From mboxrd@z Thu Jan  1 00:00:00 1970
From: marit@secmail.pro
Subject: bug#36909: CVE-2017-837{2,3,4} patches for libmad from Debian
Date: Sat, 3 Aug 2019 05:12:24 -0700
Message-ID: <30c0beda6f616bb829c4590ee4367f7c.squirrel@giyzk7o6dcunb2ry.onion>
Mime-Version: 1.0
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: quoted-printable
Return-path: <help-debbugs-bounces+gcgd-help-debbugs=m.gmane.org@gnu.org>
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
Resent-Message-ID: <handler.36909.B.156484546328867@debbugs.gnu.org>
Received: from eggs.gnu.org ([2001:470:142:3::10]:53567)
 by lists.gnu.org with esmtp (Exim 4.86_2)
 (envelope-from <marit@secmail.pro>) id 1htsu9-0003YW-Ae
 for bug-guix@gnu.org; Sat, 03 Aug 2019 08:12:58 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <marit@secmail.pro>) id 1htsu8-000891-DV
 for bug-guix@gnu.org; Sat, 03 Aug 2019 08:12:57 -0400
Received: from secmail.pro ([146.185.132.44]:57214)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <marit@secmail.pro>) id 1htsu8-000887-86
 for bug-guix@gnu.org; Sat, 03 Aug 2019 08:12:56 -0400
Received: from secmailw453j7piv.onion (localhost [IPv6:::1])
 by secmail.pro (Postfix) with ESMTP id 0FBC9F239E
 for <bug-guix@gnu.org>; Sat,  3 Aug 2019 05:12:24 -0700 (PDT)
List-Unsubscribe: <https://lists.gnu.org/mailman/options/help-debbugs>,
 <mailto:help-debbugs-request@gnu.org?subject=unsubscribe>
List-Archive: <https://lists.gnu.org/archive/html/help-debbugs>
List-Post: <mailto:help-debbugs@gnu.org>
List-Help: <mailto:help-debbugs-request@gnu.org?subject=help>
List-Subscribe: <https://lists.gnu.org/mailman/listinfo/help-debbugs>,
 <mailto:help-debbugs-request@gnu.org?subject=subscribe>
Errors-To: help-debbugs-bounces+gcgd-help-debbugs=m.gmane.org@gnu.org
Sender: "help-debbugs"
 <help-debbugs-bounces+gcgd-help-debbugs=m.gmane.org@gnu.org>
To: bug-guix@gnu.org
List-Id: bug-guix.gnu.org

Package: libmad
Version: 0.15.1b
Tags: security
Severity: important

Hello!
I think that package "libmad" should be updated to include fixes for the
following vulnerabilities:
https://security-tracker.debian.org/tracker/CVE-2017-8372,
https://security-tracker.debian.org/tracker/CVE-2017-8373,
https://security-tracker.debian.org/tracker/CVE-2017-8374.
This can be done by applying md_size.diff from Debian and replacing
libmad-frame-length.patch with length-check.diff from Debian.