Bug#672994: CVE-2012-0219: buffer overflow

2013-03-17 Thread Jonathan Wiltshire 
Package: socat

Dear maintainer,

Recently you fixed one or more security problems and as a result you closed
this bug. These problems were not serious enough for a Debian Security
Advisory, so they are now on my radar for fixing in the following suites
through point releases:

squeeze (6.0.7) - use target stable

Please prepare a minimal-changes upload targetting each of these suites,
and submit a debdiff to the Release Team [0] for consideration. They will
offer additional guidance or instruct you to upload your package.

I will happily assist you at any stage if the patch is straightforward and
you need help. Please keep me in CC at all times so I can
track [1] the progress of this request.

For details of this process and the rationale, please see the original
announcement [2] and my blog post [3].

0: debian-rele...@lists.debian.org
1: http://prsc.debian.net/tracker/672994/
2: 201101232332.11736.th...@debian.org
3: http://deb.li/prsc

Thanks,

with his security hat on:
--
Jonathan Wiltshire  j...@debian.org
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Bug#672994: CVE-2012-0219: buffer overflow

2012-05-15 Thread Moritz Muehlenhoff 
Package: socat
Severity: grave
Tags: security

Please see http://www.dest-unreach.org/socat/contrib/socat-secadv3.html

Cheers,
Moritz



-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Bug#672994: CVE-2012-0219: buffer overflow

2012-05-15 Thread Jakub Wilk 

found 672994 1.7.1.3-1
fixed 672994 1.7.1.3-1.3
fixed 672994 2.0.0~beta4-1.1
thanks

* Moritz Muehlenhoff muehlenh...@univention.de, 2012-05-15, 12:31:

Please see http://www.dest-unreach.org/socat/contrib/socat-secadv3.html


A heap based buffer overflow vulnerability has been found with data 
that happens to be output on the READLINE address.


I recently disabled readline support in socat, due to license 
incompatibility. Squeeze is still affected, though.


--
Jakub Wilk



--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org