear_code)
+     {
diff -Nru htmldoc-1.9.11/debian/patches/series htmldoc-1.9.11/debian/patches/series
--- htmldoc-1.9.11/debian/patches/series	2021-11-15 17:13:36.000000000 +0100
+++ htmldoc-1.9.11/debian/patches/series	2022-02-25 22:03:02.000000000 +0100
@@ -14,3 +14,7 @@
 CVE-2021-26948.patch
 CVE-2021-40985.patch
 CVE-2021-43579.patch
+
+CVE-2022-0534-1.patch
+CVE-2022-0534-2.patch
+

--- End Message ---
--- Begin Message --- 
Package: release.debian.org
Version: 11.3

Hi,

The updates referenced by these bugs were included in stable as part of
this morning's 11.3 point release.

Regards,

Adam

--- End Message ---
Reply to: