Your message dated Sat, 13 Sep 2008 12:47:39 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#497666: fixed in openjdk-6 6b11-7
has caused the Debian Bug report #497666,
regarding openjdk-6-jre: segfault (+arbitrary code execution?) with invalid
locale name
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
497666: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=497666
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: openjdk-6-jre
Version: 6b11-6
Severity: minor
Tags: security
Steps to produce:
1) LC_CTYPE="fi_FI.iso8859-1`perl -e 'print " "x80'`" freecol
Expected results:
1) openjdk runs freecol (a Java application) or complains about wrong locale
name
Actual results:
1) openjdk segfaults:
#
# An unexpected error has been detected by Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0xb755e818, pid=2687, tid=3076606864
#
# Java VM: OpenJDK Client VM (1.6.0_0-b11 mixed mode, sharing linux-x86)
# Problematic frame:
# C [libjava.so+0xf818] Java_java_lang_System_initProperties+0x28
#
# An error report file with more information is saved as:
# /home/lindi/hs_err_pid2687.log
#
# If you would like to submit a bug report, please visit:
# http://icedtea.classpath.org/bugzilla
#
Aborted (core dumped)
More info:
1) java_props_wd.c does strcpy without checking buffer bounds
lc = setlocale(LC_CTYPE, "");
....
char temp[64];
....
strcpy(temp, lc);
so maybe this could also be (ab)used to corrupt stack to execute
arbitrary code? I hope there is no way for a Java applet to set
LC_CTYPE.
--- End Message ---
--- Begin Message ---
Source: openjdk-6
Source-Version: 6b11-7
We believe that the bug you reported is fixed in the latest version of
openjdk-6, which is due to be installed in the Debian FTP archive:
openjdk-6-dbg_6b11-7_i386.deb
to pool/main/o/openjdk-6/openjdk-6-dbg_6b11-7_i386.deb
openjdk-6-demo_6b11-7_i386.deb
to pool/main/o/openjdk-6/openjdk-6-demo_6b11-7_i386.deb
openjdk-6-doc_6b11-7_all.deb
to pool/main/o/openjdk-6/openjdk-6-doc_6b11-7_all.deb
openjdk-6-jdk_6b11-7_i386.deb
to pool/main/o/openjdk-6/openjdk-6-jdk_6b11-7_i386.deb
openjdk-6-jre-headless_6b11-7_i386.deb
to pool/main/o/openjdk-6/openjdk-6-jre-headless_6b11-7_i386.deb
openjdk-6-jre-lib_6b11-7_all.deb
to pool/main/o/openjdk-6/openjdk-6-jre-lib_6b11-7_all.deb
openjdk-6-jre_6b11-7_i386.deb
to pool/main/o/openjdk-6/openjdk-6-jre_6b11-7_i386.deb
openjdk-6-source_6b11-7_all.deb
to pool/main/o/openjdk-6/openjdk-6-source_6b11-7_all.deb
openjdk-6_6b11-7.diff.gz
to pool/main/o/openjdk-6/openjdk-6_6b11-7.diff.gz
openjdk-6_6b11-7.dsc
to pool/main/o/openjdk-6/openjdk-6_6b11-7.dsc
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Matthias Klose <[EMAIL PROTECTED]> (supplier of updated openjdk-6 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sat, 13 Sep 2008 10:00:22 +0200
Source: openjdk-6
Binary: openjdk-6-jdk openjdk-6-jre-headless openjdk-6-jre openjdk-6-jre-lib
openjdk-6-demo openjdk-6-source openjdk-6-doc openjdk-6-dbg
Architecture: source i386 all
Version: 6b11-7
Distribution: unstable
Urgency: low
Maintainer: OpenJDK Team <[EMAIL PROTECTED]>
Changed-By: Matthias Klose <[EMAIL PROTECTED]>
Description:
openjdk-6-dbg - Java runtime based on OpenJDK (debugging symbols)
openjdk-6-demo - Java runtime based on OpenJDK (demos and examples)
openjdk-6-doc - OpenJDK Development Kit (JDK) documentation
openjdk-6-jdk - OpenJDK Development Kit (JDK)
openjdk-6-jre - OpenJDK Java runtime, using ${vm:Name}
openjdk-6-jre-headless - OpenJDK Java runtime, using ${vm:Name} (headless)
openjdk-6-jre-lib - OpenJDK Java runtime (architecture independent libraries)
openjdk-6-source - OpenJDK Development Kit (JDK) source files
Closes: 497666
Changes:
openjdk-6 (6b11-7) unstable; urgency=low
.
* Apply fixes taken from the IcedTea trunk:
- Add atomic operations for the m68k zero port (maybe the build
finishes before lenny is released ...).
- Fix segfaults with arbitrary long locale variables. Closes: #497666.
- Remove checks for maximum allowable cryptographic strength.
Checksums-Sha1:
0b86584f2a12fb4c2ece88f0cb87c0fda2eae299 2135 openjdk-6_6b11-7.dsc
88e83e6c8cd182fe70b5a994659d3e4d58c22fc0 169114 openjdk-6_6b11-7.diff.gz
ebd3147e630427d64b3ce1b3cf0454b595be08b7 9651708 openjdk-6-jdk_6b11-7_i386.deb
0e5f0bf3f47a63a02a50cd1eb9f53ab7073dd72b 23549592
openjdk-6-jre-headless_6b11-7_i386.deb
fb639a3c9d83019d1d6325c97c1a6792c3607086 217562 openjdk-6-jre_6b11-7_i386.deb
d5bc7b2fff6c96f4a40382147c2917f790bc1b30 2337190 openjdk-6-demo_6b11-7_i386.deb
86bfa22eb25f962dec18f0e2112dd520847cd53c 101047936
openjdk-6-dbg_6b11-7_i386.deb
2f09505b704e79991c42683444e97337aa5a70e4 5244690
openjdk-6-jre-lib_6b11-7_all.deb
1c36a121ce29b0b24f6550b0f77fbdcda1fd760e 26538086
openjdk-6-source_6b11-7_all.deb
e59c6e9b6530172abc9f437253bd4c85c00cfc95 12042562 openjdk-6-doc_6b11-7_all.deb
Checksums-Sha256:
203213755b9031638e273e1ab2c3de6d93cfd34104f22e7b475698080ce1019b 2135
openjdk-6_6b11-7.dsc
f363dc50e948773ae4217d53302cb83c47838159b20f07a4def307ddd2ad551e 169114
openjdk-6_6b11-7.diff.gz
26ce91c8489007382b6d15f654e8da0c6b16a6d7bde23319067836531ab5f82f 9651708
openjdk-6-jdk_6b11-7_i386.deb
51d5443659391fd34605b4e570ade456bb44d1b6b14b65a5c56772737334ad30 23549592
openjdk-6-jre-headless_6b11-7_i386.deb
db8cdb345063c5542c0d64a8f3476aee8c67f51de5e73ae8e57b9c5435c5720b 217562
openjdk-6-jre_6b11-7_i386.deb
6af5fc7f520c22e0c44ccf1e9996823983171e6e06522886dbe653fa6af68de0 2337190
openjdk-6-demo_6b11-7_i386.deb
55a68349a467bbfadb0b7dceca3eda508c5cb8fe41f5e88f4b4e3582d76a7a53 101047936
openjdk-6-dbg_6b11-7_i386.deb
72ca87f9ebf7072e965f85be00243b5218379442dd704753b2adfec7608b8cea 5244690
openjdk-6-jre-lib_6b11-7_all.deb
2ea69955a14d428f30dc8476428201ef99fdf94ab328d712a8aaf592cab8daca 26538086
openjdk-6-source_6b11-7_all.deb
59c3fe067cd17445cec0f9cf70c38f836f8f9f1540208c4b116fc1ae129cdbcd 12042562
openjdk-6-doc_6b11-7_all.deb
Files:
7790e53031f1b8e9f77b669e8d53d785 2135 devel extra openjdk-6_6b11-7.dsc
093cc91ec3632fcf37b6048892126350 169114 devel extra openjdk-6_6b11-7.diff.gz
affbe9ea720a9a235a92d94fc25fc766 9651708 devel extra
openjdk-6-jdk_6b11-7_i386.deb
53df3198810256fe6918ae116ff820e1 23549592 interpreters extra
openjdk-6-jre-headless_6b11-7_i386.deb
35c26e420d578339e3f626bdd5dcbcf4 217562 interpreters extra
openjdk-6-jre_6b11-7_i386.deb
e11a2e045f6b7bd4080836796b3b5249 2337190 devel extra
openjdk-6-demo_6b11-7_i386.deb
b68ad6a78eeff7f27625bd93383183b4 101047936 devel extra
openjdk-6-dbg_6b11-7_i386.deb
400fd597182f22857e6c7293575397d2 5244690 interpreters extra
openjdk-6-jre-lib_6b11-7_all.deb
ce25096b90afcfaec5f915e5c6386c0e 26538086 devel extra
openjdk-6-source_6b11-7_all.deb
8cfcc0478e8b1b98c1f253d179206d83 12042562 doc extra
openjdk-6-doc_6b11-7_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFIy7JSStlRaw+TLJwRApMRAKC1dEdo1KETsd+NLus+JVqDwICuOQCfTCJZ
6gFLr9Nq3WgTX48oKICmeOw=
=Gx5W
-----END PGP SIGNATURE-----
--- End Message ---
