Your message dated Sat, 06 Nov 2021 19:32:22 +0000 with message-id <e1mjrqm-0004ux...@fasolo.debian.org> and subject line Bug#992973: fixed in plib 1.8.5-8+deb10u1 has caused the Debian Bug report #992973, regarding plib: CVE-2021-38714 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 992973: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992973 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: plib Version: 1.8.5-8 Severity: grave Tags: security upstream Justification: user security hole Forwarded: https://sourceforge.net/p/plib/bugs/55/ X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Hi, The following vulnerability was published for plib. CVE-2021-38714[0]: | In Plib through 1.85, there is an integer overflow vulnerability that | could result in arbitrary code execution. The vulnerability is found | in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file. The severity of the this bug is set op purpose higher as it is probably warranted. There is the following reason for that: plib is orphaned in Debian for a while, it is obsoleted and unmaintained upstream as well. Ideally it get's removed from Debian from the next release, but thee would be some revers dependencies issues to be solved, making it imposssible for now to remove the package: | Checking reverse dependencies... | # Broken Depends: | crrcsim: crrcsim [amd64 arm64 armhf i386 mips64el mipsel ppc64el s390x] | flightgear: flightgear | openuniverse: openuniverse | stormbaancoureur: stormbaancoureur | torcs: torcs | | # Broken Build-Depends: | crrcsim: libplib-dev | flightgear: libplib-dev | torcs: libplib-dev | | Dependency problem found. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-38714 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38714 [1] https://sourceforge.net/p/plib/bugs/55/ Regards, Salvatore
--- End Message ---
--- Begin Message ---Source: plib Source-Version: 1.8.5-8+deb10u1 Done: Anton Gladky <gl...@debian.org> We believe that the bug you reported is fixed in the latest version of plib, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 992...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Anton Gladky <gl...@debian.org> (supplier of updated plib package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 17 Oct 2021 14:56:13 +0200 Source: plib Architecture: source Version: 1.8.5-8+deb10u1 Distribution: buster Urgency: medium Maintainer: Debian QA Group <packa...@qa.debian.org> Changed-By: Anton Gladky <gl...@debian.org> Closes: 992973 Changes: plib (1.8.5-8+deb10u1) buster; urgency=medium . * Prevent integer overflow in ssgLoadTGA() function. CVE-2021-38714 (Closes: #992973) Checksums-Sha1: ad89f666cb479e05049f7dc29aadfbb5de52d3d3 2009 plib_1.8.5-8+deb10u1.dsc c2cf7e3e1e58f7b63dae4bb21e4fa82c3e4d4cfc 779133 plib_1.8.5.orig.tar.gz 404b0fcb0fe7baa1b9153c688648cd9ee63e4552 11392 plib_1.8.5-8+deb10u1.debian.tar.xz 71635ac173ab2097e9c5879ceefd00330e2302fc 8297 plib_1.8.5-8+deb10u1_source.buildinfo Checksums-Sha256: 36ca02c4ede8fbf8c42a3d9b957cb29080acb4db76dd00cf4cf2123092f8c3bb 2009 plib_1.8.5-8+deb10u1.dsc 485b22bf6fdc0da067e34ead5e26f002b76326f6371e2ae006415dea6a380a32 779133 plib_1.8.5.orig.tar.gz c6c89fda43270ddd4dff1a7a4510fe3c91ef7b82a7f55ca80a198c8f882382cd 11392 plib_1.8.5-8+deb10u1.debian.tar.xz 084aef954ef296373fa62a431d61811a9b0748d3044360fcf010319c230b73d0 8297 plib_1.8.5-8+deb10u1_source.buildinfo Files: b10f61b9cafb3f36df74705acd284402 2009 devel extra plib_1.8.5-8+deb10u1.dsc 47a6fbf63668c1eed631024038b2ea90 779133 devel extra plib_1.8.5.orig.tar.gz 6c16bd3d10233ff478c8df5999e91e24 11392 devel extra plib_1.8.5-8+deb10u1.debian.tar.xz 0874ed3408018f706118ea4e71868952 8297 devel extra plib_1.8.5-8+deb10u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmFsIBAACgkQ0+Fzg8+n /wbotQ/+PNW/WJuVANbDKMRInV0kYS3eMJ+Uyz0Y1j43geTjjzwnkw4c0wr6VR93 zfh9K6HhvBY+c0EDhIIJvwBZJAwuUvB9jkk0qmvdccy6BJ7V3bNNJIyOYAm+I+3T f4BhbfnRjGBeXmjAZ70i4pnb7b7R9qx64DjWmp2wrAs6CSKzIV/EFQUii/DN2MY8 RPaLCh5MDelt2sdzscRWZAPoH30zttESjr5wBmdyHMFQsXg277OWChdVti02uX6M 8KkaxLj3QSZGd2GKsSKTSVoXg2Mo0HvXTUNXFvqaz4nkdXu/kPxHK5VTKY7y42fW 1FZ/j51Wk+SHGK8oG9htQpQf7GtNiRf2Lq9asIH6uM8c5+7WWQxLCZDCuIyWcCkx O+ktD0LVw28fiZ4DQav+RDonHKSbQVJaAPEKYO47zazJVgzN3Bb/0bw07ze1WCF/ D75G0v6MXxrYyZpS107BxpNDg4wQbXOaBqyhc87k/R+aKhf39oWxOY4JxSCBz0tB JoC7qDr3OY7ZScRvztxmqItHgXHgz/s8T7VaJccM75a00ImijtT7VereOT5RdktE ku4uhqWFzTLE45HdmMLk0fRtvnn9iJOnYQY5JXVJkO+TwHcOubvbL/C1C+SAKbyp i2GilN2rR/Cl2vll3vyDTYaTNUieTAmyDDwVyiyJ+yjppf52aF0= =NaH9 -----END PGP SIGNATURE-----
--- End Message ---
