Your message dated Sat, 31 Dec 2016 04:33:29 +0000 with message-id <e1cnbmh-000hdt...@fasolo.debian.org> and subject line Bug#778412: fixed in nvi 1.81.6-13 has caused the Debian Bug report #778412, regarding nvi: CVE-2015-2305: Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 778412: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778412 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Package: nvi Severity: important Tags: security patch The security team received a report from the CERT Coordination Center that the Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability. It looks like this package includes the affected code at that's the reason of this bug report. The patch is available here: http://gitweb.dragonflybsd.org/dragonfly.git/blobdiff/4d133046c59a851141519d03553a70e903b3eefc..2841837793bd095a82f477e9c370cfe6cfb3862c:/lib/libc/regex/regcomp.c Please, can you confirm if the binary packages are affected? Are stable and testing affected? More information, here: http://www.kb.cert.org/vuls/id/695940 https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/ A CVE id has been requested already and the report will be updated with it eventually. Cheers, luciano
--- End Message ---
--- Begin Message ---Source: nvi Source-Version: 1.81.6-13 We believe that the bug you reported is fixed in the latest version of nvi, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 778...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Colin Watson <cjwat...@debian.org> (supplier of updated nvi package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sat, 31 Dec 2016 04:10:57 +0000 Source: nvi Binary: nvi nvi-doc Architecture: source Version: 1.81.6-13 Distribution: unstable Urgency: medium Maintainer: Debian QA Group <packa...@qa.debian.org> Changed-By: Colin Watson <cjwat...@debian.org> Description: nvi - 4.4BSD re-implementation of vi nvi-doc - 4.4BSD re-implementation of vi - documentation files Closes: 778412 794030 Changes: nvi (1.81.6-13) unstable; urgency=medium . * QA upload. * Build with all hardening options. * CVE-2015-2305: Apply heap overflow patch from Dragonfly BSD (closes: #778412). * Fix cross-build failure: pass --build and --host to configure (thanks, Helmut Grohne; closes: #794030). Checksums-Sha1: 5d34e13fc05d0faa6da9b8556feeac60bdcac7b0 1873 nvi_1.81.6-13.dsc cb451c0a77405ddfa20b978a89d9ad96fd6afcf8 76868 nvi_1.81.6-13.debian.tar.xz Checksums-Sha256: 4e2689c394c86ec41274e178d238eafeadefe444cf1f7156c0b7303889cc560d 1873 nvi_1.81.6-13.dsc 306c6059d386a161b9884535f0243134c8c9b5b15648e09e595fd1b349a7b9e1 76868 nvi_1.81.6-13.debian.tar.xz Files: 0f41f56e918e69b79cc0d7d5b9b1e2f6 1873 editors optional nvi_1.81.6-13.dsc 9c37ab5b5bd5470faab6edf0fe104fed 76868 editors optional nvi_1.81.6-13.debian.tar.xz -----BEGIN PGP SIGNATURE----- Comment: Colin Watson <cjwat...@debian.org> -- Debian developer iQIzBAEBCAAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAlhnMSYACgkQOTWH2X2G UAvyuhAAjZQy2UshRN8Zy3Fh8yjbPRZVOTstgyxcfiryocMf2V17XVdLwJmVMn3T dWTR3Shu7j3jr8OjXz13t1RgUKkZMvd5tkF2CUzYRY4heMs/wUvNo+hEmmAMaEVc mUzZm7LeHdOtnkAFdSt9eEESdHiubdHXotjIQUgJMvNRK7SLXhLdVEdQCbeQzAbO r+S9GdVaPR5axhJ4SDidIIK7J63Vp6BeKbCY/IgOjf7nPJyiWwA9SaUewNJWLDU7 O155U6G2aGhQ0aeFvrBZfMzlS5NNGGPsC+XyLnTwHw/SW2eHS+ScpnekoQWtfhSj tftZOYL6HhuNypIKoQSA4Tft0VLZUJ4Ql6XUO4MsrjRTIhCI84VnOLRPfSvaE6ER l+HScTSi2X3CHdCwzyqA2R+8tj0WyNgC0Xi8uQm31L0noFcCQWDnw55Sch5eb2K8 BxPoGduKkp/0z6brrLC2kFDKAubnDRYsu1ISXnFY8T7ivZOgNlhLY8/s01puKVmZ mcpscyzPodcJre3GeFMSqowPn+0q5MYjPiCB9ITZMxOVewhTpQz3n66PZRn/H/mX Tijn5j3MKOCpbvNmB0hUjG4+ZD8Ltmq0adRT3byUIW5ON0qjkiLJURDUjPitSQSd 55OuaF3ROKLk3gR4MsYCWPsPypCqRta9tQUZ9EAzZl8gyQpZMt0= =wi+N -----END PGP SIGNATURE-----
--- End Message ---
