Your message dated Mon, 29 Jun 2015 13:49:48 +0000 with message-id <[email protected]> and subject line Bug#784192: fixed in libwmf 0.2.8.4-6.2+deb6u2 has caused the Debian Bug report #784192, regarding CVE-2015-4696: wmf2gd/wmf2eps use after free to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 784192: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784192 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: libwmf-bin When recompiling libwmf-bin and enabling ASAN, trying to use it with one of the examples provided in the package (cell.wmf) a heap-use-after-free is reported. The same cell.wmf can be used in wmf2svg without any warning. $ /home/fmunozs/ramdisk/wmf2gd --wmf-fontdir=/usr/share/fonts/type1/gsfonts examples/cell.wmf ================================================================= ==10173==ERROR: AddressSanitizer: heap-use-after-free on address 0xb5208670 at pc 0x805d0bc bp 0xbfc07688 sp 0xbfc07678 READ of size 4 at 0xb5208670 thread T0 #0 0x805d0bb in gd_translate_ft64 ../../src/ipa/xgd/device.h:241 #1 0x805d0bb in gd_translate ../../src/ipa/xgd/device.h:230 #2 0x805d0bb in wmf_gd_region_clip ../../src/ipa/xgd/region.h:112 #3 0x818ebb0 in meta_dc_restore player/meta.h:2598 #4 0x818ebb0 in WmfPlayMetaFile /home/fmunozs/wmf/libwmf-0.2.8.4/src/player.c:1161 #5 0x81b4bdd in wmf_play /home/fmunozs/wmf/libwmf-0.2.8.4/src/player.c:323 #6 0x805097a in wmf2gd_draw /home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2gd.c:191 #7 0x805097a in wmf2gd_file /home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2gd.c:410 #8 0x804abf8 in main /home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2gd.c:429 #9 0xb6f4472d in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x1872d) #10 0x804b2ee (/home/fmunozs/ramdisk/wmf2gd+0x804b2ee) 0xb5208670 is located 0 bytes inside of 8-byte region [0xb5208670,0xb5208678) freed by thread T0 here: #0 0xb731ef06 in __interceptor_free (/usr/lib/i386-linux-gnu/libasan.so.1+0x50f06) #1 0x80ea7db in wmf_free /home/fmunozs/wmf/libwmf-0.2.8.4/src/api.c:582 previously allocated by thread T0 here: #0 0xb731f18c in __interceptor_malloc (/usr/lib/i386-linux-gnu/libasan.so.1+0x5118c) #1 0x80e43e8 in wmf_malloc /home/fmunozs/wmf/libwmf-0.2.8.4/src/api.c:482 SUMMARY: AddressSanitizer: heap-use-after-free ../../src/ipa/xgd/device.h:241 gd_translate_ft64 Shadow bytes around the buggy address: 0x36a41070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a41080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a41090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a410a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a410b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x36a410c0: fa fa fa fa fa fa fa fa fa fa fd fa fa fa[fd]fa 0x36a410d0: fa fa 00 04 fa fa fd fa fa fa fd fa fa fa 00 fa 0x36a410e0: fa fa 06 fa fa fa 00 fa fa fa 00 fa fa fa fd fd 0x36a410f0: fa fa 00 04 fa fa 00 04 fa fa 00 fa fa fa fd fa 0x36a41100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a41110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==10173==ABORTING $ /home/fmunozs/ramdisk/wmf2eps --wmf-fontdir=/usr/share/fonts/type1/gsfonts examples/cell.wmf %!PS-Adobe-2.0 EPSF-2.0 %%BoundingBox: 0 0 1025 1025 save gsave 0 1025 translate 1 -1 scale 0.066498 0.066498 translate 1.000847 1.000847 scale gsave % begin clip grestore % end clip gsave % begin clip [ 0.000000 -0.000000 1024.000000 1024.000000 ] rectclip gsave % wmf_[eps_]draw_rectangle newpath 0.000000 -0.000000 moveto 0.000000 1024.000000 lineto 1024.000000 1024.000000 lineto 1024.000000 -0.000000 lineto closepath 1.000000 1.000000 1.000000 setrgbcolor fill grestore grestore % end clip gsave % begin clip [ ================================================================= ==32161==ERROR: AddressSanitizer: heap-use-after-free on address 0xb5108654 at pc 0x80588a1 bp 0xbff325e8 sp 0xbff325d8 READ of size 4 at 0xb5108654 thread T0 #0 0x80588a0 in wmf_eps_region_clip ../../src/ipa/eps/region.h:136 #1 0x818c810 in meta_dc_restore player/meta.h:2598 #2 0x818c810 in WmfPlayMetaFile /home/fmunozs/wmf/libwmf-0.2.8.4/src/player.c:1161 #3 0x81b283d in wmf_play /home/fmunozs/wmf/libwmf-0.2.8.4/src/player.c:323 #4 0x8050023 in wmf2eps_draw /home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2eps.c:216 #5 0x8050023 in wmf2eps_file /home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2eps.c:456 #6 0x804ac70 in main /home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2eps.c:475 #7 0xb6e6e72d in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x1872d) #8 0x804b33e (/home/fmunozs/ramdisk/wmf2eps+0x804b33e) 0xb5108654 is located 4 bytes inside of 8-byte region [0xb5108650,0xb5108658) freed by thread T0 here: #0 0xb7248f06 in __interceptor_free (/usr/lib/i386-linux-gnu/libasan.so.1+0x50f06) #1 0x80e843b in wmf_free /home/fmunozs/wmf/libwmf-0.2.8.4/src/api.c:582 previously allocated by thread T0 here: #0 0xb724918c in __interceptor_malloc (/usr/lib/i386-linux-gnu/libasan.so.1+0x5118c) #1 0x80e2048 in wmf_malloc /home/fmunozs/wmf/libwmf-0.2.8.4/src/api.c:482 SUMMARY: AddressSanitizer: heap-use-after-free ../../src/ipa/eps/region.h:136 wmf_eps_region_clip Shadow bytes around the buggy address: 0x36a21070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a21080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a21090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a210a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a210b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x36a210c0: fa fa fa fa fa fa fa fa fa fa[fd]fa fa fa fd fa 0x36a210d0: fa fa fd fa fa fa fd fa fa fa 00 fa fa fa 06 fa 0x36a210e0: fa fa 00 04 fa fa 00 fa fa fa 00 fa fa fa fd fd 0x36a210f0: fa fa 00 04 fa fa 00 04 fa fa 00 fa fa fa fd fa 0x36a21100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x36a21110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==32161==ABORTING
--- End Message ---
--- Begin Message ---Source: libwmf Source-Version: 0.2.8.4-6.2+deb6u2 We believe that the bug you reported is fixed in the latest version of libwmf, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Raphaël Hertzog <[email protected]> (supplier of updated libwmf package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Mon, 29 Jun 2015 12:15:30 +0200 Source: libwmf Binary: libwmf0.2-7 libwmf-bin libwmf-dev libwmf-doc Architecture: source amd64 all Version: 0.2.8.4-6.2+deb6u2 Distribution: squeeze-lts Urgency: medium Maintainer: Loic Minier <[email protected]> Changed-By: Raphaël Hertzog <[email protected]> Description: libwmf-bin - Windows metafile conversion tools libwmf-dev - Windows metafile conversion development libwmf-doc - Windows metafile documentation libwmf0.2-7 - Windows metafile conversion library Closes: 784192 784205 Changes: libwmf (0.2.8.4-6.2+deb6u2) squeeze-lts; urgency=medium . * Non-maintainer upload by the Debian LTS team. * Add patch to fix CVE-2015-4695: meta_pen_create heap buffer overflow Thanks to Fernando Muñoz <[email protected]>. Closes: #784205 * Add patch to fix CVE-2015-4696: wmf2gd/wmf2eps use after free Thanks to Caolán McNamara <[email protected]> for the patch. Closes: #784192 Checksums-Sha1: 8b8bff160cb32867d24cf037587ecd60a2a59e52 1516 libwmf_0.2.8.4-6.2+deb6u2.dsc 11c55d958a9890b299ccb0bbc55cd8f537834c63 9909 libwmf_0.2.8.4-6.2+deb6u2.diff.gz f2b4e1d8d6beef14e67f6cd9f927bf0c31c71ad1 188752 libwmf0.2-7_0.2.8.4-6.2+deb6u2_amd64.deb 8e513bc1d5bfecf263ca826885f51934dada5c1f 19604 libwmf-bin_0.2.8.4-6.2+deb6u2_amd64.deb 1eeaf25aa6a4b23c07bac402da4b4318977b4bac 211974 libwmf-dev_0.2.8.4-6.2+deb6u2_amd64.deb 532600c51925ba2c850baaa4cdee45b13ba31aac 286210 libwmf-doc_0.2.8.4-6.2+deb6u2_all.deb Checksums-Sha256: 84788e094b6e5e1c7b8cd705cc6c16471d1e337d1d430f725e4906576c0154de 1516 libwmf_0.2.8.4-6.2+deb6u2.dsc 432982338bb314086eee82157a2d226e804422d27a93a51d3cee6e2dd6b7abf4 9909 libwmf_0.2.8.4-6.2+deb6u2.diff.gz dc660d05e47dd0c7ffcccd6c794fdb5c9624bf264e35483d0c652050615889c0 188752 libwmf0.2-7_0.2.8.4-6.2+deb6u2_amd64.deb 5fa9cce0e9ff7525f9d6e781a1a9bd10017de938af9f43dd0139e3a0163583fa 19604 libwmf-bin_0.2.8.4-6.2+deb6u2_amd64.deb 6a5b94e6bb5ec1cb1b0a41003ef028176c2ae69ac38803d7a61f76bbe4b79590 211974 libwmf-dev_0.2.8.4-6.2+deb6u2_amd64.deb 80785c2a6f7f1c743cab335347d927e3d390eeb9977cded5a141c4154a34a806 286210 libwmf-doc_0.2.8.4-6.2+deb6u2_all.deb Files: 830bae1016c9c74af8f96ba9e72d65a7 1516 libs optional libwmf_0.2.8.4-6.2+deb6u2.dsc 76e3701a4a21c08beea757608fd65fdd 9909 libs optional libwmf_0.2.8.4-6.2+deb6u2.diff.gz 4fdc0874c16c9c54983faab6d60ce078 188752 libs optional libwmf0.2-7_0.2.8.4-6.2+deb6u2_amd64.deb 5c84ee536a4bb62acda41da7385d536e 19604 graphics optional libwmf-bin_0.2.8.4-6.2+deb6u2_amd64.deb 5b26701234967d486f4c23eb6194f7dd 211974 libdevel optional libwmf-dev_0.2.8.4-6.2+deb6u2_amd64.deb 8639daeb0d1dfea56a69a94e2cbe95e4 286210 doc optional libwmf-doc_0.2.8.4-6.2+deb6u2_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Signed by Raphael Hertzog iQEcBAEBCAAGBQJVkUrPAAoJEAOIHavrwpq5Vn4IAIXCAb8Yyf7Cxfk+cIssm+2Y NwE/hWO07xZRUfbockvB9Rs0Cv3DHy8n4pAS9fLF4uVdKr6q+KzBnr/1Rl46sfRA gBU1WdKp0LhuKX80FAAl1LZk2FuMAC0jO5Tf7elG7ZWK4LVoXQP3odn8STgitsDW Do1uRmKUqq6p4kCEk6cJE/CUX2H2dBIejV22ALlLNoJEeZJL1fR1ExdkNDkmtXHa Z9DHIAfoABxlW1ZRwP+3NZg83HY+fdQcviGDgK1PM1Uai3pvbhhe1SIdHgdRVQhT zPLXzwOZNsbVh1S5FKuYxd7uV2HR8R+oRKJjm+Zjmd4vK6OyfVeg6AMgeYBhDVk= =647W -----END PGP SIGNATURE-----
--- End Message ---
