diff -Nru sysstat-12.2.0/debian/changelog sysstat-12.2.0/debian/changelog --- sysstat-12.2.0/debian/changelog 2022-11-25 17:57:50.000000000 +0000 +++ sysstat-12.2.0/debian/changelog 2023-06-05 14:19:10.000000000 +0000 @@ -1,3 +1,12 @@ +sysstat (12.2.0-2ubuntu0.3) focal-security; urgency=medium + + * SECURITY UPDATE: overflow in arithmetic multiplication + - debian/patches/CVE-2023-33204.patch: fix overflow check logic in + check_overflow() in common.c. + - CVE-2023-33204 + + -- Rodrigo Figueiredo Zaiden Mon, 05 Jun 2023 11:19:10 -0300 + sysstat (12.2.0-2ubuntu0.2) focal-security; urgency=medium * SECURITY UPDATE: overflow in arithmetic multiplication diff -Nru sysstat-12.2.0/debian/patches/CVE-2023-33204.patch sysstat-12.2.0/debian/patches/CVE-2023-33204.patch --- sysstat-12.2.0/debian/patches/CVE-2023-33204.patch 1970-01-01 00:00:00.000000000 +0000 +++ sysstat-12.2.0/debian/patches/CVE-2023-33204.patch 2023-06-05 14:19:03.000000000 +0000 @@ -0,0 +1,37 @@ +From 6f8dc568e6ab072bb8205b732f04e685bf9237c0 Mon Sep 17 00:00:00 2001 +From: Sebastien GODARD +Date: Wed, 17 May 2023 21:10:31 +0200 +Subject: [PATCH] Merge branch 'pkopylov-master' + +Signed-off-by: Sebastien GODARD +--- + common.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- sysstat-12.2.0.orig/common.c ++++ sysstat-12.2.0/common.c +@@ -422,15 +422,17 @@ int get_wwnid_from_pretty(char *pretty, + void check_overflow(unsigned int val1, unsigned int val2, + unsigned int val3) + { +- if ((unsigned long long) val1 * (unsigned long long) val2 * +- (unsigned long long) val3 > UINT_MAX) { ++ if ((val1 != 0) && (val2 != 0) && (val3 != 0) && ++ (((unsigned long long) UINT_MAX / (unsigned long long) val1 < ++ (unsigned long long) val2) || ++ ((unsigned long long) UINT_MAX / ((unsigned long long) val1 * (unsigned long long) val2) < ++ (unsigned long long) val3))) { + #ifdef DEBUG +- fprintf(stderr, "%s: Overflow detected (%llu). Aborting...\n", +- __FUNCTION__, (unsigned long long) val1 * (unsigned long long) val2 * +- (unsigned long long) val3); ++ fprintf(stderr, "%s: Overflow detected (%u,%u,%u). Aborting...\n", ++ __FUNCTION__, val1, val2, val3); + #endif +- exit(4); +- } ++ exit(4); ++ } + } + + #ifndef SOURCE_SADC diff -Nru sysstat-12.2.0/debian/patches/series sysstat-12.2.0/debian/patches/series --- sysstat-12.2.0/debian/patches/series 2022-11-25 17:57:24.000000000 +0000 +++ sysstat-12.2.0/debian/patches/series 2023-06-05 14:18:56.000000000 +0000 @@ -12,3 +12,4 @@ CVE-2022-39377-1.patch CVE-2022-39377-2.patch CVE-2022-39377-3.patch +CVE-2023-33204.patch