Debian Package Tracker

general

source: libpff (main)
version: 20180714-1
maintainer: Debian Security Tools (DMD)
uploaders: Pierre Chifflier [DMD]
arch: any
std-ver: 4.2.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 20120802-2
oldstable: 20120802-5
stable: 20180714-1
testing: 20180714-1
unstable: 20180714-1

versioned links

20120802-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20120802-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20180714-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libpff-dev
libpff1
pff-tools

action needed

Multiarch hinter reports 2 issue(s) normal

There are issues with the multiarch metadata for this package.

libpff-dev could be marked Multi-Arch: same
libpff1 could be marked Multi-Arch: same

Created: 2016-09-14 Last update: 2019-10-15 01:38

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 20180714-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit ae50f627c7ce5e210810debcb363a7b90c205de5
Author: Samuel Henrique <samueloph@debian.org>
Date:   Sat Oct 5 23:29:02 2019 +0100

    Add salsa-ci.yml

commit 9044468d259872d60462d737b5ddaec07fd1dfdd
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Jan 3 14:22:48 2019 +0300

    d/patches: mark 01-fix-spelling-binary.patch as forwarded

commit ddc9acbc82f0afa289afdb8bd39b133fe9fbc345
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Jan 3 04:05:03 2019 +0300

    d/rules: set buildsystem=autoconf explicitly, to avoid building python code

commit 54c15a7554b1ac798e0c82f6953544a7d43dd98c
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Jan 3 03:41:42 2019 +0300

    d/control: bump std-version to 4.3.0

commit 5ada547036c5e21849f04f0b0f19f6612853a5f6
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Jan 3 03:28:35 2019 +0300

    d/control: bump debhelper-compat to 12

commit 67789caef43f391743dd6cb1986095aea2d74f53
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Jan 3 03:14:54 2019 +0300

    manpage patches are forwarded

commit fdc5e2852db54a3cd02dcc8403ba5fdc25c2f863
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Jan 3 03:10:33 2019 +0300

    lintian override for the debian-watch-does-not-check-gpg-signature tag

commit 16a79ef7afab3603254f70da0fa73b9f7b089340
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Jan 3 02:23:37 2019 +0300

    d/watch: track libpff release tarballs instead of tags

commit bf03f45404c3b1aafc5e9001f8eb43c9e7e517f7
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Wed Jan 2 12:52:37 2019 +0300

    d/watch: track libpff github tags

commit bcb810a79f27ff16aee0c25d3ea4dfd9578e2364
Author: Samuel Henrique <samueloph@debian.org>
Date:   Tue Jan 1 23:56:23 2019 +0000

    d/changelog: fix BTS closes stanza

commit 16b7f7847c5a696ac72c933cf7386313cf553c68
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Mon Nov 12 01:23:43 2018 +0300

    override manpage-has-errors-from-man warning

commit 0eae2afdb646fb09299da9e4044137c01dcc4a32
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sat Nov 10 13:26:54 2018 +0300

    changelog: select unstable distro

commit 25f274f597545a5d162fc44dcd855d93d482f725
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sat Nov 10 13:25:16 2018 +0300

    changelog entry for changed Uploaders field

commit 251c839b9e8f65e96a586a1ca37bc14cb54cb5f6
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sat Nov 10 12:21:33 2018 +0300

    apply wrap-and-sort

commit e8c90d58f7b297923d2b5c5fa231eec6ced5b35f
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sat Nov 10 12:09:08 2018 +0300

    CVE-2018-11723 is fixed in libpff 20180714.
    
    The actual bug (buffer overflow) beneeth CVE-2018-11723 is fixed
    as Issue #64 https://github.com/libyal/libpff/issues/64 .
    The fix is included into libpff version 20180714.

commit 302d53a4a70a24f004d491d7e7a52f95a73100fa
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Nov 8 08:40:51 2018 +0300

    fix lintian and man warnings for the libpff.3 manpage

commit d9884fc7a33c9e77f3b45eb373aca3cca7bb0caf
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Nov 8 08:32:19 2018 +0300

    fix man warnings for two manpages

commit 58e8ab20bfda6e6424d12da16ca92897bedd53ca
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Nov 8 08:22:02 2018 +0300

    override spelling-error-in-binary lintian warning

commit a9b7a016ff6308310529d7e5fd96ffd3374e6661
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Nov 8 07:35:10 2018 +0300

    fix spelling errors in the pffexport binary

commit 20cf12dcc51ea06bed569335851afd1ad375ba31
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Wed Nov 7 02:34:26 2018 +0300

    fix building twice with debuild command

commit 45f133eb4bd275951da28f468427f0f212b71a41
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Wed Nov 7 02:18:03 2018 +0300

    fix build in a fresh jail

commit 0b277c066f7805a46966da25190a9ddd58a66b03
Author: Raphaël Hertzog <hertzog@debian.org>
Date:   Thu Nov 8 15:24:19 2018 +0100

    Drop Christophe Monniez from Uploaders
    
    He's no longer contributing to the team.

commit e857dbc0373eb3521f638b2cb5d5b6c00535bc33
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Mon Oct 29 03:00:15 2018 +0300

    update short description of pff-tools

commit 0774daaa6542389820c29b3abffa1a03ae5bc64d
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 17:57:55 2018 +0300

    clean up debian/rules

commit d5e8cb92f3429c17b3fa865f9af6407f80c8d8b8
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 13:10:56 2018 +0300

    clean up copyright file

commit fe2292d35c4f6c6a3237352e7fd5d453edc7030f
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 12:25:59 2018 +0300

    add metadata about upstream

commit af9dbe85985fa320da5ca9f01953fe3bf105508b
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 07:37:12 2018 +0300

    migrate to automatic debug package

commit 362b94fe9d93df7516d647099512065b1b14325e
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 07:20:13 2018 +0300

    remove deprecated dependency on dh-autoreconf

commit 52ae5e5772edddf6a333404baf8d65224d4d19e8
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 02:59:04 2018 +0300

    recreate libpff1.symbols, since ABI is broken

commit 880998561e3d56c49e928cbecc9f91548d445ef8
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 02:57:05 2018 +0300

    drop obsolete patches

commit 22de4d115ee58758df89806d2678c306f798d0e5
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sat Oct 27 11:53:46 2018 +0300

    changelog entry for v20180714

commit f3a5e098b94be49df80b03af160ec63b78968f70
Merge: 0d9f792 1a9ccaa
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 03:44:43 2018 +0300

    Update upstream source from tag 'upstream/20180714'
    
    Update to upstream version '20180714'
    with Debian dir 24ba0d899f3a3080ae9f0d9b8d5464438016094f

commit 1a9ccaa4a78b2e656400f33f9c58925ec465df9d
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Sun Oct 28 03:44:32 2018 +0300

    New upstream version 20180714

commit 0d9f792c150f050b8c47b7de484e55374b5edff9
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Oct 25 10:33:44 2018 +0300

    Switch copyright url to https

commit 7e1ece83dd8e1153c379717b77bf8cbb164b542b
Author: Aleksey Kravchenko <rhash.admin@gmail.com>
Date:   Thu Oct 25 10:01:31 2018 +0300

    Bump std-version and debhelper-compat level

Created: 2018-02-04 Last update: 2019-10-13 13:53

2 ignored security issues in jessie low

There are 2 open security issues in jessie.

2 issues skipped by the security teams:

CVE-2018-11723: ** DISPUTED ** The libpff_name_to_id_map_entry_read function in libpff_name_to_id_map.c in libyal libpff through 2018-04-28 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted pff file. NOTE: the vendor has disputed this as described in libyal/libpff issue 66 on GitHub.
CVE-2018-20348: libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c.

Please fix them.

Created: 2018-06-20 Last update: 2019-07-07 09:00

2 ignored security issues in stretch low

There are 2 open security issues in stretch.

2 issues skipped by the security teams:

CVE-2018-11723: ** DISPUTED ** The libpff_name_to_id_map_entry_read function in libpff_name_to_id_map.c in libyal libpff through 2018-04-28 allows remote attackers to cause an information disclosure (heap-based buffer over-read) via a crafted pff file. NOTE: the vendor has disputed this as described in libyal/libpff issue 66 on GitHub.
CVE-2018-20348: libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c.

Please fix them.

Created: 2018-06-20 Last update: 2019-07-07 09:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.1 instead of 4.2.1).

Created: 2018-02-04 Last update: 2019-09-29 23:39

news

[rss feed]

[2019-01-07] libpff 20180714-1 MIGRATED to testing (Debian testing watch)
[2019-01-02] Accepted libpff 20180714-1 (source) into unstable (Aleksey Kravchenko) (signed by: Samuel Henrique)
[2018-02-09] libpff 20120802-5.1 MIGRATED to testing (Debian testing watch)
[2018-02-04] Accepted libpff 20120802-5.1 (source) into unstable (Aurelien Jarno)
[2015-07-10] libpff 20120802-5 MIGRATED to testing (Britney)
[2015-07-05] Accepted libpff 20120802-5 (source amd64) into unstable (Joao Eriberto Mota Filho)
[2015-06-26] libpff 20120802-4 MIGRATED to testing (Britney)
[2015-06-18] Accepted libpff 20120802-4 (source amd64) into unstable (Joao Eriberto Mota Filho)
[2015-04-02] Accepted libpff 20120802-3 (source amd64) into experimental (Joao Eriberto Mota Filho)
[2014-09-02] libpff 20120802-2 MIGRATED to testing (Britney)
[2014-08-28] Accepted libpff 20120802-2 (source amd64) into unstable (Pierre Chifflier)
[2013-05-29] libpff 20120802-1 MIGRATED to testing (Debian testing watch)
[2013-05-18] Accepted libpff 20120802-1 (source amd64) (Pierre Chifflier)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 20180714-1