Package: dia
Version: 0.97.3+git20160930-8.1
Severity: critical
Tags: security upstream
Justification: breaks the whole system

Dear Maintainer,

when GNOME Dia before 2019-11-27 is launched with a filename argument
that is not a valid codepoint in the current encoding, it enters an
endless loop, thus endlessly writing text to stdout.
(The filename can be for a nonexistent file.)

If this launch is from a thumbnailer service, this output will usually
be written to disk via the system's logging facility (potentially with
elevated privileges), thus filling up the disk and eventually rendering
the system unusable.

Further details are available in the upstream bugreport [1] and the CVE
description [2].

Upstream (the GNOME Dia developers) has not tagged any official release
versions since 2011 (0.97.2), so Debian currently ships a more recent
state as 0.97.3+git20160930-8.2.
The vulnerability was introduced after the release of 0.97.2, and is
contained in all 0.97.3+* versions in Debian.

Could you please package the current development version of Dia, or
apply the (one-line) patch [3], to fix this vulnerability?

Kind regards,
Nils Steinger


-- System Information:
Debian Release: 10.2
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable'), (90, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-6-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dia depends on:
ii  dia-common           0.97.3+git20160930-8.1
ii  libart-2.0-2         2.3.21-4
ii  libatk1.0-0          2.30.0-2
ii  libc6                2.28-10
ii  libcairo2            1.16.0-4
ii  libfontconfig1       2.13.1-2
ii  libfreetype6         2.9.1-3+deb10u1
ii  libgdk-pixbuf2.0-0   2.38.1+dfsg-1
ii  libglib2.0-0         2.58.3-2+deb10u2
ii  libgtk2.0-0          2.24.32-3
ii  libpango-1.0-0       1.42.4-7~deb10u1
ii  libpangocairo-1.0-0  1.42.4-7~deb10u1
ii  libpangoft2-1.0-0    1.42.4-7~deb10u1
ii  libpng16-16          1.6.36-6
ii  libpython2.7         2.7.16-2+deb10u1
ii  libxml2              2.9.4+dfsg1-7+b3
ii  libxslt1.1           1.1.32-2.2~deb10u1
ii  zlib1g               1:1.2.11.dfsg-1

Versions of packages dia recommends:
ii  dia-shapes   0.6.0-3
ii  gsfonts-x11  0.26

dia suggests no packages.

-- no debconf information

Reply via email to