Debdiff to fix CVE-2007-1263 in feisty and edgy

Bug #90864 reported by Michael Bienia
4
Affects Status Importance Assigned to Milestone
gpgme1.0 (Ubuntu)
Fix Released
Medium
Kees Cook
Breezy
Invalid
Low
Unassigned
Dapper
Fix Released
Medium
Kees Cook
Edgy
Fix Released
Medium
Kees Cook
Feisty
Fix Released
Medium
Kees Cook

Bug Description

gpgme1.0 (1.1.2-2ubuntu1) feisty; urgency=low

  * SECURITY UPDATE: detect and bail out on double plaintext messages
  * debian/patches/20_CVE-2007-1263.dpatch: upstream patch.
  * References:
    ftp://ftp.gnupg.org/gcrypt/gpgme/patches/gpgme-1.1.3-multiple-message.patch
    CVE-2007-1263
  * debian/control: Change Maintainer/XSBC-Original-Maintainer field.

 -- Michael Bienia <email address hidden> Fri, 9 Mar 2007 16:23:36 +0100

CVE References

Revision history for this message
Michael Bienia (geser) wrote :
Revision history for this message
Michael Bienia (geser) wrote :
Revision history for this message
Kees Cook (kees) wrote :

Thanks for getting this put together! I'm building them now and they should be published shortly...

Changed in gpgme1.0:
assignee: nobody → keescook
importance: Undecided → Medium
status: Unconfirmed → In Progress
assignee: nobody → keescook
status: Unconfirmed → In Progress
importance: Undecided → Medium
assignee: nobody → keescook
importance: Undecided → Medium
status: Unconfirmed → Confirmed
assignee: nobody → keescook
importance: Undecided → Medium
status: Unconfirmed → Confirmed
Kees Cook (kees)
Changed in gpgme1.0:
status: In Progress → Fix Released
Revision history for this message
Kees Cook (kees) wrote :

Breezy's gpgme1.0 doesn't even parse plaintext notifications, and will be EOL'ing in a month.

Changed in gpgme1.0:
importance: Medium → Wishlist
status: In Progress → Fix Committed
importance: Wishlist → Low
assignee: keescook → nobody
status: Confirmed → Fix Committed
Kees Cook (kees)
Changed in gpgme1.0:
status: Fix Committed → Fix Released
status: Fix Committed → Fix Released
Revision history for this message
Kees Cook (kees) wrote :

Fixes released as USN-432-2:

http://www.ubuntu.com/usn/usn-432-2

Revision history for this message
Marco Rodrigues (gothicx) wrote :

Breezy support is over.. Today it's Breezy End Of Life!

Changed in gpgme1.0:
status: Confirmed → Rejected
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.