Debian Bug report logs - #377047
slapd: Vulnerable to CVE-2006-2754 (buffer overflow)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <mpitt@debian.org>

To: Debian BTS Submit <submit@bugs.debian.org>

Subject: slapd: Vulnerable to CVE-2006-2754 (buffer overflow)

Date: Thu, 6 Jul 2006 13:05:15 +0200

[Message part 1 (text/plain, inline)]

Package: slapd
Version: 2.2.26-5
Severity: important
Tags: security patch

Hi!

There is a buffer overflow in st.c. Please see

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2754

for links to more detailled descriptions and a pointer to the upstream
CVS patch.

Please mention the CVE number in the changelog when you fix this.

Thank you!

Martin
-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

In a world without walls and fences, who needs Windows and Gates?

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 377047@bugs.debian.org (full text, mbox, reply):

From: Torsten Landschoff <torsten@debian.org>

To: Martin Pitt <mpitt@debian.org>, 377047@bugs.debian.org

Subject: Re: [Pkg-openldap-devel] Bug#377047: slapd: Vulnerable to CVE-2006-2754 (buffer overflow)

Date: Sat, 8 Jul 2006 17:42:23 +0200

[Message part 1 (text/plain, inline)]

Hi Martin, 

On Thu, Jul 06, 2006 at 01:05:15PM +0200, Martin Pitt wrote:
 
> There is a buffer overflow in st.c. Please see
> 
>   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2754
> 
> for links to more detailled descriptions and a pointer to the upstream
> CVS patch.
> 
> Please mention the CVE number in the changelog when you fix this.

How is the current procedure for security uploads (RTFM pointer is good
enough)? We can surely provide an updated package for sarge but I fear 
duplicated work with the security team. 

@Matthijs: I can build an updated sarge package by tomorrow I think, any
objections?

Greetings

	Torsten

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 377047@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <mpitt@debian.org>

To: Torsten Landschoff <torsten@debian.org>

Cc: 377047@bugs.debian.org

Subject: Re: [Pkg-openldap-devel] Bug#377047: slapd: Vulnerable to CVE-2006-2754 (buffer overflow)

Date: Sun, 9 Jul 2006 15:51:37 +0200

[Message part 1 (text/plain, inline)]

Hi Torsten,

Torsten Landschoff [2006-07-08 17:42 +0200]:
> > There is a buffer overflow in st.c. Please see
> > 
> >   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2754
> > 
> > for links to more detailled descriptions and a pointer to the upstream
> > CVS patch.
> > 
> > Please mention the CVE number in the changelog when you fix this.
> 
> How is the current procedure for security uploads (RTFM pointer is good
> enough)? We can surely provide an updated package for sarge but I fear 
> duplicated work with the security team. 

Normally the security team is glad to get security updates prepared by
the maintainers. Please just mail security@d.o. with a short
description and the CVE number and tell them that you will prepare an
update. Then follow up with a source package and they will you give ok
to upload or discuss changes with you.

http://www.de.debian.org/doc/developers-reference/ch-pkgs.en.html#s-bug-security
has some more details.

Thanks,

Martin

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

In a world without walls and fences, who needs Windows and Gates?

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.