Your message dated Sun, 13 Dec 2009 12:37:24 +0100
with message-id <4b24d1f4.7020...@epost.diwic.se>
and subject line Re: Bug#560919: CVE-2009-3560 and CVE-2009-3720 
denial-of-services
has caused the Debian Bug report #560919,
regarding CVE-2009-3560 and CVE-2009-3720 denial-of-services
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
560919: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560919
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
package: audacity
severity: serious
tags: security

Hi,

The following CVE (Common Vulnerabilities & Exposures) ids were
published for expat.  I have determined that this package embeds a
vulnerable copy of xmlparse.c and xmltok_impl.c.  However, since this is
a mass bug filing (due to so many packages embedding expat), I have
not had time to determine whether the vulnerable code is actually
present in any of the binary packages derived from this source package.
Please determine whether this is the case. If the binary packages are
not affected, please feel free to close the bug with a message
containing the details of what you did to check.

CVE-2009-3560[0]:
| The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
| as used in the XML-Twig module for Perl, allows context-dependent
| attackers to cause a denial of service (application crash) via an XML
| document with malformed UTF-8 sequences that trigger a buffer
| over-read, related to the doProlog function in lib/xmlparse.c, a
| different vulnerability than CVE-2009-2625 and CVE-2009-3720.

CVE-2009-3720[1]:
| The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
| 2.0.1, as used in Python, PyXML, w3c-libwww, and other software,
| allows context-dependent attackers to cause a denial of service
| (application crash) via an XML document with crafted UTF-8 sequences
| that trigger a buffer over-read, a different vulnerability than
| CVE-2009-2625.

These issues also affect old versions of expat, so this package in etch
and lenny is very likely affected.  This is a low-severity security
issue, so DSAs will not be issued to correct these problems.  However,
you can optionally submit a proposed-update to the release team for
inclusion in the next stable point releases.  If you plan to do this, 
please open new bugs and include the security tag so we are aware that
you are working on that.

For further information see [0],[1],[2],[3].  In particular, [2] and [3]
are links to the patches for CVE-2009-3560 and CVE-2009-3720
respectively. Note that the ideal solution would be to make use of the
system expat so only one package will need to be updated for future
security issues. Preferably in your update to unstable, alter your
package to make use of the system expat.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560
    http://security-tracker.debian.org/tracker/CVE-2009-3560
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720
    http://security-tracker.debian.org/tracker/CVE-2009-3720
[2]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
[3]
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch



--- End Message ---
--- Begin Message ---
Audacity already uses the system version of expat. Upstream ships expat
included, but we configure the packages to build with the system
versions instead. According to the changelog, this has been the case for
all 1.3.x releases of Audacity (i e Lenny, Squeeze and Sid).

// David

Michael Gilbert wrote:
> package: audacity
> severity: serious
> tags: security
> 
> Hi,
> 
> The following CVE (Common Vulnerabilities & Exposures) ids were
> published for expat.  I have determined that this package embeds a
> vulnerable copy of xmlparse.c and xmltok_impl.c.  However, since this is
> a mass bug filing (due to so many packages embedding expat), I have
> not had time to determine whether the vulnerable code is actually
> present in any of the binary packages derived from this source package.
> Please determine whether this is the case. If the binary packages are
> not affected, please feel free to close the bug with a message
> containing the details of what you did to check.
> 
> CVE-2009-3560[0]:
> | The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1,
> | as used in the XML-Twig module for Perl, allows context-dependent
> | attackers to cause a denial of service (application crash) via an XML
> | document with malformed UTF-8 sequences that trigger a buffer
> | over-read, related to the doProlog function in lib/xmlparse.c, a
> | different vulnerability than CVE-2009-2625 and CVE-2009-3720.
> 
> CVE-2009-3720[1]:
> | The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
> | 2.0.1, as used in Python, PyXML, w3c-libwww, and other software,
> | allows context-dependent attackers to cause a denial of service
> | (application crash) via an XML document with crafted UTF-8 sequences
> | that trigger a buffer over-read, a different vulnerability than
> | CVE-2009-2625.
> 
> These issues also affect old versions of expat, so this package in etch
> and lenny is very likely affected.  This is a low-severity security
> issue, so DSAs will not be issued to correct these problems.  However,
> you can optionally submit a proposed-update to the release team for
> inclusion in the next stable point releases.  If you plan to do this, 
> please open new bugs and include the security tag so we are aware that
> you are working on that.
> 
> For further information see [0],[1],[2],[3].  In particular, [2] and [3]
> are links to the patches for CVE-2009-3560 and CVE-2009-3720
> respectively. Note that the ideal solution would be to make use of the
> system expat so only one package will need to be updated for future
> security issues. Preferably in your update to unstable, alter your
> package to make use of the system expat.
> 
> If you fix the vulnerability please also make sure to include the
> CVE id in your changelog entry.
> 
> [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560
>     http://security-tracker.debian.org/tracker/CVE-2009-3560
> [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3720
>     http://security-tracker.debian.org/tracker/CVE-2009-3720
> [2]
> http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
> [3]
> http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
> 
> 
> 
> _______________________________________________
> pkg-multimedia-maintainers mailing list
> pkg-multimedia-maintainers@lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/pkg-multimedia-maintainers
> 




--- End Message ---
_______________________________________________
pkg-multimedia-maintainers mailing list
pkg-multimedia-maintainers@lists.alioth.debian.org
http://lists.alioth.debian.org/mailman/listinfo/pkg-multimedia-maintainers

Reply via email to