Your message dated Sat, 23 Jun 2018 12:32:13 +0100
with message-id <[email protected]>
and subject line Closing bugs for requests included in the EoL jessie point
release
has caused the Debian Bug report #901276,
regarding jessie-pu: package lame/3.99.5+repack1-7+deb8u2
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
901276: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901276
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: jessie
User: [email protected]
Usertags: pu
Hi,
lame 3.99.5+repack1-7+deb8u1 is affected by several vulnerabilities in
the code used to read the input file. These issues are not present in
any Debian release after Jessie because the package switched to
libsndfile to read and write audio files. The upstream code itself was
recently fixed in 3.100.
Following advices from lame's upstream and from lame's maintainer I
proposed the attached patch. In this patch we modify the Jessie
package to use libsndfile instead of the internal code. The security
team considers these issues not worth a DSA but recommended me to
submit this patch as jessie-pu.
You can find more detailed information about this patch on the
debian-lts ML[0].
Thanks !
Regards,
Hugo
[0] https://lists.debian.org/debian-lts/2018/05/msg00081.html
--
Hugo Lefeuvre (hle) | www.owl.eu.com
4096/ 9C4F C8BF A4B0 8FC5 48EB 56B8 1962 765B B9A8 BACA
diff -Nru lame-3.99.5+repack1/debian/changelog lame-3.99.5+repack1/debian/changelog
--- lame-3.99.5+repack1/debian/changelog 2015-06-15 09:05:28.000000000 -0400
+++ lame-3.99.5+repack1/debian/changelog 2018-05-27 17:30:02.000000000 -0400
@@ -1,3 +1,16 @@
+lame (3.99.5+repack1-7+deb8u2) oldstable; urgency=high
+
+ [ Fabian Greffrath ]
+
+ * Build the frontend with the sndfile io routines, RAW PCM and WAV can be
+ read from stdin since at least 3.99.0 (Closes: #867725).
+ - Add Build-Depends: libsndfile1-dev.
+
+ Addressed CVEs: CVE-2017-9872, CVE-2017-9871, CVE-2017-9870, CVE-2017-9869,
+ CVE-2017-15046, CVE-2017-15045, CVE-2017-15018.
+
+ -- Hugo Lefeuvre <[email protected]> Sun, 27 May 2018 17:30:02 -0400
+
lame (3.99.5+repack1-7+deb8u1) jessie; urgency=medium
* debian/patches/force_align_arg_pointer.patch: Enable functions with SSE
diff -Nru lame-3.99.5+repack1/debian/control lame-3.99.5+repack1/debian/control
--- lame-3.99.5+repack1/debian/control 2015-06-15 09:03:04.000000000 -0400
+++ lame-3.99.5+repack1/debian/control 2018-05-27 17:16:42.000000000 -0400
@@ -9,6 +9,7 @@
debhelper (>= 9),
dh-autoreconf,
libncurses5-dev,
+ libsndfile1-dev,
pkg-config,
nasm [i386]
Standards-Version: 3.9.5
diff -Nru lame-3.99.5+repack1/debian/rules lame-3.99.5+repack1/debian/rules
--- lame-3.99.5+repack1/debian/rules 2015-06-15 09:03:04.000000000 -0400
+++ lame-3.99.5+repack1/debian/rules 2018-05-27 17:16:42.000000000 -0400
@@ -9,4 +9,4 @@
--enable-dynamic-frontends \
--enable-expopt=full \
--enable-nasm \
- --with-fileio=lame
+ --with-fileio=sndfile
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Version: 8.11
Hi,
The updates referenced by these bugs were included in today's EoL point
release for jessie (8.11).
Regards,
Adam
--- End Message ---
