[Pkg-virtualbox-commits] [SCM] virtualbox Debian packaging branch, master, updated. debian/4.1.18-dfsg-2

[Felix Geyer]

The following commit has been merged in the master branch:
commit ac8603aee0c2239385bdd2183fd253c2dc67650c
Author: Felix Geyer <fgeyer at debian.org>
Date:   Sat Jan 19 22:53:38 2013 +0100

    Include patch to fix virtual graphics device user vulnerability CVE-2013-0420.
    
    Closes: #698292

diff --git a/debian/changelog b/debian/changelog
index e15a5ef..66f5d6a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+virtualbox (4.1.18-dfsg-2) unstable; urgency=high
+
+  [ John Paul Adrian Glaubitz ]
+  * Include patch to fix virtual graphics device user
+    vulnerability CVE-2013-0420. (Closes: #698292)
+
+ -- Felix Geyer <debfx-pkg at fobos.de>  Sat, 19 Jan 2013 18:05:25 +0100
+
 virtualbox (4.1.18-dfsg-1.1) unstable; urgency=high
 
   * Non-maintainer upload.
diff --git a/debian/patches/CVE-2013-0420.patch b/debian/patches/CVE-2013-0420.patch
new file mode 100644
index 0000000..e301734
--- /dev/null
+++ b/debian/patches/CVE-2013-0420.patch
@@ -0,0 +1,15 @@
+Description: DevVGA: Do not draw more lines than necessary.
+Origin: upstream, https://www.virtualbox.org/changeset/44055/vbox
+Bug-Debian: http://bugs.debian.org/698292
+
+--- virtualbox-4.1.18-dfsg.orig/src/VBox/Devices/Graphics/DevVGA.cpp
++++ virtualbox-4.1.18-dfsg/src/VBox/Devices/Graphics/DevVGA.cpp
+@@ -1795,7 +1795,7 @@ static int vga_draw_text(VGAState *s, in
+     cx_max_upd = -1;
+     cx_min_upd = width;
+ 
+-    for(cy = 0; cy < height; cy = cy + (1 << dscan)) {
++    for(cy = 0; cy < (height - dscan); cy = cy + (1 << dscan)) {
+         d1 = dest;
+         src = s1;
+         cx_min = width;
diff --git a/debian/patches/series b/debian/patches/series
index 33a14a3..640b328 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -15,3 +15,4 @@
 35-libvdeplug-soname.patch
 36-fix-ftbfs-xserver-112.patch
 cve-2012-3221.patch
+CVE-2013-0420.patch

-- 
virtualbox Debian packaging