Your message dated Tue, 25 Mar 2025 14:25:23 +0200
with message-id <Z+Kgs6smXyeyp1us@localhost>
and subject line Fixed in 2025.01-1
has caused the Debian Bug report #1098254,
regarding u-boot: CVE-2024-57254 CVE-2024-57255 CVE-2024-57256 CVE-2024-57257
CVE-2024-57258 CVE-2024-57259
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1098254: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098254
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: u-boot
Version: 2024.01+dfsg-7
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for u-boot.
CVE-2024-57254[0]:
| Integer overflow in U-Boot's SquashFS symlink size calculation
| function
CVE-2024-57255[1]:
| Integer overflow in U-Boot's SquashFS symlink resolution function
CVE-2024-57256[2]:
| Integer overflow in U-Boot's ext4 symlink resolution function
CVE-2024-57257[3]:
| Stack overflow in U-Boot's SquashFS symlink resolution function
CVE-2024-57258[4]:
| Multiple integer overflows in U-Boot's memory allocator
CVE-2024-57259[5]:
| Heap corruption in U-Boot's SquashFS directory listing function
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-57254
https://www.cve.org/CVERecord?id=CVE-2024-57254
[1] https://security-tracker.debian.org/tracker/CVE-2024-57255
https://www.cve.org/CVERecord?id=CVE-2024-57255
[2] https://security-tracker.debian.org/tracker/CVE-2024-57256
https://www.cve.org/CVERecord?id=CVE-2024-57256
[3] https://security-tracker.debian.org/tracker/CVE-2024-57257
https://www.cve.org/CVERecord?id=CVE-2024-57257
[4] https://security-tracker.debian.org/tracker/CVE-2024-57258
https://www.cve.org/CVERecord?id=CVE-2024-57258
[5] https://security-tracker.debian.org/tracker/CVE-2024-57259
https://www.cve.org/CVERecord?id=CVE-2024-57259
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Version: 2025.01-1
The fixes are included in 2025.01
cu
Adrian
--- End Message ---
