[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[debian-users:42087] Re: [Translate] [SECURITY] [DSA 597-1] New cyrus-imapd packages fix arbitrary code execution
- From: Shinichiro HIDA <shinichiro@xxxxxxxxxxxxx>
- Subject: [debian-users:42087] Re: [Translate] [SECURITY] [DSA 597-1] New cyrus-imapd packages fix arbitrary code execution
- Date: Tue, 30 Nov 2004 23:01:22 +0900
- List-help: <mailto:debian-users-ctl@debian.or.jp?body=help>
- List-id: debian-users.debian.or.jp
- List-owner: <mailto:debian-users-admin@debian.or.jp>
- List-post: <mailto:debian-users@debian.or.jp>
- List-software: fml [fml 4.0.3 release (20011202/4.0.3)]
- List-unsubscribe: <mailto:debian-users-ctl@debian.or.jp?body=unsubscribe>
- Organization: Stained Glass
- X-authentication: shinichiro was authenticated by ps8.suite2.arena.ne.jp at 30 Nov 2004 23:01:20 +0900
- X-face: "+/#(k[%E{,A*R~]BQ;$}j4`A/l\!fGUsqWE]_Ss/CqBX091]WBCJVV<>gDweDL(-<hi=C< 6^"4wCZ:$lS>H=6@cZA1x|W2F"DUf,5t7M[R[g@Y5qFZ2;u=]d#
- X-gnupg-fingerprint: 5F2D 1656 FFF6 F691 A51C 5E61 E416 D398 470C 1CE9
- X-gnupg-public-key: http://stained-g.net/shinichiro/shinichiro-gpg.key
- X-gnupg-version: gpg (GnuPG) 1.2.4
- X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
- X-ml-name: debian-users
- X-mlserver: fml [fml 4.0.3 release (20011202/4.0.3)]; post only (only members can post)
- X-original-to: debian-users@debian.or.jp
- X-spam-level: *
- X-spam-status: No, hits=1.2 required=10.0 tests=IN_REP_TO,ISO2022JP_BODY,ISO2022JP_CHARSET,NOSPAM_INC, RCVD_IN_ORBS,RCVD_IN_OSIRUSOFT_COM,REFERENCES, SIGNATURE_SHORT_DENSE,SPAM_PHRASE_00_01,USER_AGENT, X_OSIRU_OPEN_RELAY version=2.44
- X-uri: http://stained-g.net/shinichiro/
- References: <p04320403bdcb9fc88064@xxxxxxxxxxxxx> <m1CXG1Y-000olKC@xxxxxxxxxxxxxxxxxxxxxxxxxxx> <87u0rd5lgc.wl%shinichiro@xxxxxxxxxxxxx>
- Message-id: <87pt1v5tcy.wl%shinichiro@xxxxxxxxxxxxx>
- X-mail-count: 42087
- User-agent: Wanderlust/2.11.30 (Wonderwall) SEMI/1.14.6 (Maruoka) FLIM/1.14.6 (Marutamachi) APEL/10.6 MULE XEmacs/21.4 (patch 15) (Security Through Obscurity) (i386-debian-linux)
飛田です。
cyrus21-imapd の 2.1.17-1 が取れるようになったようです。
>>>>> In [debian-users : No.42050]
>>>>> Shinichiro HIDA <shinichiro@xxxxxxxxxxxxx> wrote:
飛> 飛田です。
[...]
飛> 原文では、
>>>>> In <m1CXG1Y-000olKC@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
>>>>> joey@xxxxxxxxxxxx (Martin Schulze) wrote:
Martin> -----BEGIN PGP SIGNED MESSAGE-----
Martin> Hash: SHA1
Martin> - --------------------------------------------------------------------------
Martin> Debian Security Advisory DSA 597-1 security@debian.org
[...]
Martin> CVE ID : CAN-2004-1012 CAN-2004-1013
Martin> Debian Bug : 282681
^^^^^^^
Martin> For the unstable distribution (sid) these problems have been fixed in
Martin> version 2.1.17-1.
^^^^^^^^
飛> なので、原文は 2.1.17-1 になってます。
飛> でも今 apt-get で引いてみたら 2.1.16-11 が落ちてきたので、
飛> cyrus21-imapd (2.1.16-11) の changelog.Debian.gz をみてみると、
changelog> cyrus21-imapd (2.1.16-11) unstable; urgency=high
[...]
以下、cyrus21-imapd 2.1.17-1 の changelog.Debian.gz より、
cyrus21-imapd (2.1.17-1) unstable; urgency=high
* New upstream source
* SECURITY FIX:
Detect and avoid buffer overflow on SASL canonical processing
* SECURITY FIX (from Ubuntu, thanks to Martin Pitt
<martin.pitt@xxxxxxxxxxxxx>): fixed two incarnations of "flag[nflags++]
= xstrdup(...)"; the value of nflags within functions called by
xstrdup() is undefined and different gcc versions handle this
differently (closes: #282681)
という事だそうです。お騒がせしました。
--
Shinichiro HIDA mailto:shinichiro@xxxxxxxxxxxxx
GPG fingerprint = 5F2D 1656 FFF6 F691 A51C 5E61 E416 D398 470C 1CE9