Your message dated Sat, 31 Jan 2015 21:20:25 +0000
with message-id <[email protected]>
and subject line Bug#724614: fixed in txt2man 1.5.6-1
has caused the Debian Bug report #724614,
regarding txt2man: CVE-2013-1444: unsafe use of temporary files
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
724614: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=724614
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: txt2man
Version: 1.5.5-4
Severity: normal
Tags: patch pending security
Dear maintainer,
txt2man in all suites allows overwriting of arbitrary files by an unsafe
use of the file /tmp/2222. This was introduced by a Debian patch.
The fix for this is to remove the line:
echo $post > /tmp/2222
which appears to be leftover debugging.
It is my intention to perform an NMU in two days if the bug remains
unfixed, and to then upload fixes for stable and oldstable. If you object,
please tell me as soon as possible.
If you fix the bug yourself, please include a reference to the assigned CVE
number, CVE-2013-1444.
Regards.
--
Jonathan Wiltshire [email protected]
Debian Developer http://people.debian.org/~jmw
4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51
diff -Nru txt2man-1.5.5/debian/changelog txt2man-1.5.5/debian/changelog
--- txt2man-1.5.5/debian/changelog 2011-04-11 10:37:22.000000000 +0100
+++ txt2man-1.5.5/debian/changelog 2013-09-25 19:08:15.000000000 +0100
@@ -1,3 +1,12 @@
+txt2man (1.5.5-4.1) UNRELEASED; urgency=low
+
+ * Non-maintainer upload.
+ * Fix CVE-2013-1444: insecure use of temporary files
+ by removing apparant debug output from
+ patches/debian-changes-1.5.5-2.1 (Closes: #nnnnnn)
+
+ -- Jonathan Wiltshire <[email protected]> Wed, 25 Sep 2013 19:07:07 +0100
+
txt2man (1.5.5-4) unstable; urgency=low
* Updated Standards version
diff -Nru txt2man-1.5.5/debian/patches/debian-changes-1.5.5-2.1 txt2man-1.5.5/debian/patches/debian-changes-1.5.5-2.1
--- txt2man-1.5.5/debian/patches/debian-changes-1.5.5-2.1 2011-04-11 10:37:22.000000000 +0100
+++ txt2man-1.5.5/debian/patches/debian-changes-1.5.5-2.1 2013-09-25 19:07:02.000000000 +0100
@@ -47,7 +47,7 @@
printf ".EH ||%s||\n" "$volume"
--- txt2man-1.5.5.orig/txt2man
+++ txt2man-1.5.5/txt2man
-@@ -139,11 +139,12 @@ do
+@@ -139,11 +139,11 @@ do
p) doprobe=1;;
I) itxt="$OPTARG�$itxt";;
B) btxt=$OPTARG;;
@@ -57,7 +57,6 @@
*) usage; exit;;
esac
done
-+echo $post > /tmp/2222
shift $(($OPTIND - 1))
date=${date:-$(date +'%d %B %Y')}
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
Source: txt2man
Source-Version: 1.5.6-1
We believe that the bug you reported is fixed in the latest version of
txt2man, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Joao Eriberto Mota Filho <[email protected]> (supplier of updated txt2man
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sat, 31 Jan 2015 13:07:36 -0200
Source: txt2man
Binary: txt2man
Architecture: source all
Version: 1.5.6-1
Distribution: experimental
Urgency: medium
Maintainer: Joao Eriberto Mota Filho <[email protected]>
Changed-By: Joao Eriberto Mota Filho <[email protected]>
Description:
txt2man - convert flat ASCII text to manpage format
Closes: 656029 724614
Changes:
txt2man (1.5.6-1) experimental; urgency=medium
.
* New maintainer. Thanks a lot to Fredrik Steen and Robin Cornelius for
your nice work over this package.
* New upstream release. (Closes: #656029)
* Acknowledge NMU. Thanks to Jonathan Wiltshire. (Closes: #724614)
* Migrations:
- DH level to 9.
- Standards-Version to 3.9.6.
- debian/copyright to 1.0 format.
- debian/rules to new (reduced) format.
* debian/control:
- Improved the long description.
- Updated the Homepage field. The upstream is using GitHub now.
- Updated the Vcs-* fields.
* debian/copyright: updated the upstream and packagers names and years.
* debian/dirs: removed. The fix-makefile patch fixed the upstream Makefile
and it will create the need directories.
* debian/docs: removed (useless to final user).
* debian/examples: created to install some examples.
* debian/examples.d: create to be a stuff of examples.
* debian/patches/:
- remove-ksh-check.patch:
. Added a header.
. Renamed to drop-ksh-check.
- debian-changes-1.5.5-2.1:
. Reviewed and split to fix-bashisms and fix-pager-option.
- fix-makefile: added to fix the upstream Makefile.
- fix-path-hyphen: fix a path pointing manpages level 2 and a hyphen
used as a minus sign in bookman file.
- fix-spelling-hyphen: fix a spelling error and a hyphen used as a
minus sign in txt2man file.
* debian/README.Debian: added to point to some examples.
* debian/watch: updated (using GitHub now).
Checksums-Sha1:
809a00ee3eef0bd785fa1aae4e42610089bd82bb 1828 txt2man_1.5.6-1.dsc
02b65f08dd67a1de7b1a8b596d14f582c16f139e 17805 txt2man_1.5.6.orig.tar.gz
136336e5513eced6a3382a1af4b5e2ab96f6ae52 14640 txt2man_1.5.6-1.debian.tar.xz
0b313c984b2d1206156fa93f53d2f69756922d31 27310 txt2man_1.5.6-1_all.deb
Checksums-Sha256:
ae2853cd23b6a868a4a8218474b7d7165d5656c766796852103e4aad10a7eb67 1828
txt2man_1.5.6-1.dsc
e5aed4a44e041f3b8327e43d847707720ae71aad643d3c1d37f898b8d40c9c03 17805
txt2man_1.5.6.orig.tar.gz
bca6fe36941439f8db6111abaa098a596b17364cb7001052cb374927ce50b29a 14640
txt2man_1.5.6-1.debian.tar.xz
e2e6c8ddee160faeb436a5e86fb5f1282a04da70228bcdbc825fca2dbfaa9e56 27310
txt2man_1.5.6-1_all.deb
Files:
d9cd60f1819be53684663fd10bec284d 1828 text optional txt2man_1.5.6-1.dsc
e9d47c7b1c88681fd57dfb0ba769edda 17805 text optional txt2man_1.5.6.orig.tar.gz
c351dd2b42c309456f24b9872c293976 14640 text optional
txt2man_1.5.6-1.debian.tar.xz
f31c4bf59d312197bc5c1105b3e7140c 27310 text optional txt2man_1.5.6-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJUzTGJAAoJEN5juccE6+nv8koP/1/HTVaX6gu49vcBQK067M4o
bNWDEU8aYx+eO730JlLdwjS73ZH8RKu3zHULdwlnDqgoDp7niq5AD3YR2j9rZBDh
0mW+4RORDFl5sDytMBHq8RhHKETmr/L8T3jodAxXJGpUSdUkH6J2/mrv/6mjWKt5
b6fbMfL1duDQT0yG4S7Q5JuWSeCPnbdl2oO1bIAiWEnZD7A625fymwv0zjMpgsaN
2ly93H7/5assGZIFoD/hzChc678BxFb8vP/ziF3pyF7+AbEYRSxmWVKtaW08cWNY
XThHr0LO2w1gVM2oNX1NWrdOX8fHoCWZjGCXTXPRW2cU0QU5RIwU4Yv8kVGAIvl1
v03omEleZmGbb5MK/mPpLOKQTcQM7ADjr5+CtqKhRIfzDbTA3Lh8ZrTyCbb3P1w7
weDGaGOolzUfVMg/BnljEq3eid3i0CoD4fM6UmxMaq5kvsX9DlEgOylcWh0NN51J
5wWvL3wVwaHYvE22nAna57vJFLaoyK7QxgeRwoWqayLl1ton065nQ1zV9NCQ+Q9B
bbPjFbbWkEY2aOojjY2HU0DMy1qAJZoi+/91k1X2D85UAFvt8OXVuL+PObI+DS3A
lOM7oVaemXVuJbuK1ou7Qigvq00Iu/sow7Vf4ztSPHFNzo018P+Ip/awPS0TDUUC
vIrSBlwxHw1qy6dqJyzP
=JNem
-----END PGP SIGNATURE-----
--- End Message ---
