Debian Bug report logs - #601521
irssi-plugin-silc vulnerable to CVE-2010-1156

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Silvio Cesare <silvio.cesare@gmail.com>

To: submit@bugs.debian.org

Subject: irssi-plugin-silc vulnerable to CVE-2010-1156

Date: Wed, 27 Oct 2010 10:58:43 +1100

[Message part 1 (text/plain, inline)]

Package: irssi-plugin-silc
Version: 1.1.4-1+lenny
Severity: important
Tags: security

silc-client embeds irssi. irssi has this known vulnerability
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1156. I have
confirmed that the following patch has not been applied
http://svn.irssi.org/cgi-bin/viewvc.cgi/irssi/trunk/src/core/nicklist.c?root=irssi&r1=4922&r2=5126
.

[Message part 2 (text/html, inline)]

Message #10 received at 601521-close@bugs.debian.org (full text, mbox, reply):

From: Jérémy Bobbio <lunar@debian.org>

To: 601521-close@bugs.debian.org

Subject: Re: [Pkg-silc-devel] Bug#601521: irssi-plugin-silc vulnerable to CVE-2010-1156

Date: Thu, 28 Oct 2010 18:49:38 +0200

[Message part 1 (text/plain, inline)]

Version: 1.1.7-1

> silc-client embeds irssi. irssi has this known vulnerability
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1156. I have
> confirmed that the following patch has not been applied
> http://svn.irssi.org/cgi-bin/viewvc.cgi/irssi/trunk/src/core/nicklist.c?root=irssi&r1=4922&r2=5126
> .

The embedded code copy is not used anymore since version 1.1.7-1.
Quoting debian/changelog:

  * Since Debian Policy 3.8.0, embedded code copy are officially not
    allowed in Debian anymore.  As it was a minor fork of irssi, the
    silc package providing the official SILC client has been
    discontinued.
  * Use a custom build system for the irssi plugin.  We now
    Build-Depends on irssi-dev instead of relying on irssi embedded code
    copy.  (Closes: #448186, #522080)
  * Remove extra symlinks for irssi plugin.  (Closes: #476177)
  * Ship the silc package as a transitional package which depends
    on irssi and irssi-plugin-silc and contains a NEWS file.

Lenny ships version 1.1.7-2 and Etch is unsupported at this time.
Nothing to act on, hence closing this bug.

Cheers,
-- 
Jérémy Bobbio                        .''`. 
jeremy.bobbio@irq7.fr               : :   :             lunar@debian.org
                                    `. `'` 
                                      `-

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.