diff -u libnet-dns-perl-0.57/debian/changelog libnet-dns-perl-0.57/debian/changelog --- libnet-dns-perl-0.57/debian/changelog +++ libnet-dns-perl-0.57/debian/changelog @@ -1,3 +1,17 @@ +libnet-dns-perl (0.57-1ubuntu1.1) edgy-security; urgency=low + + * SECURITY UPDATE: + + debian/patches/42_CVE-2007-6341.dpatch (LP: #201454) + - used in packages such as SpamAssassin and OTRS, allows remote + attackers to cause a denial of service (program "croak") via a + crafted DNS response. + + * References + + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6341 + + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=457445 + + -- Emanuele Gentili Sun, 23 Mar 2008 23:36:14 +0100 + libnet-dns-perl (0.57-1ubuntu1) edgy-security; urgency=low [ Scott Kitterman ] diff -u libnet-dns-perl-0.57/debian/patches/00list libnet-dns-perl-0.57/debian/patches/00list --- libnet-dns-perl-0.57/debian/patches/00list +++ libnet-dns-perl-0.57/debian/patches/00list @@ -4,0 +5 @@ +52_CVE-2007-6341.dpatch only in patch2: unchanged: --- libnet-dns-perl-0.57.orig/debian/patches/52_CVE-2007-6341.dpatch +++ libnet-dns-perl-0.57/debian/patches/52_CVE-2007-6341.dpatch @@ -0,0 +1,19 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 52_CVE-2007-6341.dpatch by Emanuele Gentili +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +@DPATCH@ +diff -urNad libnet-dns-perl-0.57~/lib/Net/DNS/RR/A.pm libnet-dns-perl-0.57/lib/Net/DNS/RR/A.pm +--- libnet-dns-perl-0.57~/lib/Net/DNS/RR/A.pm 2006-02-24 13:52:58.000000000 +0100 ++++ libnet-dns-perl-0.57/lib/Net/DNS/RR/A.pm 2008-03-23 23:36:02.000000000 +0100 +@@ -18,7 +18,7 @@ + sub new { + my ($class, $self, $data, $offset) = @_; + +- if ($self->{"rdlength"} > 0) { ++ if ($self->{"rdlength"} >= 4) { + $self->{"address"} = inet_ntoa(substr($$data, $offset, 4)); + } +