Your message dated Sat, 23 Jun 2012 15:18:01 +0000
with message-id <[email protected]>
and subject line Bug#677717: fixed in vte 1:0.28.2-5
has caused the Debian Bug report #677717,
regarding "malicious escape sequences can cause denial of service for vte-based
terminals"
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
677717: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677717
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: mosh
Version: 1.2-1
Severity: important
Tags: security
I submitted details upstream at
https://github.com/keithw/mosh/issues/271
but here's also a copy:
> The commands
>
> echo -en "\e[2147483647L"
> echo -en "\e[2147483647M"
> echo -en "\e[2147483647@"
> echo -en "\e[2147483647P"
>
> all cause mosh-server to enter very long for-loops in terminalfunctions.cc.
Upstream has released a fix, please consider including it in the debian
package.
Security team, this also affects gnome-terminal and probably all other
terminal emulators that use libvte. Its upstream is also working a fix
but they made their bug report restricted for now:
https://bugzilla.gnome.org/show_bug.cgi?id=676090
-- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-5-amd64 (SMP w/6 CPU cores)
Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages mosh depends on:
ii libc6 2.13-32
ii libgcc1 1:4.7.0-8
ii libio-pty-perl 1:1.08-1+b2
ii libprotobuf7 2.4.1-1
ii libstdc++6 4.7.0-8
ii libtinfo5 5.9-7
ii libutempter0 1.1.5-4
ii openssh-client 1:5.9p1-5
ii zlib1g 1:1.2.7.dfsg-1
mosh recommends no packages.
mosh suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: vte
Source-Version: 1:0.28.2-5
We believe that the bug you reported is fixed in the latest version of
vte, which is due to be installed in the Debian FTP archive:
libvte-common_0.28.2-5_all.deb
to main/v/vte/libvte-common_0.28.2-5_all.deb
libvte-dev_0.28.2-5_amd64.deb
to main/v/vte/libvte-dev_0.28.2-5_amd64.deb
libvte-doc_0.28.2-5_all.deb
to main/v/vte/libvte-doc_0.28.2-5_all.deb
libvte9-udeb_0.28.2-5_amd64.udeb
to main/v/vte/libvte9-udeb_0.28.2-5_amd64.udeb
libvte9_0.28.2-5_amd64.deb
to main/v/vte/libvte9_0.28.2-5_amd64.deb
python-vte_0.28.2-5_amd64.deb
to main/v/vte/python-vte_0.28.2-5_amd64.deb
vte_0.28.2-5.debian.tar.gz
to main/v/vte/vte_0.28.2-5.debian.tar.gz
vte_0.28.2-5.dsc
to main/v/vte/vte_0.28.2-5.dsc
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Josselin Mouette <[email protected]> (supplier of updated vte package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sat, 23 Jun 2012 16:02:46 +0200
Source: vte
Binary: libvte9 libvte9-udeb libvte-dev libvte-common python-vte libvte-doc
Architecture: source all amd64
Version: 1:0.28.2-5
Distribution: unstable
Urgency: medium
Maintainer: Debian GNOME Maintainers
<[email protected]>
Changed-By: Josselin Mouette <[email protected]>
Description:
libvte-common - Terminal emulator widget for GTK+ 2.x - common files
libvte-dev - Terminal emulator widget for GTK+ 2.0 - development files
libvte-doc - Terminal emulator widget for GTK+ 2.x - documentation
libvte9 - Terminal emulator widget for GTK+ 2.0 - runtime files
libvte9-udeb - Terminal emulator widget for GTK+ 2.0 - minimal runtime (udeb)
python-vte - Python bindings for the VTE widget set
Closes: 677717
Changes:
vte (1:0.28.2-5) unstable; urgency=medium
.
* Update repository URL.
* 03_CVE-2012-2738.patch, 04_CVE-2012-2738.patch: backport upstream
patches to fix a memory exhaustion vulnerability. Closes: #677717.
Checksums-Sha1:
c971eaf2e74fcfcb6aa4d16cbee75ae0a26a6265 1885 vte_0.28.2-5.dsc
6eb2530cc3e66b9025152131518dea718e2b9f4f 21852 vte_0.28.2-5.debian.tar.gz
5a13679f2a2758201df9d0c58d913a05cd0b087e 434640 libvte-common_0.28.2-5_all.deb
ca8389f75d4ad1ea43e958cad0d3f0e7355e54f0 433306 libvte-doc_0.28.2-5_all.deb
a6cc3a966a43f43bd7c95c89ae45ca216244678e 726454 libvte9_0.28.2-5_amd64.deb
a424cf779e7614d79740c422b6342de04fed3646 216968
libvte9-udeb_0.28.2-5_amd64.udeb
350d5ad94b4b6d0d12b32ed6e0ab154b613d9268 759132 libvte-dev_0.28.2-5_amd64.deb
fd9d040a134838111ca28f4707dbdae2490daa00 413256 python-vte_0.28.2-5_amd64.deb
Checksums-Sha256:
3b4d5fe4776335000ca523b0821cf21a3fb445fc4379628567d96ab0f24c851d 1885
vte_0.28.2-5.dsc
dfb1c5d29f64ed8df7ae77cd70ddbede339a70cbdeb5c4c8fd9226639d8e834b 21852
vte_0.28.2-5.debian.tar.gz
c848d13b08d88cb50cfba6c4377297bfdccf9962a54ff3964ea9cc5fdf23a89d 434640
libvte-common_0.28.2-5_all.deb
adbd4e44b9359b58d4e5aa708c412164c94327fb108e1cd1c34656a8048de73f 433306
libvte-doc_0.28.2-5_all.deb
1afb434bd9fe1d26947338d67078f6101de6ca4bad2bbd387b15c07feedd8dea 726454
libvte9_0.28.2-5_amd64.deb
4963033cbda5a8ba7eb8ebf1debae34463b8e63b821259860cfb51c1ab99562d 216968
libvte9-udeb_0.28.2-5_amd64.udeb
6143041bdd6ad9ea5d1aff33ec87bdfdf71de4d711957f25a107bc9c06fc7c9f 759132
libvte-dev_0.28.2-5_amd64.deb
5d7b81fdb6a32a0407a856cdac4d453fafbd09dd44dbf840ffa9d87eab7bb497 413256
python-vte_0.28.2-5_amd64.deb
Files:
6c40cde38623ee990c2eb52619064088 1885 libs optional vte_0.28.2-5.dsc
2699eaa8be90361be42116f712db9f99 21852 libs optional vte_0.28.2-5.debian.tar.gz
03923752a261c6d57944369484ded4df 434640 libs optional
libvte-common_0.28.2-5_all.deb
d8da6a3f9f5b78520f8e8c36b21a0b46 433306 doc optional
libvte-doc_0.28.2-5_all.deb
8d81236d7373645c53ab33f24e9f96e7 726454 libs optional
libvte9_0.28.2-5_amd64.deb
7da7201effaf5ced19abd9d0b45aa2c6 216968 debian-installer extra
libvte9-udeb_0.28.2-5_amd64.udeb
16ea0fb11037be1e2c6ccb35221afd4a 759132 libdevel optional
libvte-dev_0.28.2-5_amd64.deb
baeb69eed3765fbf83a12cf0a62af7f8 413256 python optional
python-vte_0.28.2-5_amd64.deb
Package-Type: udeb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFP5dsGrSla4ddfhTMRAi0wAKDUabZUdK3wnRH5WjHSc6MggSl0cACg9Mx5
jeVArmJe4kYIjd4UR6TpDuQ=
=Wt0/
-----END PGP SIGNATURE-----
--- End Message ---
