Package: grip Version: 3.3.1-6 Severity: normal Tags: patch In MakeAboutPage in src/grip.c, if the translated string of "Version %s" is more than 20 bytes, sprintf causes buffer overflow and grip may crash.
For detail, please see the atached patch.
grip.c.patch
Description: Binary data
-- System Information: Debian Release: testing/unstable APT prefers unstable APT policy: (500, 'unstable') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/dash Kernel: Linux 2.6.17-1-k7 Locale: LANG=ja_JP.UTF-8, LC_CTYPE=ja_JP.UTF-8 (charmap=UTF-8) Versions of packages grip depends on: ii libart-2.0-2 2.3.17-1 Library of functions for 2D graphi ii libatk1.0-0 1.12.1-1 The ATK accessibility toolkit ii libaudiofile0 0.2.6-6 Open-source version of SGI's audio ii libavahi-client3 0.6.12-1 Avahi client library ii libavahi-common3 0.6.12-1 Avahi common library ii libavahi-glib1 0.6.12-1 Avahi glib integration library ii libbonobo2-0 2.14.0-1 Bonobo CORBA interfaces library ii libbonoboui2-0 2.14.0-4 The Bonobo UI library ii libc6 2.3.6-18 GNU C Library: Shared libraries ii libcairo2 1.2.2-1 The Cairo 2D vector graphics libra ii libcdparanoia0 3a9.8-14 Shared libraries for cdparanoia ii libcomerr2 1.39-1 common error description library ii libcurl3-gnutls 7.15.5-1 Multi-protocol file transfer libra ii libdbus-1-2 0.62-4 simple interprocess messaging syst ii libesd0 0.2.36-3 Enlightened Sound Daemon - Shared ii libfontconfig1 2.3.2-7 generic font configuration library ii libfreetype6 2.2.1-2 FreeType 2 font engine, shared lib ii libgcc1 1:4.1.1-10 GCC support library ii libgconf2-4 2.14.0-4 GNOME configuration database syste ii libgcrypt11 1.2.2-3 LGPL Crypto library - runtime libr ii libglib2.0-0 2.10.3-3 The GLib library of C routines ii libgnome-keyring0 0.4.9-1 GNOME keyring services library ii libgnome2-0 2.14.1-3 The GNOME 2 library - runtime file ii libgnomecanvas2-0 2.14.0-2 A powerful object-oriented display ii libgnomeui-0 2.14.1-2 The GNOME 2 libraries (User Interf ii libgnomevfs2-0 2.14.2-1 GNOME virtual file-system (runtime ii libgnutls13 1.4.1-1 the GNU TLS library - runtime libr ii libgpg-error0 1.2-1 library for common error values an ii libgtk2.0-0 2.8.18-7 The GTK+ graphical user interface ii libice6 1:1.0.0-3 X11 Inter-Client Exchange library ii libid3-3.8.3c2a 3.8.3-5 Library for manipulating ID3v1 and ii libidn11 0.6.5-1 GNU libidn library, implementation ii libjpeg62 6b-13 The Independent JPEG Group's JPEG ii libkrb53 1.4.3-9 MIT Kerberos runtime libraries ii libncurses5 5.5-2 Shared libraries for terminal hand ii liborbit2 1:2.14.0-2 libraries for ORBit2 - a CORBA ORB ii libpango1.0-0 1.12.3-1+b1 Layout and rendering of internatio ii libpng12-0 1.2.8rel-5.2 PNG library - runtime ii libpopt0 1.10-3 lib for parsing cmdline parameters ii libsm6 1:1.0.0-4 X11 Session Management library ii libstdc++6 4.1.1-10 The GNU Standard C++ Library v3 ii libtasn1-3 0.3.5-2 Manage ASN.1 structures (runtime) ii libvte4 1:0.12.2-2 Terminal emulator widget for GTK+ ii libx11-6 2:1.0.0-8 X11 client-side library ii libxcursor1 1.1.5.2-5 X cursor management library ii libxext6 1:1.0.0-4 X11 miscellaneous extension librar ii libxfixes3 1:3.0.1.2-4 X11 miscellaneous 'fixes' extensio ii libxft2 2.1.8.2-8 FreeType-based font drawing librar ii libxi6 1:1.0.0-5 X11 Input extension library ii libxinerama1 1:1.0.1-4 X11 Xinerama extension library ii libxml2 2.6.26.dfsg-3 GNOME XML library ii libxrandr2 2:1.1.0.2-4 X11 RandR extension library ii libxrender1 1:0.9.0.2-4 X Rendering Extension client libra ii zlib1g 1:1.2.3-13 compression library - runtime Versions of packages grip recommends: ii vorbis-tools 1.1.1-6 several Ogg Vorbis tools -- no debconf information regards, -- Hidetaka IWAI [EMAIL PROTECTED]
