Your message dated Wed, 23 Jul 2008 22:17:03 +0000 with message-id <[EMAIL PROTECTED]> and subject line Bug#430044: fixed in aatv 0.3-4 has caused the Debian Bug report #430044, regarding aatv: Buffer overflow in handling environmental variables. to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [EMAIL PROTECTED] immediately.) -- 430044: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=430044 Debian Bug Tracking System Contact [EMAIL PROTECTED] with problems
--- Begin Message ---Package: aatv Version: 0.3-3 Severity: normal *** Please type your report below this line *** aatv contains code which causes a buffer overflow when reading an overly long $HOME variable. This is exploitable to execute arbitary code, but not usefully since it is neither setuid nor setgid. Demonstration: [EMAIL PROTECTED]:~$ HOME=`perl -e "print 'x'x3000"` aatv Segmentation fault [EMAIL PROTECTED]:~$ Code (aatv.c): sprintf (filename, "%s/%s", getenv ("HOME"), ".aatv"); Fix: snprintf (filename, sizeof(filename)-1, "%s/%s", getenv ("HOME"), ".aatv"); Steve -- -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 2.6.18-xen (SMP w/2 CPU cores) Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages aatv depends on: ii libaa1 1.4p5-32 ascii art library ii libc6 2.5-11 GNU C Library: Shared libraries aatv recommends no packages. -- no debconf information
--- End Message ---
--- Begin Message ---Source: aatv Source-Version: 0.3-4 We believe that the bug you reported is fixed in the latest version of aatv, which is due to be installed in the Debian FTP archive: aatv_0.3-4.diff.gz to pool/main/a/aatv/aatv_0.3-4.diff.gz aatv_0.3-4.dsc to pool/main/a/aatv/aatv_0.3-4.dsc aatv_0.3-4_i386.deb to pool/main/a/aatv/aatv_0.3-4_i386.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [EMAIL PROTECTED], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Uwe Hermann <[EMAIL PROTECTED]> (supplier of updated aatv package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [EMAIL PROTECTED]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Wed, 23 Jul 2008 23:47:41 +0200 Source: aatv Binary: aatv Architecture: source i386 Version: 0.3-4 Distribution: unstable Urgency: medium Maintainer: Uwe Hermann <[EMAIL PROTECTED]> Changed-By: Uwe Hermann <[EMAIL PROTECTED]> Description: aatv - A program to watch TV in a text-based console Closes: 430044 Changes: aatv (0.3-4) unstable; urgency=medium . * Fix buffer overflow in handling environmental variables (Closes: #430044). Thanks Steve Kemp <[EMAIL PROTECTED]> for the fix/patch. * debian/control: + Standards-Version: 3.8.0 (no changes required). + Add Homepage field. * debian/copyright: Convert to machine-readable format. * debian/menu: Move to category "Applications/TV and Radio". * debian/watch: Add file. Checksums-Sha1: 3f29e85dbfbdb8c199cb5dc38fc4a1775e81037f 967 aatv_0.3-4.dsc ab23da571206980a9f1921a57f6f241624dbc114 3409 aatv_0.3-4.diff.gz 7c5be26ec5971f74ffdef50ed35dad07f3fbb30a 15890 aatv_0.3-4_i386.deb Checksums-Sha256: 42e53d59f9546d8d913d284c7dad56f1a1eec078cbef4b63a8d32528ed51b244 967 aatv_0.3-4.dsc 9e5cacec12ef113d131ff9cde1cdd78f3dc7ad9c7c41cd414cbcac59e3707029 3409 aatv_0.3-4.diff.gz 9bfca0e468007e99cd0e6881e3bae5a3aa56a622d09cbfa6a3dab7686a731b2b 15890 aatv_0.3-4_i386.deb Files: 2887b5f2647d62e32efab92111d1ebdb 967 graphics optional aatv_0.3-4.dsc f2f90506c46fe7d9631a026effb92e39 3409 graphics optional aatv_0.3-4.diff.gz bff3e1d85822564388381950535643b4 15890 graphics optional aatv_0.3-4_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkiHqK0ACgkQXdVoV3jWIbSyjwCdGiZTKR+QLMJTO4MebaGlMWat ikwAn2jt9L/cDouAZ/bKqbbozFMFDTwU =RaQJ -----END PGP SIGNATURE-----
--- End Message ---
