Debian Bug report logs - #308819
openmotif: affected by vulnerabilities in libxpm

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Matej Vela <vela@debian.org>

To: submit@bugs.debian.org

Subject: openmotif: affected by vulnerabilities in libxpm

Date: Thu, 12 May 2005 17:12:46 +0200

Package: openmotif
Version: 2.1.30-5, 2.2.3-1
Severity: grave
Tags: security

OpenMotif includes an outdated copy of the Xpm library with a number of
vulnerabilities: CAN-2004-0687, CAN-2004-0688, CAN-2004-0914, and
CAN-2005-0605.

(Note that the patches supplied by X.Org contain several regressions
(#286164, #308783).  Hopefully, Debian's xfree86 package will have a
definitive patch soon.)

Thanks,

Matej

Message #10 received at 308819@bugs.debian.org (full text, mbox, reply):

From: Frank Lichtenheld <djpig@debian.org>

To: Matej Vela <vela@debian.org>, 308819@bugs.debian.org

Subject: Re: Bug#308819: openmotif: affected by vulnerabilities in libxpm

Date: Mon, 16 May 2005 01:31:00 +0200

[Message part 1 (text/plain, inline)]

On Thu, May 12, 2005 at 05:12:46PM +0200, Matej Vela wrote:
> OpenMotif includes an outdated copy of the Xpm library with a number of
> vulnerabilities: CAN-2004-0687, CAN-2004-0688, CAN-2004-0914, and
> CAN-2005-0605.

I investigated this a bit and it seems that upstream only has made
fixes available for the first two CANs yet. For reference I attached
the output of a cvs diff between 2.2.3 and 2.2.4 of the affected files
(AFAICT)

Gruesse,
-- 
Frank Lichtenheld <djpig@debian.org>
www: http://www.djpig.de/

[xpmvuln.openmotif.patch (text/plain, attachment)]

Message #15 received at 308819@bugs.debian.org (full text, mbox, reply):

From: Kenshi Muto <kmuto@debian.org>

To: 308819-submitter@bugs.debian.org, 308819@bugs.debian.org

Cc: control@bugs.debian.org

Subject: openmotif: affected by vulnerabilities in libxpm

Date: Sun, 29 May 2005 14:38:38 +0900

[Message part 1 (text/plain, inline)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

tags + patch
thanks

Hi,

> > OpenMotif includes an outdated copy of the Xpm library with a number of
> > vulnerabilities: CAN-2004-0687, CAN-2004-0688, CAN-2004-0914, and
> > CAN-2005-0605.
> I investigated this a bit and it seems that upstream only has made
> fixes available for the first two CANs yet. For reference I attached
> the output of a cvs diff between 2.2.3 and 2.2.4 of the affected files
> (AFAICT)

I created a patch for missing two piece and modified djpig's patch to
suit Debian package.

All of them are taken from XFree86 CVS diff.
For test, ida and mwm looks still work correctly (although mwm misses
system.mwmrc by incorrect original rules).

Thanks,
- -- 
Kenshi Muto
kmuto@debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8 <http://mailcrypt.sourceforge.net/>

iEYEARECAAYFAkKZVT8ACgkQQKW+7XLQPLEXOwCg2AdJv3l9HC8lyUmeUH6qvh7E
xgMAoKxc5s5GoiTF97KQLihpvxDCs+br
=6F/p
-----END PGP SIGNATURE-----

[xpm.patch.tar.gz (application/octet-stream, attachment)]

Message #25 received at 308819@bugs.debian.org (full text, mbox, reply):

From: Kenshi Muto <kmuto@debian.org>

To: 308819@bugs.debian.org

Subject: Re: openmotif: affected by vulnerabilities in libxpm

Date: Mon, 30 May 2005 16:25:29 +0900

[Message part 1 (text/plain, inline)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Here is final patch, taken from Debian xfree86 svn repository.

Thanks,
- -- 
Kenshi Muto
kmuto@debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8 <http://mailcrypt.sourceforge.net/>

iEYEARECAAYFAkKav8wACgkQQKW+7XLQPLEt/wCgodskl96XyQb+mU2LIyRHssgp
7X4An0Bzk+E9OOZhvG575h1DaI7T51fz
=uUbm
-----END PGP SIGNATURE-----

[xpmvuln.openmotif.patch.gz (application/octet-stream, attachment)]

Message #32 received at 308819@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: 308819@bugs.debian.org

Subject: Re: openmotif: affected by vulnerabilities in libxpm

Date: Mon, 6 Jun 2005 04:16:45 -0700

[Message part 1 (text/plain, inline)]

tags 308819 = patch security woody sarge etch
thanks

Although an NMU was uploaded for this bug, because openmotif is in non-free
there were no autobuilds for the package and so it was not updated in time
for release.  This bug still exists in sarge and etch, and possibly in woody
as well.

-- 
Steve Langasek
postmodern programmer

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.