Your message dated Sat, 29 Jun 2024 10:46:18 +0000 with message-id <e1snvb0-002bd7...@coccia.debian.org> and subject line Released with 12.6 has caused the Debian Bug report #1068451, regarding bookworm-pu: package libtommath/1.2.0-6+deb12u1 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 1068451: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068451 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: release.debian.org Severity: normal Tags: bookworm User: release.debian....@packages.debian.org Usertags: pu X-Debbugs-Cc: libtomm...@packages.debian.org Control: affects -1 + src:libtommath Addresses CVE-2023-36328, debdiff below. Acked by Dominique before. Cheers, Moritz diff -Nru libtommath-1.2.0/debian/changelog libtommath-1.2.0/debian/changelog --- libtommath-1.2.0/debian/changelog 2021-02-07 11:58:15.000000000 +0100 +++ libtommath-1.2.0/debian/changelog 2024-04-04 22:20:38.000000000 +0200 @@ -1,3 +1,9 @@ +libtommath (1.2.0-6+deb12u1) bookworm; urgency=medium + + * CVE-2023-36328 (Closes: #1051100) + + -- Moritz Mühlenhoff <j...@debian.org> Thu, 04 Apr 2024 22:20:38 +0200 + libtommath (1.2.0-6) unstable; urgency=medium [ Helmut Grohne ] diff -Nru libtommath-1.2.0/debian/patches/CVE-2023-36328.patch libtommath-1.2.0/debian/patches/CVE-2023-36328.patch --- libtommath-1.2.0/debian/patches/CVE-2023-36328.patch 1970-01-01 01:00:00.000000000 +0100 +++ libtommath-1.2.0/debian/patches/CVE-2023-36328.patch 2024-04-04 22:20:38.000000000 +0200 @@ -0,0 +1,121 @@ +From beba892bc0d4e4ded4d667ab1d2a94f4d75109a9 Mon Sep 17 00:00:00 2001 +From: czurnieden <czurnie...@gmx.de> +Date: Tue, 9 May 2023 17:17:12 +0200 +Subject: [PATCH] Fix possible integer overflow + +--- + bn_mp_2expt.c | 4 ++++ + bn_mp_grow.c | 4 ++++ + bn_mp_init_size.c | 5 +++++ + bn_mp_mul_2d.c | 4 ++++ + bn_s_mp_mul_digs.c | 4 ++++ + bn_s_mp_mul_digs_fast.c | 4 ++++ + bn_s_mp_mul_high_digs.c | 4 ++++ + bn_s_mp_mul_high_digs_fast.c | 4 ++++ + 8 files changed, 33 insertions(+) + +--- libtommath-1.2.0.orig/bn_mp_2expt.c ++++ libtommath-1.2.0/bn_mp_2expt.c +@@ -12,6 +12,10 @@ mp_err mp_2expt(mp_int *a, int b) + { + mp_err err; + ++ if (b < 0) { ++ return MP_VAL; ++ } ++ + /* zero a as per default */ + mp_zero(a); + +--- libtommath-1.2.0.orig/bn_mp_grow.c ++++ libtommath-1.2.0/bn_mp_grow.c +@@ -9,6 +9,10 @@ mp_err mp_grow(mp_int *a, int size) + int i; + mp_digit *tmp; + ++ if (size < 0) { ++ return MP_VAL; ++ } ++ + /* if the alloc size is smaller alloc more ram */ + if (a->alloc < size) { + /* reallocate the array a->dp +--- libtommath-1.2.0.orig/bn_mp_init_size.c ++++ libtommath-1.2.0/bn_mp_init_size.c +@@ -6,6 +6,11 @@ + /* init an mp_init for a given size */ + mp_err mp_init_size(mp_int *a, int size) + { ++ ++ if (size < 0) { ++ return MP_VAL; ++ } ++ + size = MP_MAX(MP_MIN_PREC, size); + + /* alloc mem */ +--- libtommath-1.2.0.orig/bn_mp_mul_2d.c ++++ libtommath-1.2.0/bn_mp_mul_2d.c +@@ -9,6 +9,10 @@ mp_err mp_mul_2d(const mp_int *a, int b, + mp_digit d; + mp_err err; + ++ if (b < 0) { ++ return MP_VAL; ++ } ++ + /* copy */ + if (a != c) { + if ((err = mp_copy(a, c)) != MP_OKAY) { +--- libtommath-1.2.0.orig/bn_s_mp_mul_digs.c ++++ libtommath-1.2.0/bn_s_mp_mul_digs.c +@@ -16,6 +16,10 @@ mp_err s_mp_mul_digs(const mp_int *a, co + mp_word r; + mp_digit tmpx, *tmpt, *tmpy; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* can we use the fast multiplier? */ + if ((digs < MP_WARRAY) && + (MP_MIN(a->used, b->used) < MP_MAXFAST)) { +--- libtommath-1.2.0.orig/bn_s_mp_mul_digs_fast.c ++++ libtommath-1.2.0/bn_s_mp_mul_digs_fast.c +@@ -26,6 +26,10 @@ mp_err s_mp_mul_digs_fast(const mp_int * + mp_digit W[MP_WARRAY]; + mp_word _W; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* grow the destination as required */ + if (c->alloc < digs) { + if ((err = mp_grow(c, digs)) != MP_OKAY) { +--- libtommath-1.2.0.orig/bn_s_mp_mul_high_digs.c ++++ libtommath-1.2.0/bn_s_mp_mul_high_digs.c +@@ -15,6 +15,10 @@ mp_err s_mp_mul_high_digs(const mp_int * + mp_word r; + mp_digit tmpx, *tmpt, *tmpy; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* can we use the fast multiplier? */ + if (MP_HAS(S_MP_MUL_HIGH_DIGS_FAST) + && ((a->used + b->used + 1) < MP_WARRAY) +--- libtommath-1.2.0.orig/bn_s_mp_mul_high_digs_fast.c ++++ libtommath-1.2.0/bn_s_mp_mul_high_digs_fast.c +@@ -19,6 +19,10 @@ mp_err s_mp_mul_high_digs_fast(const mp_ + mp_digit W[MP_WARRAY]; + mp_word _W; + ++ if (digs < 0) { ++ return MP_VAL; ++ } ++ + /* grow the destination as required */ + pa = a->used + b->used; + if (c->alloc < pa) { diff -Nru libtommath-1.2.0/debian/patches/series libtommath-1.2.0/debian/patches/series --- libtommath-1.2.0/debian/patches/series 2021-02-07 11:58:15.000000000 +0100 +++ libtommath-1.2.0/debian/patches/series 2024-04-04 22:20:38.000000000 +0200 @@ -2,3 +2,4 @@ remove-undefined-macro fix-shift-count-overflow-on-x32 use-utc-timezone +CVE-2023-36328.patch
--- End Message ---
--- Begin Message ---Version: 12.6 The upload requested in this bug has been released as part of 12.6.
--- End Message ---
