Debian Package Tracker

general

source: libcroco (main)
version: 0.6.12-2
maintainer: Debian GNOME Maintainers (archive) [DMD]
uploaders: Josselin Mouette [DMD] – Jeremy Bicha [DMD] – Emilio Pozuelo Monfort [DMD] – Michael Biebl [DMD]
arch: any
std-ver: 4.1.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.6.6-2
o-o-sec: 0.6.6-2+deb7u1
oldstable: 0.6.8-3
stable: 0.6.11-3
testing: 0.6.12-2
unstable: 0.6.12-2

versioned links

0.6.6-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.6-2+deb7u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.8-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.11-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.6.12-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libcroco-tools
libcroco3
libcroco3-dev

action needed

lintian reports 6 warnings high

Lintian reports 6 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2015-03-07 Last update: 2018-09-09 06:34

2 security issues in buster high

There are 2 open security issues in buster.

2 important issues:

CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.
CVE-2017-8834: The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Please fix them.

Created: 2017-06-18 Last update: 2018-06-02 08:03

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.
CVE-2017-8834: The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Please fix them.

Created: 2017-06-12 Last update: 2018-06-02 08:03

2 new commits since last upload, time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 0.6.12-3, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 09718bdfad309438165d394acfdf25eb205b5ee5
Author: Jeremy Bicha <jbicha@ubuntu.com>
Date:   Sat Jan 20 16:26:56 2018 -0500

    Bump debhelper compat to 11

commit ae2cd45544a87ca9fae16775462a07582494c878
Author: Jeremy Bicha <jbicha@ubuntu.com>
Date:   Sat Jan 20 16:26:07 2018 -0500

    Update Vcs fields for migration to https://salsa.debian.org/

The Vcs URL is using anonscm.debian.org. Please update it for the move to salsa.debian.org.

Created: 2018-01-22 Last update: 2018-11-19 15:31

2 ignored security issues in stretch low

There are 2 open security issues in stretch.

2 issues skipped by the security teams:

CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.
CVE-2017-8834: The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Please fix them.

Created: 2017-06-12 Last update: 2018-06-02 08:03

4 ignored security issues in jessie low

There are 4 open security issues in jessie.

4 issues skipped by the security teams:

CVE-2017-7961: ** DISPUTED ** The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco 0.6.11 and 0.6.12 has an "outside the range of representable values of type long" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CSS file. NOTE: third-party analysis reports "This is not a security issue in my view. The conversion surely is truncating the double into a long value, but there is no impact as the value is one of the RGB components."
CVE-2017-8871: The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file.
CVE-2017-7960: The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file.
CVE-2017-8834: The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file.

Please fix them.

Created: 2017-04-20 Last update: 2018-06-02 08:03

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.2.1 instead of 4.1.2).

Created: 2018-04-16 Last update: 2018-08-26 08:16

news

[rss feed]

[2017-12-22] libcroco 0.6.12-2 MIGRATED to testing (Debian testing watch)
[2017-12-16] Accepted libcroco 0.6.12-2 (source) into unstable (Jeremy Bicha)
[2017-07-07] libcroco 0.6.12-1 MIGRATED to testing (Debian testing watch)
[2017-07-02] Accepted libcroco 0.6.12-1 (source) into unstable (Andreas Henriksson)
[2017-04-30] libcroco 0.6.11-3 MIGRATED to testing (Debian testing watch)
[2017-04-23] Accepted libcroco 0.6.11-3 (source) into unstable (Emilio Pozuelo Monfort)
[2017-04-23] Accepted libcroco 0.6.6-2+deb7u1 (source amd64) into oldstable (Emilio Pozuelo Monfort)
[2016-09-27] libcroco 0.6.11-2 MIGRATED to testing (Debian testing watch)
[2016-09-21] Accepted libcroco 0.6.11-2 (source) into unstable (Michael Biebl)
[2015-12-24] libcroco 0.6.11-1 MIGRATED to testing (Debian testing watch)
[2015-12-18] Accepted libcroco 0.6.11-1 (source) into unstable (Michael Biebl)
[2015-12-15] Accepted libcroco 0.6.10-1 (source) into unstable (Michael Biebl)
[2015-11-15] libcroco 0.6.9-1 MIGRATED to testing (Britney)
[2015-11-09] Accepted libcroco 0.6.9-1 (source) into unstable (Michael Biebl)
[2014-08-23] libcroco 0.6.8-3 MIGRATED to testing (Britney)
[2014-08-17] Accepted libcroco 0.6.8-3 (source amd64) into unstable (Andreas Henriksson)
[2013-05-28] libcroco 0.6.8-2 MIGRATED to testing (Debian testing watch)
[2013-05-17] Accepted libcroco 0.6.8-2 (source amd64) (Michael Biebl)
[2012-12-07] libcroco 0.6.6-2 MIGRATED to testing (Debian testing watch)
[2012-11-26] Accepted libcroco 0.6.6-2 (source amd64) (Josselin Mouette)
[2012-11-09] Accepted libcroco 0.6.8-1 (source amd64) (Simon McVittie)
[2012-10-10] libcroco 0.6.6-1 MIGRATED to testing (Debian testing watch)
[2012-09-29] Accepted libcroco 0.6.6-1 (source amd64) (Josselin Mouette)
[2012-04-06] libcroco 0.6.5-1 MIGRATED to testing (Debian testing watch)
[2012-03-26] Accepted libcroco 0.6.5-1 (source amd64) (Michael Biebl)
[2012-02-20] libcroco 0.6.4-2 MIGRATED to testing (Debian testing watch)
[2012-02-10] Accepted libcroco 0.6.4-2 (source amd64) (Michael Biebl)
[2012-02-08] Accepted libcroco 0.6.4-1 (source amd64) (Martin Pitt)
[2011-11-03] libcroco 0.6.2-2 MIGRATED to testing (Debian testing watch)
[2011-10-24] Accepted libcroco 0.6.2-2 (source i386) (Michael Biebl)

bugs [bug history graph]

all: 5
RC: 0
I&N: 5
M&W: 0
F&P: 0
patch: 0

links

lintian (0, 6)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.6.12-2
1 bug