Security vulnerabilities in heirloom-mailx 12.5-2 affecting trusty and utopic

[Timo]

The package heirloom-mailx 12.5-2 currently found in Ubuntu Trusty and Utopic is vulnerable to CVE-2004-2771 and CVE-2014-7844. See debian bug #773417 for details.
Fixes are already included in version 12.5-3 and higher, but only released for Ubuntu Vivid so far.

Please update the packages for Trusty and Utopic as well to fix those vulnerabilites.

Links attached:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773417
https://security-tracker.debian.org/tracker/CVE-2004-2771
https://security-tracker.debian.org/tracker/CVE-2014-7844

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Timo (timo-1)]

Sorry, I'm an absolute novice when it comes to packaging. But I can attach the patches by Florian Weimer/Red Hat that solve the vulnerabilities. The patchset is based on version 12.5-2 (found in trusty & utopic).

Does that help?

[Timo (timo-1)]

Btw. The same set of patches has already been applied in Debian Wheezy & Jessie as well as Ubuntu Vivid Vervet.

[Timo (timo-1)]

Package heirloom-mailx in vivic already contains the patches that fix the vulnerabilities.

[Rolf Leggewie (r0lf)]

utopic has seen the end of its life and is no longer receiving any updates. Marking the utopic task for this ticket as "Won't Fix".

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release