Ubuntu backported a fix for this hole to lesstif1. From their changelog:
* SECURITY UPDATE: More Xpm vulnerabilities. * lib/Xm-2.1/Xpmcreate.c, lib/Xm-2.1/Xpmscan.c: Applied patch from freedesktop.org to avoid integer overflows. * lib/Xm/LTXpm.c: Backported patch to old lesstif1. * References: CAN-2005-0605 https://bugs.freedesktop.org/show_bug.cgi?id=1920 https://bugzilla.ubuntulinux.org/show_bug.cgi?id=7210
I'm not going to try to islate the patch from their diff, as previous changes in their diff make that difficult:
* SECURITY UDPATE: Fix multiple Xpm vulnerabilities. * lib/Xm-2.1/Xpm.c: Split into several files (as upstream did for easier patching), applied fixes pulled from new upstream version. References: - CAN-2004-0914 - Ubuntu #6273 - Debian #294099 * Added CAN numbers to previous changelog.
* SECURITY: apply Xpm security fixes. (Closes: #1821) * CAN-2004-0687, CAN-2004-0688
Their diff is here:
http://security.ubuntu.com/ubuntu/pool/main/l/lesstif1-1/lesstif1-1_0.93.94-4ubuntu1.3.diff.gz
-- see shy jo
Ubuntu backported a fix for this hole to lesstif1. From their changelog:
* SECURITY UPDATE: More Xpm vulnerabilities. 2.1/Xpmcreate. c, lib/Xm- 2.1/Xpmscan. c: Applied patch from /bugs.freedeskt op.org/ show_bug. cgi?id= 1920 /bugzilla. ubuntulinux. org/show_ bug.cgi? id=7210
* lib/Xm-
freedesktop.org to avoid integer overflows.
* lib/Xm/LTXpm.c: Backported patch to old lesstif1.
* References:
CAN-2005-0605
https:/
https:/
I'm not going to try to islate the patch from their diff, as previous changes
in their diff make that difficult:
* SECURITY UDPATE: Fix multiple Xpm vulnerabilities.
* lib/Xm-2.1/Xpm.c: Split into several files (as upstream did for easier
patching), applied fixes pulled from new upstream version.
References:
- CAN-2004-0914
- Ubuntu #6273
- Debian #294099
* Added CAN numbers to previous changelog.
* SECURITY: apply Xpm security fixes. (Closes: #1821)
* CAN-2004-0687, CAN-2004-0688
Their diff is here:
http:// security. ubuntu. com/ubuntu/ pool/main/ l/lesstif1- 1/lesstif1- 1_0.93. 94-4ubuntu1. 3.diff. gz
--
see shy jo