Your message dated Tue, 14 Feb 2023 19:01:39 +0200
with message-id <Y+u+c5pj4KkDJVOz@localhost>
and subject line Re: Bug#993376: gtkpod: CVE-2021-32732 - stack overflow in
embedded AtomicParsley code APar_read64
has caused the Debian Bug report #993376,
regarding gtkpod: CVE-2021-32732 - stack overflow in embedded AtomicParsley
code APar_read64
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
993376: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993376
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: gtkpod
Version: 2.1.5-6
Severity: important
Tags: security
https://github.com/wez/atomicparsley/issues/32
See also #993366
gtkpod embeds a vulnerable version of AtomicParsley which causes a stack
overflow,
however the data file used to test atomicparsley upstream is not recognised by
gtkpod.
Note that in #993366, the upstream fix for this CVE does not resolve the issue
as described when
the upstream fix is applied to atomicparsley, so more work may be needed here
to identify the
problem as it applies to the version of atomicparsley used by gtkpod.
>From a check of the embedded source code, the vulnerable code can be found at:
https://sources.debian.org/src/gtkpod/2.1.5-8/libs/atomic-parsley/AP_AtomExtracts.cpp/#L1325
--- End Message ---
--- Begin Message ---
On Tue, Aug 31, 2021 at 03:25:42PM +0100, Neil Williams wrote:
> Package: gtkpod
> Version: 2.1.5-6
> Severity: important
> Tags: security
>
> https://github.com/wez/atomicparsley/issues/32
>
> See also #993366
>
> gtkpod embeds a vulnerable version of AtomicParsley which causes a stack
> overflow,
> however the data file used to test atomicparsley upstream is not recognised
> by gtkpod.
>...
The version of AtomicParsley embedded in gtkpod is not vulnerable.
The overflow is in the code parsing 64-bit creation/modified times in
tkhd version 1, which is not supported by the version of AtomicParsley
in gtkpod.
cu
Adrian
--- End Message ---
