Your message dated Sat, 29 Nov 2014 23:04:26 +0000 with message-id <[email protected]> and subject line Bug#771360: fixed in claws-mail 3.11.1-2 has caused the Debian Bug report #771360, regarding CVE-2010-5109 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 771360: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=771360 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: claws Severity: grave Tags: security Hi, claws-mail embeds a copy of libytnef: | claws-mail (3.10.1-1) unstable; urgency=medium | | - Remove libytnef dependency: it was assimilated (and modified) But it's missing the security fix CVE-2010-5109, I'm attaching the patch from src:libytnef Can you please fix this for jessie and forward the patch upstream? Cheers, MoritzIndex: b/ytnef.c =================================================================== --- a/ytnef.c +++ b/ytnef.c @@ -1328,7 +1328,7 @@ comp_Prebuf.size = strlen(RTF_PREBUF); comp_Prebuf.data = calloc(comp_Prebuf.size, 1); - strcpy(comp_Prebuf.data, RTF_PREBUF); + memcpy(comp_Prebuf.data, RTF_PREBUF, comp_Prebuf.size); src = p->data; in = 0;
--- End Message ---
--- Begin Message ---Source: claws-mail Source-Version: 3.11.1-2 We believe that the bug you reported is fixed in the latest version of claws-mail, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Ricardo Mones <[email protected]> (supplier of updated claws-mail package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sat, 29 Nov 2014 23:03:27 +0100 Source: claws-mail Binary: claws-mail claws-mail-dbg libclaws-mail-dev claws-mail-plugins claws-mail-spamassassin claws-mail-pgpmime claws-mail-pgpinline claws-mail-smime-plugin claws-mail-bogofilter claws-mail-i18n claws-mail-doc claws-mail-tools claws-mail-extra-plugins claws-mail-acpi-notifier claws-mail-address-keeper claws-mail-archiver-plugin claws-mail-attach-remover claws-mail-attach-warner claws-mail-bsfilter-plugin claws-mail-clamd-plugin claws-mail-fancy-plugin claws-mail-feeds-reader claws-mail-fetchinfo-plugin claws-mail-gdata-plugin claws-mail-libravatar claws-mail-newmail-plugin claws-mail-mailmbox-plugin claws-mail-multi-notifier claws-mail-tnef-parser claws-mail-perl-filter claws-mail-pdf-viewer claws-mail-python-plugin claws-mail-spam-report claws-mail-vcalendar-plugin Architecture: source amd64 all Version: 3.11.1-2 Distribution: unstable Urgency: high Maintainer: Ricardo Mones <[email protected]> Changed-By: Ricardo Mones <[email protected]> Description: claws-mail - Fast, lightweight and user-friendly GTK+2 based email client claws-mail-acpi-notifier - Laptop's Mail LED control for Claws Mail claws-mail-address-keeper - Address keeper plugin for Claws Mail claws-mail-archiver-plugin - Archiver plugin for Claws Mail claws-mail-attach-remover - Mail attachment remover for Claws Mail claws-mail-attach-warner - Missing attachment warnings for Claws Mail claws-mail-bogofilter - Bogofilter plugin for Claws Mail claws-mail-bsfilter-plugin - Spam filtering using bsfilter for Claws Mail claws-mail-clamd-plugin - ClamAV socket-based plugin for Claws Mail claws-mail-dbg - Debug symbols for Claws Mail mailer claws-mail-doc - User documentation for Claws Mail mailer claws-mail-extra-plugins - Extra plugins collection for Claws Mail claws-mail-fancy-plugin - HTML mail viewer using GTK+2 WebKit claws-mail-feeds-reader - Feeds (RSS/Atom) reader plugin for Claws Mail claws-mail-fetchinfo-plugin - Add X-FETCH headers plugin for Claws Mail claws-mail-gdata-plugin - Access to GData (Google services) for Claws Mail claws-mail-i18n - Locale data for Claws Mail (i18n support) claws-mail-libravatar - Display sender avatar from a libravatar server claws-mail-mailmbox-plugin - mbox format mailboxes handler for Claws Mail claws-mail-multi-notifier - Various new mail notifiers for Claws Mail claws-mail-newmail-plugin - New mail logger plugin for Claws Mail claws-mail-pdf-viewer - PDF and PostScript attachment viewer for Claws Mail claws-mail-perl-filter - Message filtering plugin using perl for Claws Mail claws-mail-pgpinline - PGP/inline plugin for Claws Mail claws-mail-pgpmime - PGP/MIME plugin for Claws Mail claws-mail-plugins - Installs plugins for the Claws Mail mailer claws-mail-python-plugin - Python plugin and console for Claws Mail claws-mail-smime-plugin - S/MIME signature/encryption handling for Claws Mail claws-mail-spam-report - Spam reporting plugin for Claws Mail claws-mail-spamassassin - SpamAssassin plugin for Claws Mail claws-mail-tnef-parser - TNEF attachment handler for Claws Mail claws-mail-tools - Helper and utility scripts for Claws Mail mailer claws-mail-vcalendar-plugin - vCalendar message handling plugin for Claws Mail libclaws-mail-dev - Development files for Claws Mail plugins Closes: 771360 Changes: claws-mail (3.11.1-2) unstable; urgency=high . * patches/14CVE_2010_5109.patch, patches/series - Fix possible buffer overflow CVE-2010-5109 (Closes: #771360) - Raised urgency because of RC security bug Checksums-Sha1: b72c8dd5b24e25331be4e45a11c37b49d20c3f39 5006 claws-mail_3.11.1-2.dsc 2fcdf56551d8ad9ee5c2d8aa2cdf4af154468521 44060 claws-mail_3.11.1-2.debian.tar.xz 262676c61eeea4ae34a22a5735143f176ff00780 1355292 claws-mail_3.11.1-2_amd64.deb 070cd9ced5b9e06248bf00ea905a3810823d4e20 6823074 claws-mail-dbg_3.11.1-2_amd64.deb ff04baaa11a5dd1ac3d5476ea11c03a7a50b414c 214284 libclaws-mail-dev_3.11.1-2_amd64.deb 963edd25ee23be8678478ee39b0682b244f925c4 81298 claws-mail-plugins_3.11.1-2_all.deb 06d54a26bde0a00dba1826600c884a75024dbebd 102144 claws-mail-spamassassin_3.11.1-2_amd64.deb 5750023a9592853ad55f9b2cb96df95bedd27e87 116054 claws-mail-pgpmime_3.11.1-2_amd64.deb 775a863c97c51aefb418f0b8cbad8d4bd5d9d5ed 91924 claws-mail-pgpinline_3.11.1-2_amd64.deb edcdfdad20778ca3068c110bc2c8eb91963e1b45 92546 claws-mail-smime-plugin_3.11.1-2_amd64.deb d4c175e1db148e659b744984360a9f41b539645b 96176 claws-mail-bogofilter_3.11.1-2_amd64.deb 4f64625332c31bf35c64dd491be664937e45852e 1329774 claws-mail-i18n_3.11.1-2_all.deb eb6b3cb1c12a5918003241921247435c78ac302b 2440384 claws-mail-doc_3.11.1-2_all.deb d5336e00885cee81266f38a5361720dcb0f090bb 164132 claws-mail-tools_3.11.1-2_all.deb 1407e7cf78cec827c686badf92bf41880388706d 82894 claws-mail-extra-plugins_3.11.1-2_all.deb 7155ac0d435b37becd66d7870e9fa6363f5086f9 91406 claws-mail-acpi-notifier_3.11.1-2_amd64.deb 8d20c0eb290178aa5e2fcb53d939d9cc0b6f2af1 89774 claws-mail-address-keeper_3.11.1-2_amd64.deb e0acc9feadfb87eb66f6b551047690343d8d0a9a 102368 claws-mail-archiver-plugin_3.11.1-2_amd64.deb c0b067ab1a2493457dfb24b9a5f0f7b508973433 90502 claws-mail-attach-remover_3.11.1-2_amd64.deb 4c94368dad890cac58bbbeb92af33cdd2627a297 89986 claws-mail-attach-warner_3.11.1-2_amd64.deb 773bada2d2031787fd44732dc201107f3df6e52a 93248 claws-mail-bsfilter-plugin_3.11.1-2_amd64.deb 6ea7bde8e2cab4012b1a534a7638d14de48bb778 98342 claws-mail-clamd-plugin_3.11.1-2_amd64.deb 67e7c3fee8a79348ab5b60e5453e828a8c734e1a 96876 claws-mail-fancy-plugin_3.11.1-2_amd64.deb 056f812b99cfd880200d87a343526ae6561ac970 130190 claws-mail-feeds-reader_3.11.1-2_amd64.deb fdd288b8e22bb6f196baa01e8cf2b00e83c76612 88416 claws-mail-fetchinfo-plugin_3.11.1-2_amd64.deb b38078fa58767a38cab894ad50d1f3720fbc5d27 91646 claws-mail-gdata-plugin_3.11.1-2_amd64.deb da27088bdb495ab3bbcf3735878a1b3577f5c041 94186 claws-mail-libravatar_3.11.1-2_amd64.deb cde6ca0e539582401c9c44774d7b9bccfb38ffc6 85950 claws-mail-newmail-plugin_3.11.1-2_amd64.deb 5f3c525c2595bcf161ea1042816c16c3def0e4ab 126264 claws-mail-mailmbox-plugin_3.11.1-2_amd64.deb 8e00ccaa5d68404fbde09e44684b44f1e21ef475 137844 claws-mail-multi-notifier_3.11.1-2_amd64.deb c0e08cc2cae5d4608cf7c65a7b64a2d021da71c8 106044 claws-mail-tnef-parser_3.11.1-2_amd64.deb 698e97cec045cc0696251234c88dd94f80f3b23f 115876 claws-mail-perl-filter_3.11.1-2_amd64.deb 67f5bf3275f3c9046026d0697548f4df44ce2dc8 100806 claws-mail-pdf-viewer_3.11.1-2_amd64.deb 402b7f08d207b1213147fcfc25fad0386a3fcdf8 116924 claws-mail-python-plugin_3.11.1-2_amd64.deb 81974a8dcec9953df95f1b9bf1ba52490c9112a7 90752 claws-mail-spam-report_3.11.1-2_amd64.deb b2ec04bb499acee1718c0fe387e5b6ade7d9978c 247900 claws-mail-vcalendar-plugin_3.11.1-2_amd64.deb Checksums-Sha256: 01aa4fa3c8246b1bea5160219db133eedd46732e4247c87bc3c5ef8ced58385e 5006 claws-mail_3.11.1-2.dsc 0e47a90a69cab7c8adc1c93ffcb2620f9f49d6406f9b4b7431910e1a24c011f1 44060 claws-mail_3.11.1-2.debian.tar.xz 076721d2375a9be2d6e4488ccb7821439a2135a3996802ac3ab5035237faa184 1355292 claws-mail_3.11.1-2_amd64.deb d533e0201ac9a724589aa09b2a623c0b474bccaa037e65dde9726ab255ad66d9 6823074 claws-mail-dbg_3.11.1-2_amd64.deb 6c367571a219976e058e46d841ea46002bd75fcf0bbc6f08935d27e6392139a1 214284 libclaws-mail-dev_3.11.1-2_amd64.deb 52f77e66099369da4aef12580496fa915ac704400ec0bde5f665a4f7a4347519 81298 claws-mail-plugins_3.11.1-2_all.deb de9ee20f4c9c7f0d1c3effe137e3cb0e1c7330075483814c1df36cd61370b8dd 102144 claws-mail-spamassassin_3.11.1-2_amd64.deb 68d37f043eb4834535c13b29d1ac1ad60bf0856c20b5ad8f999fea8284287ddd 116054 claws-mail-pgpmime_3.11.1-2_amd64.deb 9da6b8f9ff2092753b6b0f5024753a7fef218f8b57b1aaf6f7912ec86dc8e6be 91924 claws-mail-pgpinline_3.11.1-2_amd64.deb 83e092bdeaff8507b434eb6dfa4a6debb65060489aec0c0a013e946c86fe5d86 92546 claws-mail-smime-plugin_3.11.1-2_amd64.deb d61e5a05d7fdf5dc33e322134118f1cb1b6bbf0d3ea90b138674e4dd68074d13 96176 claws-mail-bogofilter_3.11.1-2_amd64.deb 9762391b35fd46c90f7175c2bbc951f90449bb1b1b8dbec5e18267c67adcd675 1329774 claws-mail-i18n_3.11.1-2_all.deb 3497ae35b48386bca5910983d444d37287f56d3923f4a6fe3c6596a7e9fdd4b5 2440384 claws-mail-doc_3.11.1-2_all.deb 509f9c6211eb5b5a628adb5c5453468a2aecc2cafd2f09a5d38b4a5c622d0b73 164132 claws-mail-tools_3.11.1-2_all.deb e5db833669d4bca7c08c6be0f8a82f218fbca9fc14f6fe2efaa25e0e3d773e3e 82894 claws-mail-extra-plugins_3.11.1-2_all.deb 85921608174b2e1a112727604d2d3a9d1f81c00949c55b0f491ead92787162fd 91406 claws-mail-acpi-notifier_3.11.1-2_amd64.deb 095c978eb114347915246023467655c296f4456bb252c72df9ef3ece119616a4 89774 claws-mail-address-keeper_3.11.1-2_amd64.deb 6219f8598ef2fa88845ff042b5c0a54afb80cbdcdf0178dcd2aa159b401396a5 102368 claws-mail-archiver-plugin_3.11.1-2_amd64.deb e31cd6504bff5faddc7aa2fc679f8e1cd56591cd6667024a8187133f249eb09e 90502 claws-mail-attach-remover_3.11.1-2_amd64.deb 350e436200fe932c456033f33559a36bfbae86fff773e48aecb436a7aebb7874 89986 claws-mail-attach-warner_3.11.1-2_amd64.deb f64e8e9f1c244e5b7a50665b09d97a7fa1993cf841f359d1e57c33c9440ae20c 93248 claws-mail-bsfilter-plugin_3.11.1-2_amd64.deb fdf76cff405ffa4fa6ce204297fe527e860b9b12eb0b982d09359cff064c091d 98342 claws-mail-clamd-plugin_3.11.1-2_amd64.deb d6747b3ea10d3e4edd3e407b22860949e40b3ba52ab3d0041109b1e4eeb682b6 96876 claws-mail-fancy-plugin_3.11.1-2_amd64.deb aabeb04daeeddf5c0fcccf4fc46b55cd94b3e62416901dce5c59dae01c5ce3e1 130190 claws-mail-feeds-reader_3.11.1-2_amd64.deb 9cb823168595deead2ed7efbee5b4332b7887cb82afe3150029ed1fb5e13d62e 88416 claws-mail-fetchinfo-plugin_3.11.1-2_amd64.deb 01390a62fd14574b87e2a3c1434704e295bee00f21d2431b6fec5c2d3f9466ec 91646 claws-mail-gdata-plugin_3.11.1-2_amd64.deb 068d0496fe65f64cc0525c5b388f8ee64b3f123a0e6173f3fd27640f662b0dea 94186 claws-mail-libravatar_3.11.1-2_amd64.deb d0e31bdd3ce7a6acc151d4de1890e80411de3822c0bb402ab5baae3efc51a016 85950 claws-mail-newmail-plugin_3.11.1-2_amd64.deb 362667093aaeb8d930e5a35d6520d7f7cb3086e217856ca09068518f0613fb50 126264 claws-mail-mailmbox-plugin_3.11.1-2_amd64.deb 7dff3fdbd74dee0d11e31790aa7704c7c625548500d2e116090cb5ddba0b3c97 137844 claws-mail-multi-notifier_3.11.1-2_amd64.deb ca0743c7d64057b546cbb1c5e53ad657438b4e1f6807d4300d8abbad54584e60 106044 claws-mail-tnef-parser_3.11.1-2_amd64.deb 983280942c41de2b96ad007b60f9e1f41c57b97aa1b6c58a2102271171e91d1a 115876 claws-mail-perl-filter_3.11.1-2_amd64.deb d9a80c83d72210096a3993c9869f66a80286e8d6b080bcf68d8c9be86d08e0ef 100806 claws-mail-pdf-viewer_3.11.1-2_amd64.deb 34e1c0644efd655d12c94ebe30d71192704d3d1465688bbbf2c4663b55c8d1b7 116924 claws-mail-python-plugin_3.11.1-2_amd64.deb 1b806671fda01b334bb2e48dfca641320510b94ddc6032268754dd4a4d989668 90752 claws-mail-spam-report_3.11.1-2_amd64.deb d50cfe3e573e4ad509049b860def139e4d5c17b1fd81fd3b2c13c5054ca972ca 247900 claws-mail-vcalendar-plugin_3.11.1-2_amd64.deb Files: 61f9ce1be31f6aef7f8a47f9a85dec9f 5006 mail optional claws-mail_3.11.1-2.dsc be9703824035b68f31fe69e0ec2207ee 44060 mail optional claws-mail_3.11.1-2.debian.tar.xz a603fc35c6afec51cb4ae8fdf69196ab 1355292 mail optional claws-mail_3.11.1-2_amd64.deb d9f5d8f5a2427aeeb7085fb774369da2 6823074 debug extra claws-mail-dbg_3.11.1-2_amd64.deb 2f7781e629571c529fa4da73c26bc3e7 214284 devel optional libclaws-mail-dev_3.11.1-2_amd64.deb c0821bd2a078bb335867f950a959bcab 81298 metapackages optional claws-mail-plugins_3.11.1-2_all.deb b4138f5d883d8517ad988190b7ec0fa2 102144 mail optional claws-mail-spamassassin_3.11.1-2_amd64.deb 9e79fe49565df52ef4c8aaa94ad5e5f6 116054 mail optional claws-mail-pgpmime_3.11.1-2_amd64.deb 051a95fcf11a57ca7cac2c0c18474e12 91924 mail optional claws-mail-pgpinline_3.11.1-2_amd64.deb 39a9930b78a0bec10d9a6cb5c2d0d0d4 92546 mail optional claws-mail-smime-plugin_3.11.1-2_amd64.deb 678aae87bb0c430f956d6edda62c75a6 96176 mail optional claws-mail-bogofilter_3.11.1-2_amd64.deb adf7aaeb9906b0e26d5d442367993e7a 1329774 localization optional claws-mail-i18n_3.11.1-2_all.deb fc2714bfe8852be051929ed22d3feb15 2440384 doc optional claws-mail-doc_3.11.1-2_all.deb 0561302bdb1281ddcca2d9400a02ed6e 164132 mail optional claws-mail-tools_3.11.1-2_all.deb 1edc44f1fa6a87ef24f5e008da4cc9a8 82894 metapackages optional claws-mail-extra-plugins_3.11.1-2_all.deb ca3fce0cb1c5a93af9fce23c09e4692c 91406 mail optional claws-mail-acpi-notifier_3.11.1-2_amd64.deb 052297c5b65a06369caa214b0d645b8b 89774 mail optional claws-mail-address-keeper_3.11.1-2_amd64.deb 1e8587ccddde33d7ce3a7c832f67aa3d 102368 mail optional claws-mail-archiver-plugin_3.11.1-2_amd64.deb 6a15d97d1f9383c31ea2bffe12291bd6 90502 mail optional claws-mail-attach-remover_3.11.1-2_amd64.deb a360a938dc78b1c61b382c393de1825b 89986 mail optional claws-mail-attach-warner_3.11.1-2_amd64.deb c01ccb66adc7c2d64a18ab4784d48c40 93248 mail optional claws-mail-bsfilter-plugin_3.11.1-2_amd64.deb f8600c72706f4059a8299d693268a29e 98342 mail optional claws-mail-clamd-plugin_3.11.1-2_amd64.deb 443be4eec79d97b83545e48ed06bb2ec 96876 mail optional claws-mail-fancy-plugin_3.11.1-2_amd64.deb e32905aa36b19d3d2bc13b262e1cde73 130190 mail optional claws-mail-feeds-reader_3.11.1-2_amd64.deb d1f278cee71484f6128bfec02b60f512 88416 mail optional claws-mail-fetchinfo-plugin_3.11.1-2_amd64.deb 43f39e3ee90252a60b798c5d48269dbf 91646 mail optional claws-mail-gdata-plugin_3.11.1-2_amd64.deb 15847dda866ff1fcdee2b1b7f7c99b59 94186 mail optional claws-mail-libravatar_3.11.1-2_amd64.deb 8ed1fa26631d2be79e6d3dfd042806a8 85950 mail optional claws-mail-newmail-plugin_3.11.1-2_amd64.deb b01b4ab4d84a815586d623b90cca26dc 126264 mail optional claws-mail-mailmbox-plugin_3.11.1-2_amd64.deb f1c80f7e63bc2fde777e8bba063a4a89 137844 mail optional claws-mail-multi-notifier_3.11.1-2_amd64.deb 5eadcb2750d9b04087dfe2744f78b03d 106044 mail optional claws-mail-tnef-parser_3.11.1-2_amd64.deb 6279de593bd19c10d2ac890f322a8afa 115876 mail optional claws-mail-perl-filter_3.11.1-2_amd64.deb 908d9e7039876316213f2cd343b15d43 100806 mail optional claws-mail-pdf-viewer_3.11.1-2_amd64.deb 523da9640d8315ddf0ba69144c8f070e 116924 mail optional claws-mail-python-plugin_3.11.1-2_amd64.deb a5d73dd995b3341063081f11f7a1a694 90752 mail optional claws-mail-spam-report_3.11.1-2_amd64.deb 03d1b6bd4c60fdc329b883849d2692c3 247900 mail optional claws-mail-vcalendar-plugin_3.11.1-2_amd64.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJUekwYAAoJEB8PCojeW8ympTIP/0QxghxLlAGr+t7kQL1MCW6d xZftsXDvsXluGdVDtt2CqeKWnH8coITaRZyicHv8u1XPIOeELaWuxB6nnnLDbLOs MgnjnBl4dbVzQbHxsgJAyaY2HgU9II17kAbn6hjsSkrEV8Q/jXtYm7msMR1HoCos 9QBXHRI5+mjggUd6+3FeYwMDnqB1x+j8jKxy5LxX9j27zgJEnmPzziOU8NA517mr LKM/Kfi5EtLmQz7+XWiefhdKPyjLaqSWoebUPONS7y94Kn3qjeDm1PR6GctZdhP4 v6+xlAJFSZS4iFQRvt4gxSpkC6nAsWQAkVp8nbfj+hYsZCL9HqeJEu9hdi8PmuMJ rwdis+EdhXXcMK1RvhyZ15CrzvV2woRTkjC1i+TN82bkHGp8FWqas8oXt+p3zyY6 ULFIwWxSjV0E5KJ18ODIqlJnIPa8kTMQZyHjIzw0lsYJ9+rUf8zqojk0LDGsHtkb DWIfwWNEHl0uUjMZ5G4mBsEfutqU802HGRNjzhi0CJpnLa16IejPY8EiJ2f9VFj5 ltpoMUVYkRNDUq490rcOD2C+rl4xG29QHjulAcTSUjdYpxQ3f/38b8JlXL6hXX9h gGvnIhx1zpGi9ipMOyVDBTzYm3l5myeHsIeTjiI5310LBr385Oc5i5WyFaFB4aJq +gOKLxPSHblTq8WTPcwB =wr9V -----END PGP SIGNATURE-----
--- End Message ---
