Bug#573562: libvorbis: additional CVE-2009-3379 security fixes

[Marc Deslauriers]

Package: libvorbis
Version: 1.2.3-3
Severity: normal
Tags: patch
User: ubuntu-devel at lists.ubuntu.com
Usertags: origin-ubuntu lucid ubuntu-patch



*** /tmp/tmpCr9xKy
In Ubuntu, we've applied the attached patch to achieve the following:

  * SECURITY UPDATE: denial of service and possible code execution via
    multiple vulnerabilities
    - debian/patches/CVE-2009-3379.patch: add a couple of missing commits:
      eliminate blocklist overflow in lib/backends.h, don't allow codeword
      lengths longer than 32 bits in lib/codebook.c.
    - CVE-2009-3379
  * debian/rules, debian/control: add quilt patch system

Our fix for CVE-2009-3379 included these two commits that were not included
in the 1.2.3 release.

We thought you might be interested in doing the same. 


-- System Information:
Debian Release: squeeze/sid
  APT prefers lucid-updates
  APT policy: (500, 'lucid-updates'), (500, 'lucid-security'), (500, 'lucid')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-16-generic (SMP w/2 CPU cores)
Locale: LANG=en_CA.utf8, LC_CTYPE=en_CA.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
-------------- next part --------------
A non-text attachment was scrubbed...
Name: tmps_wOmq
Type: text/x-diff
Size: 3003 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-xiph-maint/attachments/20100312/a6c0f780/attachment.diff>