Bug#931878: libonig: CVE-2019-13224 CVE-2019-13225

2019-07-12 Thread Salvatore Bonaccorso
Hi Jörg! On Fri, Jul 12, 2019 at 11:36:13AM +0200, Jörg Frings-Fürst wrote: > tags 931878 +pending > thanks > > Hello Salvatore, > > I have the libonig release 6.9.2 with both upstream fixes for the CVEs > ready for upload. > > It is uploaded to mentors[1] and into the git[2]. > > Should the

Bug#931878: libonig: CVE-2019-13224 CVE-2019-13225

2019-07-12 Thread Jörg Frings-Fürst
tags 931878 +pending thanks Hello Salvatore, I have the libonig release 6.9.2 with both upstream fixes for the CVEs ready for upload. It is uploaded to mentors[1] and into the git[2]. Should the upload of the package be handled by the security team? Or can I take care of it myself? My

Bug#931878: libonig: CVE-2019-13224 CVE-2019-13225

2019-07-11 Thread Salvatore Bonaccorso
Source: libonig Version: 6.9.1-1 Severity: important Tags: security upstream Hi, The following vulnerabilities were published for libonig. CVE-2019-13224[0]: | A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 | allows attackers to potentially cause information disclosure,