Your message dated Sat, 31 Aug 2019 23:17:12 +0000
with message-id <[email protected]>
and subject line Bug#932755: fixed in sdl-image1.2 1.2.12-10+deb10u1
has caused the Debian Bug report #932755,
regarding sdl-image1.2: multiple security issues
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
932755: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=932755
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: sdl-image1.2
Version: 1.2.12-10
Severity: important
Tags: security upstream
Hi,
the following security issues[0] were published for sdl-image1.2:
* CVE-2019-5052: integer overflow and subsequent buffer overflow in IMG_pcx.c.
* CVE-2019-5051: heap-based buffer overflow in IMG_pcx.c.
* CVE-2019-7635: heap buffer overflow in Blit1to4 (IMG_bmp.c).
* CVE-2019-12216, CVE-2019-12217,
CVE-2019-12218, CVE-2019-12219,
CVE-2019-12220, CVE-2019-12221,
CVE-2019-12222: OOB R/W in IMG_LoadPCX_RW (IMG_pcx.c).
Fixing these issues:
Patches are quite straightforward and I believe that some of these
issues are worth fixing (reporter claims that they are "exploitable").
I have prepared and uploaded a jessie LTS update addressing most of these
issues (all of them apart from CVE-2019-5051) via targeted fixes.
If the security team agrees, I will provide targeted fixes for buster and
stretch.
For testing, I suggest to package the latest upstream release. If needed, I
can provide an update with targeted fixes.
regards,
Hugo
[0] https://security-tracker.debian.org/tracker/source-package/sdl-image1.2
--
Hugo Lefeuvre (hle) | www.owl.eu.com
RSA4096_ 360B 03B3 BF27 4F4D 7A3F D5E8 14AA 1EB8 A247 3DFD
ed25519_ 37B2 6D38 0B25 B8A2 6B9F 3A65 A36F 5357 5F2D DC4C
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: sdl-image1.2
Source-Version: 1.2.12-10+deb10u1
We believe that the bug you reported is fixed in the latest version of
sdl-image1.2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Hugo Lefeuvre <[email protected]> (supplier of updated sdl-image1.2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 29 Aug 2019 08:51:05 -0400
Source: sdl-image1.2
Binary: libsdl-image1.2 libsdl-image1.2-dbgsym libsdl-image1.2-dev
Architecture: source amd64
Version: 1.2.12-10+deb10u1
Distribution: buster
Urgency: medium
Maintainer: Debian SDL packages maintainers
<[email protected]>
Changed-By: Hugo Lefeuvre <[email protected]>
Description:
libsdl-image1.2 - Image loading library for Simple DirectMedia Layer 1.2,
libraries
libsdl-image1.2-dev - Image loading library for Simple DirectMedia Layer 1.2,
developme
Closes: 932755
Changes:
sdl-image1.2 (1.2.12-10+deb10u1) buster; urgency=medium
.
* Non-maintainer upload.
* CVE-2019-5058: Fix CVE-2018-3977.patch from previous upload: check should
be done for y, not ty (Closes: #932755).
* CVE-2019-5052: integer overflow and subsequent buffer overflow in
IMG_pcx.c.
* CVE-2019-7635: heap buffer overflow in Blit1to4 (IMG_bmp.c).
* CVE-2019-12216, CVE-2019-12217,
CVE-2019-12218, CVE-2019-12219,
CVE-2019-12220, CVE-2019-12221,
CVE-2019-12222, CVE-2019-5051: OOB R/W in IMG_LoadPCX_RW (IMG_pcx.c).
Checksums-Sha1:
65bc03a273f47ddc8cadbdfbb875d6be0268ae10 2088
sdl-image1.2_1.2.12-10+deb10u1.dsc
3953a97a7415bd790543a07886007cde75552b2f 12428
sdl-image1.2_1.2.12-10+deb10u1.debian.tar.xz
9237070e972c7a422b9ce1897bbf4be8206e05ef 80204
libsdl-image1.2-dbgsym_1.2.12-10+deb10u1_amd64.deb
73f29f239d8fec1f340bb3ddfb87601ff144f79c 41056
libsdl-image1.2-dev_1.2.12-10+deb10u1_amd64.deb
02e5150e37b1b66fa5b7930b628ed480b15e593a 36656
libsdl-image1.2_1.2.12-10+deb10u1_amd64.deb
ec7c4fa8b52d99ae1ba285c44206e55468c75324 10276
sdl-image1.2_1.2.12-10+deb10u1_amd64.buildinfo
Checksums-Sha256:
9d1fd020ddddad00f4633f0ae5438a765dacb689150e6f37342dca16898534e5 2088
sdl-image1.2_1.2.12-10+deb10u1.dsc
1fc9b2d97ff7e0710272ba79a2fb02064b55a23dac12b93c1b35e24c937d552b 12428
sdl-image1.2_1.2.12-10+deb10u1.debian.tar.xz
ed03b522791995bd176181673d5e51917f961e28cdf04576eed422afa2362985 80204
libsdl-image1.2-dbgsym_1.2.12-10+deb10u1_amd64.deb
ec868d5ce00d9944d1609a0810c7e82d35b59f91a46f54f68f7d776d95102ef8 41056
libsdl-image1.2-dev_1.2.12-10+deb10u1_amd64.deb
457ba6b01414377804a534a47798829c2e94224ae0022ae4bf84e7da59021978 36656
libsdl-image1.2_1.2.12-10+deb10u1_amd64.deb
9132e6ba0ca80acc9b25589e9506464c92c75e5d41f9b9a34cd4d9651441ffd7 10276
sdl-image1.2_1.2.12-10+deb10u1_amd64.buildinfo
Files:
2146c582125716c8439fbd0e972548fb 2088 libs optional
sdl-image1.2_1.2.12-10+deb10u1.dsc
41ac24f978dfcbd395619a830318e80e 12428 libs optional
sdl-image1.2_1.2.12-10+deb10u1.debian.tar.xz
360299b039becb9f5740d03042cbaf03 80204 debug optional
libsdl-image1.2-dbgsym_1.2.12-10+deb10u1_amd64.deb
9e4131778bba917df57879d0166e1890 41056 libdevel optional
libsdl-image1.2-dev_1.2.12-10+deb10u1_amd64.deb
390f9de74dfe2d1909b8321a5835ae89 36656 libs optional
libsdl-image1.2_1.2.12-10+deb10u1_amd64.deb
10bcbe1f0f0b6e6eacea113d1986fa6f 10276 libs optional
sdl-image1.2_1.2.12-10+deb10u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQHDBAEBCgAtFiEEeDb9QWtkMa2LX4zREeMFjl5EGkIFAl1qbc0PHGhsZUBkZWJp
YW4ub3JnAAoJEBHjBY5eRBpCQ9AL/iF/PHcfRzBSZ9IXxeyfHyCPO1pxMCdfPlFm
C/N4ojeS9bD0i/N5Tr8vrDjrPDmz6rIFI7ZL7M6gszxWhXUMOQiaZzpz7yJqkxMD
W/U4f4Wtn0W6MNauurIK6L6QuQvDCwis3GuT/gHF0yjxnuNBzi1wa6yLFuTKwJ0K
+gqSV/ZJodMmq5JBn0/9AQk5mgJM6rRD5WgF5JD08VaRrWrWW+zjXNkk/6ARorkD
ILfePvBHw5/FbW/QZk0EFwXGLcdNr7F4Q+n/2V7V+Hbb8T/CaV/mVw+/ksgBMq4X
JEUssOGh8cJKIJj/Hn9mW2JaDHDmHYRtNopWZ16AxZrhfiZT/nuSQrV87NRj+5YZ
A100trZ5gSbUsjk+v10vctkjaWbaMpzJs+19IalwmvE8BvalC34csU5wNU8dt7G/
FyWHmQiiNq7x/REwd4J8jyZyor/1M+XeHLr+PSgRfjfnpNZ25XY1XY28Vy+2py+Z
rzoPerAdHm91JCnIWXsXqkWu3DHuQQ==
=9NTv
-----END PGP SIGNATURE-----
--- End Message ---
