Your message dated Sun, 17 Oct 2010 12:47:13 +0000
with message-id <[email protected]>
and subject line Bug#598289: fixed in gnome-subtitles 1.0-2
has caused the Debian Bug report #598289,
regarding gnome-subtitles: CVE-2010-3357: insecure library loading
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
598289: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598289
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: gnome-subtitles
Version: 1.0-1
Severity: grave
Tags: security
User: [email protected]
Usertags: ldpath
Hello,
During a review of the Debian archive, I've found your package to
contain a script that can be abused by an attacker to execute arbitrary
code.
The vulnerability is introduced by an insecure change to
LD_LIBRARY_PATH, and environment variable used by ld.so(8) to look for
libraries on a directory other than the standard paths.
Vulnerable code follows:
/usr/bin/gnome-subtitles line 9:
export LD_LIBRARY_PATH="$libdir/gnome-subtitles:$LD_LIBRARY_PATH"
When there's an empty item on the colon-separated list of
LD_LIBRARY_PATH, ld.so treats it as '.' (i.e. CWD/$PWD.)
If the given script is executed from a directory where a potential,
local, attacker can write files to, there's a chance to exploit this
bug.
This vulnerability has been assigned the CVE id CVE-2010-3357. Please make sure
you mention it when forwarding this report to upstream and when fixing
this bug (everywhere: upstream and here at Debian.)
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3357
[1] http://security-tracker.debian.org/tracker/CVE-2010-3357
Sincerely,
Raphael Geissert
--- End Message ---
--- Begin Message ---
Source: gnome-subtitles
Source-Version: 1.0-2
We believe that the bug you reported is fixed in the latest version of
gnome-subtitles, which is due to be installed in the Debian FTP archive:
gnome-subtitles_1.0-2.diff.gz
to main/g/gnome-subtitles/gnome-subtitles_1.0-2.diff.gz
gnome-subtitles_1.0-2.dsc
to main/g/gnome-subtitles/gnome-subtitles_1.0-2.dsc
gnome-subtitles_1.0-2_amd64.deb
to main/g/gnome-subtitles/gnome-subtitles_1.0-2_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Iain Lane <[email protected]> (supplier of updated gnome-subtitles package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 13 Oct 2010 21:26:29 +0100
Source: gnome-subtitles
Binary: gnome-subtitles
Architecture: source amd64
Version: 1.0-2
Distribution: unstable
Urgency: low
Maintainer: Debian CLI Applications Team
<[email protected]>
Changed-By: Iain Lane <[email protected]>
Description:
gnome-subtitles - Subtitles editor for the GNOME Desktop environment
Closes: 586986 598289
Changes:
gnome-subtitles (1.0-2) unstable; urgency=low
.
* debian/control:
+ Add depends on gstreamer0.10-plugins-base; app fails to start when this
is not present (Closes: #586986)
+ Add recommends on gstreamer0.10-ffmpeg — cannot import or preview videos
without any codecs present
+ Add quilt patchsys
* debian/patches/insecure_library_loading:
+ Add patch taken from upstream git to fix insecure library loading bug.
(Closes: #598289)
References: CVE-2010-3357
Thanks to dai for forwarding the patch, and for Pedro Castro for
developing it.
Checksums-Sha1:
ba4c476634bdbc8e66864a4387331d16ee36936e 2017 gnome-subtitles_1.0-2.dsc
db6ecdcffc1fa7acdba32dc1ef3a605d110dbf0c 12943 gnome-subtitles_1.0-2.diff.gz
b37c18d2f92e7033d03904e537e0d5f47983eeab 347930 gnome-subtitles_1.0-2_amd64.deb
Checksums-Sha256:
caf629e811a053e7d79d452cd224fb16d790cbe0eacd8ced17210f6cbc57f339 2017
gnome-subtitles_1.0-2.dsc
4151ff0fc7b467af17b5790777d48280a5c939cfabc3b0facacb185ffeaba3d9 12943
gnome-subtitles_1.0-2.diff.gz
b538e56df00e3627392e838ec021e9c6be19cb712f19c9b673c165225b214d9d 347930
gnome-subtitles_1.0-2_amd64.deb
Files:
1eeaa18a21537388fd219a0b238dd3fe 2017 gnome extra gnome-subtitles_1.0-2.dsc
9acfa6fa181196273091772ed85985e5 12943 gnome extra
gnome-subtitles_1.0-2.diff.gz
d39eebd30a47a87c93b4d6e8a61363ce 347930 gnome extra
gnome-subtitles_1.0-2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBCAAGBQJMuu5ZAAoJEMkPnLkOH60MbkUH/0zRxebC5uqAL1q4AgJulXFy
M/7dFixbODM7x41ZIMuXgr9zmIPRhfG1+0SceWbVqEgu7sb3ePxdjunbxJ9cMVy9
xAp+XOG3DgnphvPX03/8chrSvDh0D7nRs1FqBQsMlnfB1IqLsP3e5s1hEpxn0Fmx
5xicpKaihet1HNJBeSmY/MF74p527Bmk0sFG2Lmij3cdUCct355FTz261oLXDAGA
LVJ0moG9eoXJt983wEdDRLJ9fpWDW+glk0oC2c82MHAjOQXZGnW0+8/Lccw7/FXo
vymuy0J1ZMHiadteQyeaibkfSumEoHJGDOroM2b4hmfyKNtP1QPq3e9jA8kHIvo=
=QpIt
-----END PGP SIGNATURE-----
--- End Message ---
