Your message dated Mon, 11 Feb 2019 15:20:15 +0000
with message-id <[email protected]>
and subject line Bug#910757: fixed in gnulib 20140202+stable-3.1
has caused the Debian Bug report #910757,
regarding gnulib: CVE-2018-17942 heap-based buffer overflow
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
910757: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=910757
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: gnulib
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for gnulib.
CVE-2018-17942[0]:
| The convert_to_decimal function in vasnprintf.c in Gnulib before
| 2018-09-23 has a heap-based buffer overflow because memory is not
| allocated for a trailing '\0' character during %f processing.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2018-17942
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17942
Patch is available here:
https://github.com/coreutils/gnulib/commit/278b4175c9d7dd47c1a3071554aac02add3b3c35
Please adjust the affected versions in the BTS as needed.
Regards,
Markus
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: gnulib
Source-Version: 20140202+stable-3.1
We believe that the bug you reported is fixed in the latest version of
gnulib, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated gnulib package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 09 Feb 2019 11:11:06 +0100
Source: gnulib
Binary: git-merge-changelog git-merge-changelog-dbgsym gnulib
Architecture: source
Version: 20140202+stable-3.1
Distribution: unstable
Urgency: medium
Maintainer: build-common team <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 910757
Description:
git-merge-changelog - git merge driver for GNU ChangeLog files
gnulib - GNU Portability Library
Changes:
gnulib (20140202+stable-3.1) unstable; urgency=medium
.
* Non-maintainer upload.
* vasnprintf: Fix heap memory overrun bug (CVE-2018-17942) (Closes: #910757)
Checksums-Sha1:
f22c4b862cd091919608257810d079313c62f1d7 2248 gnulib_20140202+stable-3.1.dsc
018993c5a9231fb15a91af10122a797be6ace43a 290736
gnulib_20140202+stable-3.1.debian.tar.xz
Checksums-Sha256:
908100709722fa9a71a549573c89a71948d8f04816d01714e9408a732bde5a06 2248
gnulib_20140202+stable-3.1.dsc
6a5794a899258b507bbc90c30c46ad6ac4272fbae12b5b821185a6032b4e7151 290736
gnulib_20140202+stable-3.1.debian.tar.xz
Files:
8872aa72b62c513c741f76ee027e366a 2248 devel optional
gnulib_20140202+stable-3.1.dsc
c46df6821d9b26275bd1e4306248a9b9 290736 devel optional
gnulib_20140202+stable-3.1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlxe5khfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89ETcQP/1VKoiSbQhAtjYX/VcJj76DNTLFWLTG1
yFytzSZtNnVgOPiMba4T0imhanI0m68V+xLwvpn5WEWfnrPRjZ+D/EoG48IGJxuP
sLIY11gYmDMW9ZvYkjrdBzRXWu/2P9f9jFrlNO02w4Q/q2hAKxCIA+Ck0h4bRBdC
rH2KO0F2ODaP9YiQHe9246U3TCnj2FTeAc4TBwK3XOHRlc7itM/lTycO7OwyMOb4
+cr4Pd6cMEhCWct1DmGu1fsOv5vdRpc/zXBzxK2TdN1KTk7BO9DkFTBT22ITWqYX
JiJ+SNlHPTCVEkR0Reyl8hrlX2hMO6NVmVgDnlztURUubUnalXk2rrQL5ccD9bLi
1q8A+CQsXhzIFVKeHFUiu5Wz0MdkB30gZmwxOZt1gBBskwG7I6RpsWqzFtk1PJt7
yE1eBY2ADPr2d3/6ByWqm4MCxP+g6ZaAGIZYSzoxig6J5NBCmAly3cwf+3lANPYC
RpENKQkUiPQlF1uD8W4uQp01207GMF1LgTlrQ4R4DTu2ElufIh0pKvVrmGi9Tb+A
/yaTazu5Wk7XPTWIJQesTmiDIdRzsK3TuinoWpfbW6THQdA9DSCOAJ7FuXG9I6Q8
F/RIFHk0DCZ4mAN6tyX/rUCWfVYljZmzdhaBVQYMUJnMiaG1qgD2/wbQkzQpWJca
X+zmd7CcWBhI
=jkhB
-----END PGP SIGNATURE-----
--- End Message ---
