diff -Nru konversation-1.6/debian/changelog konversation-1.6/debian/changelog --- konversation-1.6/debian/changelog 2015-04-08 07:55:31.000000000 +0000 +++ konversation-1.6/debian/changelog 2017-11-21 22:22:28.000000000 +0000 @@ -1,3 +1,12 @@ +konversation (1.6-0ubuntu1.1) xenial-security; urgency=high + + * SECURITY UPDATE: Crash in IRC message parsing (LP: #1731797): + - CVE-2017-15923.patch: ensure integer overflow has not happened + - CVE-2017-15923 + - https://www.kde.org/info/security/advisory-20171112-1.txt + + -- Simon Quigley Tue, 21 Nov 2017 14:21:46 -0800 + konversation (1.6-0ubuntu1) vivid; urgency=medium * New upstream release. 1.6 final. diff -Nru konversation-1.6/debian/control konversation-1.6/debian/control --- konversation-1.6/debian/control 2015-04-08 07:55:31.000000000 +0000 +++ konversation-1.6/debian/control 2017-11-21 22:22:33.000000000 +0000 @@ -1,7 +1,8 @@ Source: konversation Section: net Priority: optional -Maintainer: Debian/Kubuntu Qt/KDE Team +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Debian/Kubuntu Qt/KDE Team Uploaders: Modestas Vainius , Diane Trout Build-Depends: cmake (>= 2.6.2), debhelper (>= 9), diff -Nru konversation-1.6/debian/patches/CVE-2017-15923.patch konversation-1.6/debian/patches/CVE-2017-15923.patch --- konversation-1.6/debian/patches/CVE-2017-15923.patch 1970-01-01 00:00:00.000000000 +0000 +++ konversation-1.6/debian/patches/CVE-2017-15923.patch 2017-11-21 22:20:44.000000000 +0000 @@ -0,0 +1,31 @@ +Description: Stay within bounds + This patch fixes CVE-2017-15923. +Author: Eli MacKenzie +Origin: upstream +Bug: https://www.kde.org/info/security/advisory-20171112-1.txt +Bug-Ubuntu: https://bugs.launchpad.net/bugs/1731797 +Applied-Upstream: cebf8d7658b0e3afb0292c273704ec4d2ea4019f +Reviewed-by: Eike Hein +Last-Update: 2017-11-12 +--- a/src/viewer/ircview.cpp ++++ b/src/viewer/ircview.cpp +@@ -1595,7 +1595,8 @@ QString IRCView::closeToTagString(TextHt + } + + // reopen relevant tags +- ret += openTags(data, i); ++ if (i > -1) ++ ret += openTags(data, i); + + return ret; + } +@@ -1603,7 +1604,8 @@ QString IRCView::closeToTagString(TextHt + QString IRCView::openTags(TextHtmlData* data, int from) + { + QString ret, tag; +- int i = from; ++ int i = from > -1 ? from : 0; ++ + for ( ; i < data->openHtmlTags.count(); ++i) + { + tag = data->openHtmlTags.at(i); diff -Nru konversation-1.6/debian/patches/series konversation-1.6/debian/patches/series --- konversation-1.6/debian/patches/series 2015-04-08 07:55:31.000000000 +0000 +++ konversation-1.6/debian/patches/series 2017-11-21 22:20:44.000000000 +0000 @@ -1 +1,2 @@ kubuntu_default-channels.diff +CVE-2017-15923.patch