From bounce-debian-bugs-dist==chris-lamb.co.uk@lists.debian.org Sun Apr 20 20:25:29 2008
Received: from liszt.debian.org ([82.195.75.100])
	by chris-lamb.co.uk with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32)
	(Exim 4.63)
	(envelope-from <bounce-debian-bugs-dist==chris-lamb.co.uk@lists.debian.org>)
	id 1JnfA3-0000gD-Is
	for bot.address@chris-lamb.co.uk; Sun, 20 Apr 2008 20:25:29 +0100
Received: from localhost (localhost [127.0.0.1])
	by liszt.debian.org (Postfix) with QMQP
	id A64FE13A5238; Sun, 20 Apr 2008 19:25:13 +0000 (UTC)
Old-Return-Path: <debbugs@rietz.debian.org>
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on liszt.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-2.0 required=4.0 tests=BAYES_00,IMPRONONCABLE_2,
	RCVD_IN_DNSWL_LOW autolearn=no version=3.2.3
X-Original-To: debian-bugs-dist@lists.debian.org
Delivered-To: lists-debian-bugs-dist@liszt.debian.org
Received: from rietz.debian.org (rietz.debian.org [140.211.166.43])
	by liszt.debian.org (Postfix) with ESMTP id 1315813A522E;
	Sun, 20 Apr 2008 19:25:02 +0000 (UTC)
Received: from debbugs by rietz.debian.org with local (Exim 4.63)
	(envelope-from <debbugs@rietz.debian.org>)
	id 1Jnf8t-0002WO-EO; Sun, 20 Apr 2008 19:24:03 +0000
X-Loop: owner@bugs.debian.org
Subject: Bug#454792: double free and segfault on utf8 containing regexes
Reply-To: Niko Tyni <ntyni@debian.org>, 454792@bugs.debian.org
Resent-From: Niko Tyni <ntyni@debian.org>
Resent-To: debian-bugs-dist@lists.debian.org
Resent-CC: Brendan O'Dea <bod@debian.org>
Resent-Date: Sun, 20 Apr 2008 19:24:02 +0000
Resent-Message-ID: <handler.454792.B454792.120871912427682@bugs.debian.org>
X-Debian-PR-Message: followup 454792
X-Debian-PR-Package: perl
X-Debian-PR-Keywords: etch security patch
X-Debian-PR-Source: perl
Received: via spool by 454792-submit@bugs.debian.org id=B454792.120871912427682
          (code B ref 454792); Sun, 20 Apr 2008 19:24:02 +0000
Received: (at 454792) by bugs.debian.org; 20 Apr 2008 19:18:44 +0000
X-Amavis-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00,FORGED_RCVD_HELO,
	FROMDEVELOPER,HAS_BUG_NUMBER,IMPRONONCABLE_2,VALID_BTS_CONTROL 
	autolearn=no version=3.1.4-bugs.debian.org_2005_01_02
Received: from emh03.mail.saunalahti.fi ([62.142.5.109])
	by rietz.debian.org with esmtp (Exim 4.63)
	(envelope-from <ntyni@cc.helsinki.fi>)
	id 1Jnf3Q-0005R3-2C; Sun, 20 Apr 2008 19:18:24 +0000
Received: from saunalahti-vams (vs3-11.mail.saunalahti.fi [62.142.5.95])
	by emh03-2.mail.saunalahti.fi (Postfix) with SMTP id 08142ECD34;
	Sun, 20 Apr 2008 22:18:23 +0300 (EEST)
Received: from emh01.mail.saunalahti.fi ([62.142.5.107])
	by vs3-11.mail.saunalahti.fi ([62.142.5.95])
	with SMTP (gateway) id A0485603A3F; Sun, 20 Apr 2008 22:18:23 +0300
Received: from rebekka.invalid (a88-112-25-193.elisa-laajakaista.fi [88.112.25.193])
	by emh01.mail.saunalahti.fi (Postfix) with ESMTP id BCC074BB67;
	Sun, 20 Apr 2008 22:18:18 +0300 (EEST)
Received: from niko by rebekka.invalid with local (Exim 4.63)
	(envelope-from <ntyni@cc.helsinki.fi>)
	id 1Jnf3K-0001hI-MJ; Sun, 20 Apr 2008 22:18:18 +0300
Date: Sun, 20 Apr 2008 22:18:18 +0300
From: Niko Tyni <ntyni@debian.org>
To: Don Armstrong <don@debian.org>, 454792@bugs.debian.org
Cc: team@security.debian.org
Message-ID: <20080420191818.GA6434@rebekka>
References: <20071207220325.GB3694@rzlab.ucr.edu> <20080406191013.GA6494@rebekka> <20080407184626.GA17712@rebekka>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20080407184626.GA17712@rebekka>
User-Agent: Mutt/1.5.13 (2006-08-11)
X-Antivirus: VAMS
Resent-Date: Sun, 20 Apr 2008 19:24:03 +0000
X-Debian-Message: from BTS
X-Rc-Virus: 2007-09-13_01
X-Rc-Spam: 2007-10-04_01
X-Mailing-List: <debian-bugs-dist@lists.debian.org> archive/latest/343744
X-Loop: debian-bugs-dist@lists.debian.org
List-Id: <debian-bugs-dist.lists.debian.org>
List-Post: <mailto:debian-bugs-dist@lists.debian.org>
List-Help: <mailto:debian-bugs-dist-request@lists.debian.org?subject=help>
List-Subscribe: <mailto:debian-bugs-dist-request@lists.debian.org?subject=subscribe>
List-Unsubscribe: <mailto:debian-bugs-dist-request@lists.debian.org?subject=unsubscribe>
Precedence: list
Resent-Sender: debian-bugs-dist-request@lists.debian.org
Received-SPF: none
X-SPF-Guess: pass
X-Spam-Score: -33.5
X-Spam-Report: (-33.5 points, 5.0 required)
	pts rule name              description
	---- ---------------------- --------------------------------------------------
	-50 D_FOR_BOT              For debian-devel-changes bot
	0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
	0.0 UNPARSEABLE_RELAY      Informational: message has unparseable relay lines
	-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
	[score: 0.0000]
	19 AWL                    AWL: From: address is in the auto white-list

severity 454792 important
tag 454792 - security
thanks

On Mon, Apr 07, 2008 at 09:46:26PM +0300, Niko Tyni wrote:
> > On Fri, Dec 07, 2007 at 02:03:25PM -0800, Don Armstrong wrote:
> > > Package: perl
> > > Severity: serious
> > > Version: 5.8.8-7etch1
> > > Tags: security
> > > 
> > > A trivial program containing a regex with UTF8 characters causes a
> > > double free error and segfault:
> > 
> > > *** glibc detected *** debugperl: double free or corruption (!prev): 0x081e20e0 ***

> > > I've set the severity to serious and tagged with security as there is
> > > (apparently) a possibility that this could result in execution of
> > > arbitrary code. [I don't have any proof of concept for this or a CVE
> > > though, so feel free to detag and lower severity.]
> 
> I'm unsure about the security implications. Will ask for opinions on p5p.
> Cc'ing the security team to get them in the loop.

No response from either in two weeks, so it seems that nobody is
particularly concerned. Detagging and lowering the severity as suggested.
If anybody disagrees, please speak up and undo the control part.

Cheers,
-- 
Niko Tyni   ntyni@debian.org



-- 
To UNSUBSCRIBE, email to debian-bugs-dist-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org


