New ethereal packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 613-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 21st, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : ethereal
Vulnerability : infinite loop
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-1142
Brian Caswell discovered that an improperly formatted SMB packet could make ethereal hang and eat CPU endlessly.
For the stable distribution (woody) this problem has been fixed in version 0.9.4-1woody9.
For the unstable distribution (sid) this problem has been fixed in version 0.10.8-1.
We recommend that you upgrade your ethereal packages.
New a2ps packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 612-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 20th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : a2ps
Vulnerability : unsanitised input
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-1170
BugTraq ID : 11025
Debian Bug : 283134
Rudolf Polzer discovered a vulnerability in a2ps, a converter and pretty-printer for many formats to PostScript. The program did not escape shell meta characters properly which could lead to the execution of arbitrary commands as a privileged user if a2ps is installed as a printer filter.
For the stable distribution (woody) this problem has been fixed in version 4.13b-16woody1
For the unstable distribution (sid) this problem has been fixed in version 4.13b-4.2.
We recommend that you upgrade your a2ps package.
Upgrade Instructions
---------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
---------------------------------
Source archives:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1.dsc
Size/MD5 checksum: 725 dadf3ab28283daaf34edeb7c69a52646
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1.diff.gz
Size/MD5 checksum: 71239 61c84f71f4dcd123910d12264ba1f743
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b.orig.tar.gz
Size/MD5 checksum: 1944289 0c8e0c31b08c14f7a7198ce967eb3281
Alpha architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_alpha.deb
Size/MD5 checksum: 910612 43af4a8ce22b403d25558ed7df881fba
ARM architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_arm.deb
Size/MD5 checksum: 858618 5596ea37b56f334ed06a482eabb2527b
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_i386.deb
Size/MD5 checksum: 843376 a39e6b6c1c5bf1e43a5bdb88867d8627
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_ia64.deb
Size/MD5 checksum: 980186 85c43da1b384d49f8fc5ccf91a79c666
HP Precision architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_hppa.deb
Size/MD5 checksum: 897322 53b0ba66e1c7a0840fe6373ce41cc666
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_m68k.deb
Size/MD5 checksum: 824770 56407eeee73a0316383d42250cb27f36
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_mips.deb
Size/MD5 checksum: 886682 912156733c4da9fd438940ef741f5794
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_mipsel.deb
Size/MD5 checksum: 886554 387d7b39f2ede04e518961ded2f4cb05
PowerPC architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_powerpc.deb
Size/MD5 checksum: 861318 c261076b51e733f972b75ce77510c807
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_s390.deb
Size/MD5 checksum: 854722 f5731e91bac335a40bf0b38efd134b4b
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/a/a2ps/a2ps_4.13b-16woody1_sparc.deb
Size/MD5 checksum: 852690 98bd7a3408de1f3154951f2ccf318e3d
These files will probably be moved into the stable distribution on its next update.
New htget packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 611-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 20th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : htget
Vulnerability : buffer overflow
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-0852
"infamous41md" discovered a buffer overflow in htget, a file grabber that will get files from HTTP servers. It is possible to overflow a buffer and execute arbitrary code by accessing a malicious URL.
For the stable distribution (woody) this problem has been fixed in version 0.93-1.1woody1.
This package is not present in the testing and unstable distributions.
We recommend that you upgrade your htget package.
DotDeb.org has released PHP 5.0.3 packages for Debian GNU/Linux 3.0
New cscope packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 610-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 17th, 2004 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : cscope
Vulnerability : insecure temporary file
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-0996
BugTraq ID : 11697
Debian Bug : 282815
A vulnerability has been discovered in cscope, a program to interactively examine C source code, which may allow local users to overwrite files via a symlink attack.
For the stable distribution (woody) this problem has been fixed in version 15.3-1woody2.
For the unstable distribution (sid) this problem has been fixed in version 15.5-1.
We recommend that you upgrade your cscope package.
DotDeb.org has released PHP 4.3.10 packages for Debian GNU/Linux 3.0
New atari800 packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 609-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 14th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : atari800
Vulnerability : buffer overflows
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-1076
Adam Zabrocki discovered multiple buffer overflows in atari800, an Atari emulator. In order to directly access graphics hardware, one of the affected programs is installed setuid root. A local attacker could exploit this vulnerability to gain root privileges.
For the stable distribution (woody) these problems have been fixed in version 1.2.2-1woody3.
For the unstable distribution (sid) these problems will be fixed soon.
We recommend that you upgrade your atari800 package immediately.
New zgv packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 608-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 14th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : zgv
Vulnerability : integer overflows, unsanitised input
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-1095 CAN-2004-0999
BugTraq ID : 11556
Several vulnerabilities have been discovered in zgv, an SVGAlib graphics viewer for the i386 architecture. The Common Vulnerabilities and Exposures Project identifies the following problems:
CAN-2004-1095
Luke Macken and "infamous41md" independently discoverd multiple integer overflows in zgv. Remote exploitation of an integer overflow vulnerability could allow the execution of arbitrary code.
CAN-2004-0999
Mikulas Patocka discovered that malicious multiple-image (e.g. animated) GIF images can cause a segmentation fault in zgv.
For the stable distribution (woody) these problems have been fixed in version 5.5-3woody1.
For the unstable distribution (sid) these problems will be fixed soon.
We recommend that you upgrade your zgv package immediately.
New libxpm packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 607-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 10th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : xfree86
Vulnerability : several
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-0914
Several developers have discovered a number of problems in the libXpm library which is provided by X.Org, XFree86 and LessTif. These bugs can be exploited by remote and/or local attackers to gain access to the system or to escalate their local privileges, by using a specially crafted XPM image.
For the stable distribution (woody) this problem has been fixed in version 4.1.0-16woody5.
For the unstable distribution (sid) this problem will be fixed in version 4.3.0.dfsg.1-9.
We recommend that you upgrade your libxpm package immediately.
New nfs-utils packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 606-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 8th, 2004 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : nfs-utils
Vulnerability : wrong signal handler
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-1014
SGI has discovered that rpc.statd from the nfs-utils package, the Network Status Monitor, did not ignore the "SIGPIPE". Hence, a client prematurely terminating the TCP connection could also terminate the server process.
For the stable distribution (woody) this problem has been fixed in version 1.0-2woody2.
For the unstable distribution (sid) this problem will be fixed soon.
We recommend that you upgrade your nfs-utils package.
New viewcvs packages has been released for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 605-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 6th, 2004 http://www.debian.org/security/faq
--------------------------------------------------------------------------
Package : viewcvs
Vulnerability : settings not honored
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-0915
Hajvan Sehic discovered several vulnerabilities in viewcvs, a utility for viewing CVS and Subversion repositories via HTTP. When exporting a repository as a tar archive the hide_cvsroot and forbidden settings were not honoured enough.
When upgrading the package for woody, please make a copy of your /etc/viewcvs/viewcvs.conf file if you have manually edited this file. Upon upgrade the debconf mechanism may alter it in a way so that viewcvs doesn't understand it anymore.
For the stable distribution (woody) these problems have been fixed in version 0.9.2-4woody1.
For the unstable distribution (sid) these problems have been fixed in version 0.9.2+cvs.1.0.dev.2004.07.28-1.2.
We recommend that you upgrade your viewcvs package.
OSDir.com has posted a screenshot slideshow of Debian-Installer RC2
From the debian-devel-announce mailing list:
New hpsockd packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 604-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 3rd, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : hpsockd
Vulnerability : missing input sanitising
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-0993
"infamous41md" discovered a buffer overflow condition in hpsockd, the socks server written at Hewlett-Packard. An exploit could cause the program to crash or may have worse effect.
For the stable distribution (woody) this problem has been fixed in version 0.6.woody1.
For the unstable distribution (sid) this problem has been fixed in version 0.14.
We recommend that you upgrade your hpsockd package.
A new openssl package is available for Debian GNU/linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 603-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
December 1st, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : openssl
Vulnerability : insecure temporary file
Problem-Type : local/remote
Debian-specific: no
CVE ID : CAN-2004-0975
Trustix developers discovered insecure temporary file creation in a supplemental script (der_chop) of the openssl package which may allow local users to overwrite files via a symlink attack.
For the stable distribution (woody) this problem has been fixed in version 0.9.6c-2.woody.7.
For the unstable distribution (sid) this problem has been fixed in version 0.9.7e-1.
We recommend that you upgrade your openssl package.
New libgd2 packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 602-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
November 29th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : libgd2
Vulnerability : integer overflow
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-0941 CAN-2004-0990
More potential integer overflows have been found in the GD graphics library which weren't covered by our security advisory DSA 591. They could be exploited by a specially crafted graphic and could lead to the execution of arbitrary code on the victim's machine.
For the stable distribution (woody) these problems have been fixed in version 2.0.1-10woody2.
For the unstable distribution (sid) these problems will be fixed soon.
We recommend that you upgrade your libgd2 packages.
New libgd1 packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 601-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
November 29th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : libgd1
Vulnerability : integer overflow
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-0941 CAN-2004-0990
More potential integer overflows have been found in the GD graphics library which weren't covered by our security advisory DSA 589. They could be exploited by a specially crafted graphic and could lead to the execution of arbitrary code on the victim's machine.
For the stable distribution (woody) these problems have been fixed in version 1.8.4-17.woody4.
For the unstable distribution (sid) these problems will be fixed soon.
We recommend that you upgrade your libgd1 packages.
NewsForge has posted an article about Debian as workstation OS
New tetex-bin packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 599-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
November 25th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : tetex-bin
Vulnerability : integer overflows
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-0888
Debian Bug : 278298
Chris Evans discovered several integer overflows in xpdf, that are also present in tetex-bin, binary files for the teTeX distribution, which can be exploited remotely by a specially crafted PDF document and lead to the execution of arbitrary code.
For the stable distribution (woody) these problems have been fixed in version 20011202-7.3.
For the unstable distribution (sid) these problems have been fixed in version 2.0.2-23.
We recommend that you upgrade your tetex-bin packages.
Updated yardradius packages are available for Debian GNU/Linux
---------------------------------------------------------------------------
Debian Security Advisory DSA 598-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
November 25th, 2004 http://www.debian.org/security/faq
---------------------------------------------------------------------------
Package : yardradius
Vulnerability : buffer overflow
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-0987
Debian Bug : 278384
Max Vozeler noticed that yardradius, the YARD radius authentication and accounting server, contained a stack overflow similar to the one from radiusd which is referenced as CAN-2001-0534. This could lead to the execution of arbitrary code as root.
For the stable distribution (woody) this problem has been fixed in version 1.0.20-2woody1.
For the unstable distribution (sid) this problem has been fixed in version 1.0.20-15.
We recommend that you upgrade your yardradius package immediately.
