Ubuntu
openmotif package

CVE-2005-3964: Two exploitable buffer overflows in openmotif

Bug #29398 reported by Yann Rouillard
258
Affects Status Importance Assigned to Milestone
openmotif (Ubuntu)
Fix Released
High
Daniel T Chen

Bug Description

From debian bug 342092:

Two exploitable buffer overflows have been found in OpenMotif. Please
see http://marc.theaimsgroup.com/?l=full-disclosure&m=113349242925897&w=2
for details. This has been assigned CVE-2005-3964, please mention it in
the changelog when fixing it.

Cheers,
        Moritz

CVE References

Yann Rouillard (yann-pleiades)
Changed in openmotif:
assignee: nobody → motu
Revision history for this message
Gary Coady (garycoady) wrote :

The vulnerable code still appears to be in the package.

Changed in openmotif:
status: Unconfirmed → Confirmed
Daniel T Chen (crimsun)
Changed in openmotif:
assignee: motu → crimsun
Revision history for this message
Daniel T Chen (crimsun) wrote :

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 19 May 2006 11:57:58 -0400
Source: openmotif
Binary: libmotif-dev libmotif3 motif-clients
Architecture: source
Version: 2.2.3-1.2ubuntu2
Distribution: dapper
Urgency: low
Maintainer: Gerd Knorr <email address hidden>
Changed-By: Daniel T Chen <email address hidden>
Description:
 libmotif-dev - Open Motif - development files
 libmotif3 - Open Motif - shared libraries
 motif-clients - Open Motif - X11 clients (mwm, xmbind)
Changes:
 openmotif (2.2.3-1.2ubuntu2) dapper; urgency=low
 .
   * [SECURITY]
     - Add patches/CVE-2005-3964.patch: Fix buffer overflows in libUil,
       taken from upstream cvs. Closes: Malone #29398.
     - References:
       CVE-2005-3964
       http://bugs.debian.org/342092
Files:
 846786d908aaab56b351428f3d23f802 726 non-free/devel extra openmotif_2.2.3-1.2ubuntu2.dsc
 c931d1da0f17f8a01d01decb45a74c63 19298 non-free/devel extra openmotif_2.2.3-1.2ubuntu2.diff.gz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEbesie9GwFciKvaMRAjybAJ9t37stRlqrLCxvUtbUd7yEExmJMgCdH8Wm
IDh9aJ6KncOjbOpnxfrl/+o=
=GF+R
-----END PGP SIGNATURE-----

Changed in openmotif:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.