[Security] devil - Fix buffer overflows

[Brian Thomason]

Fix buffer overflows in the iGetHdrHeader() function that allow arbitrary code execution via a crafted Radiance RGBE file

[Brian Thomason (brian-thomason)]

Forgot to run update-maintainer

[Marc Deslauriers (mdeslaur)]

Devil on hardy, jaunty and karmic is also vulnerable to CVE-2009-3994. Could you please update the debdiff with a fix for that CVE also, and then re-subscribe ubuntu-security-sponsors?

Thanks.

[Brian Thomason (brian-thomason)]

Hi Marc,

It appears that 1.6.x does not actually contain this vulnerability as the affected file doesn't even exist in that codebase. it appears that functionality was introduced in 1.7.x.

[Marc Deslauriers (mdeslaur)]

Oh, sorry about that. ACK to the debdiff. Packages for hardy are building now and will be released soon.

Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package devil - 1.6.7-5.1ubuntu0.1

---------------
devil (1.6.7-5.1ubuntu0.1) hardy-security; urgency=low

  * SECURITY UPDATE: Fix buffer overflows (LP: #603689)
  - modified src-IL/src/il_hd .c: Fix buffer overflows in the iGetHdrHeader()
    function that allow arbitrary code execution via a crafted Radiance RGBE
    file.
    Patch provided by Debian in Etch. (DSA-1717-1, DTSA-184-1)
  - CVE-2008-5262
 -- Brian Thomason <email address hidden> Fri, 09 Jul 2010 13:32:14 -0400

[Kees Cook (kees)]

Jaunty seems vulnerable to this issue. I don't understand the comments above regarding hardy. It was uploaded, so it was vulnerable, yes? And the patch labeled "Karmic patch" is for hardy again? It looks like Karmic was fixed upstream.

[Kees Cook (kees)]

Oh, NM, jaunty is fine. It was fixed already by Debian.

[Brian Thomason (brian-thomason)]

I have no clue why I posted that "karmic" patch... (it was just the hardy patch that has already gone through) I have removed it so as to not confuse anyone else.

Correct, Jaunty and Karmic are fine.