Bug#342292: tetex-bin: Multiple exploitable heap overflows in embedded xpdf copy
Martin Schulze <joey@infodrom.org> wrote:
> Frank Küster wrote:
>> Hi Joey,
>>
>> Martin Schulze <joey@infodrom.org> wrote:
>>
>> > The original patch was not sufficient. I'm attaching the entire and the
>> > incremental patch. Please apply the incremental patch to the version in
>> > sid as well.
>>
>> Did you see Martin Pitt's "enhanced" patch - do both address the same
>> problems?
>
> The appendix removes the douplette Martin found, so yes.
I looked at both, and it seems that Martin's does more. I'm speaking of
the patch attached to http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342292;msg=136
It introduces limits.h and does the same we did for the xpdf patches at
the beginning of the year, namely change code that can be optimized away
by compilers.
It seems to me that Martin Pitt's patch also has everything that yours
(Joey's) has, but I'm not completely sure; anyway it seems that also the
stable packages should use the code with limits.h.
Am I correct that the other issues that Florian found are not addressed
by any patch yet, and have not yet been widely published? Should I
delay an upload to sid until this can be fixed, too?
>> P.S. Did you see my mail to -release regarding the tetex-base upload to
>> stable/proposed-updates?
>
> No. Could you forward it?
Sent in a separate mail.
Regards, Frank
--
Frank Küster
Inst. f. Biochemie der Univ. Zürich
Debian Developer
Reply to: