diff -Nru sysstat-12.6.1/debian/changelog sysstat-12.6.1/debian/changelog --- sysstat-12.6.1/debian/changelog 2022-12-04 21:23:25.000000000 +0000 +++ sysstat-12.6.1/debian/changelog 2023-06-06 17:13:18.000000000 +0000 @@ -1,3 +1,12 @@ +sysstat (12.6.1-1ubuntu1) mantic; urgency=medium + + * SECURITY UPDATE: overflow in arithmetic multiplication + - debian/patches/CVE-2023-33204.patch: fix overflow check logic in + check_overflow() in common.c. + - CVE-2023-33204 + + -- Rodrigo Figueiredo Zaiden Tue, 06 Jun 2023 14:13:18 -0300 + sysstat (12.6.1-1) unstable; urgency=medium * New upstream stable version: fixes size_t overflow in sa_common.c diff -Nru sysstat-12.6.1/debian/control sysstat-12.6.1/debian/control --- sysstat-12.6.1/debian/control 2022-12-04 21:23:25.000000000 +0000 +++ sysstat-12.6.1/debian/control 2023-06-06 17:13:18.000000000 +0000 @@ -1,7 +1,8 @@ Source: sysstat Section: admin Priority: optional -Maintainer: Robert Luberda +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Robert Luberda Build-Depends: debhelper-compat (= 13), gettext, libsensors-dev, diff -Nru sysstat-12.6.1/debian/patches/CVE-2023-33204.patch sysstat-12.6.1/debian/patches/CVE-2023-33204.patch --- sysstat-12.6.1/debian/patches/CVE-2023-33204.patch 1970-01-01 00:00:00.000000000 +0000 +++ sysstat-12.6.1/debian/patches/CVE-2023-33204.patch 2023-06-06 17:13:18.000000000 +0000 @@ -0,0 +1,39 @@ +From 6f8dc568e6ab072bb8205b732f04e685bf9237c0 Mon Sep 17 00:00:00 2001 +From: Sebastien GODARD +Date: Wed, 17 May 2023 21:10:31 +0200 +Subject: [PATCH] Merge branch 'pkopylov-master' + +Signed-off-by: Sebastien GODARD +--- + common.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/common.c b/common.c +index 48493b5f..0efe7ee3 100644 +--- a/common.c ++++ b/common.c +@@ -431,15 +431,17 @@ int check_dir(char *dirname) + void check_overflow(unsigned int val1, unsigned int val2, + unsigned int val3) + { +- if ((unsigned long long) val1 * (unsigned long long) val2 * +- (unsigned long long) val3 > UINT_MAX) { ++ if ((val1 != 0) && (val2 != 0) && (val3 != 0) && ++ (((unsigned long long) UINT_MAX / (unsigned long long) val1 < ++ (unsigned long long) val2) || ++ ((unsigned long long) UINT_MAX / ((unsigned long long) val1 * (unsigned long long) val2) < ++ (unsigned long long) val3))) { + #ifdef DEBUG +- fprintf(stderr, "%s: Overflow detected (%llu). Aborting...\n", +- __FUNCTION__, (unsigned long long) val1 * (unsigned long long) val2 * +- (unsigned long long) val3); ++ fprintf(stderr, "%s: Overflow detected (%u,%u,%u). Aborting...\n", ++ __FUNCTION__, val1, val2, val3); + #endif +- exit(4); +- } ++ exit(4); ++ } + } + + #ifndef SOURCE_SADC diff -Nru sysstat-12.6.1/debian/patches/series sysstat-12.6.1/debian/patches/series --- sysstat-12.6.1/debian/patches/series 2022-12-04 21:23:25.000000000 +0000 +++ sysstat-12.6.1/debian/patches/series 2023-06-06 17:13:18.000000000 +0000 @@ -10,3 +10,4 @@ 13-irqstat-interpreter.patch 14-simtest-run-all.patch 15-sa2-bash.patch +CVE-2023-33204.patch