Bug#1049366: indent: CVE-2023-40305

2023-08-19 Thread Salvatore Bonaccorso 
Hi Santiago,

On Sat, Aug 19, 2023 at 02:23:03PM +0200, Santiago Vila wrote:
> Thanks for the report.
> 
> I'm going to apply the two patches which Petr Písař
> has recently posted in Savannah.

Thanks!

> After that: Should I prepare packages for security
> (stable and oldstable) for you to review (I assume
> this helps a little bit), or should I just take the
> proposed-updates route?

We think those do not really warrant a DSA, no, but a point release
update should be sufficient. For that we have marked them already
earlier this week as no-dsa in
https://security-tracker.debian.org/tracker/CVE-2023-40305 .

Thanks for taking care as well of updating those in the stable and
oldstable suites!

Regards,
Salvatore

Bug#1049366: indent: CVE-2023-40305

2023-08-19 Thread Santiago Vila 

Thanks for the report.

I'm going to apply the two patches which Petr Písař
has recently posted in Savannah.

After that: Should I prepare packages for security
(stable and oldstable) for you to review (I assume
this helps a little bit), or should I just take the
proposed-updates route?

Thanks.

Bug#1049366: indent: CVE-2023-40305

2023-08-14 Thread Salvatore Bonaccorso 
Source: indent
Version: 2.2.13-2
Severity: important
Tags: security upstream
Forwarded: https://savannah.gnu.org/bugs/index.php?64503
X-Debbugs-Cc: car...@debian.org, Debian Security Team 
Control: found -1 2.2.12-4+deb12u1
Control: found -1 2.2.12-1

Hi,

The following vulnerability was published for indent.

CVE-2023-40305[0]:
| GNU indent 2.2.13 has a heap-based buffer overflow in search_brace
| in indent.c via a crafted file.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-40305
https://www.cve.org/CVERecord?id=CVE-2023-40305
[1] https://savannah.gnu.org/bugs/index.php?64503

Regards,
Salvatore