We recommend you upgrade your mgetty package immediately.
MD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
We recommend you upgrade your micq package immediately.
We recommend you upgrade your mysql package immediately.
We recommend you upgrade your splitvt package immediately.
This package only exists in stable, so if you are running unstable you won't\nsee a bugfix unless you use the resources from the bottom of this message to\nthe proper configuration.\n
We recommend you upgrade your sash package immediately.
We recommend you upgrade your wu-ftpd package immediately.
We recommend you upgrade your jazip package immediately.
We recommend you upgrade your tinyproxy package immediately.
We recommend you upgrade your exmh packages immediately.
We recommend you upgrade your man-db package immediately.
\nThe scope of this advisory is XFree86 3.3.6 only, since that is the version\nreleased with Debian GNU/Linux 2.2 (\"potato\"); Debian packages of XFree86 4.0\nand later have not been released as part of a Debian distribution.\n
\nSeveral people are responsible for authoring the fixes to these problems,\nincluding Aaron Campbell, Paulo Cesar Pereira de Andrade, Keith Packard, David\nDawes, Matthieu Herrb, Trevor Johnson, Colin Phipps, and Branden Robinson.\n
There are several other XFree86 security issues commonly discussed in conjunction with the above, to which an up-to-date Debian 2.2 system is\nNOT vulnerable:\n
The bugfix has been backported to the version of analog from Debian\n2.2. Version 4.01-1potato1 is fixed.\n
We recommend you upgrade your analog packages immediately.
When eperl is installed setuid root, it can switch to the UID/GID of\nthe scripts owner. Although Debian doesn't ship the program setuid\nroot, this is a useful feature which people may have activated\nlocally. When the program is used as /usr/lib/cgi-bin/nph-eperl the\nbugs could lead into a remote vulnerability as well.\n
Version 2.2.14-0.7potato2 fixes this; we recommend you upgrade your eperl\npackage immediately.
We recommend you upgrade your man2html package immediately.
We recommend you upgrade your mc package.
Please note that a side-effect of this upgrade is that ldd will no longer\nwork on suid programs, unless you logged in as root.\n
The default configuration does not have wrapping enable, but it can easily\nbe enabled either by changing the configuration or pressing W while viewing a\nmessage.\n
This has been fixed in version 0.9.6.2-9potato1 and we recommand that you\nupgrade your slrn package immediately.
This has been fixed in version 2.8-15.3 and we recommend that you upgrade\nyour joe package immediately.
Gnuserv was derived from emacsserver which is part of GNU Emacs. It was\nreworked completely and not much is left over from its time as part of\nGNU Emacs. Therefore the versions of emacsserver in both Emacs19 and Emacs20\ndoesn't look vulnerable to this bug, they don't even provide a MIT-MAGIC-COOKIE\nbased mechanism.\n
This could lead into a remote user issue commands under the UID of the\nperson running gnuserv.\n
Since the mail code was never written to be secure fixing it\nproperly would mean a large rewrite. Instead of doing this we decided\nto no longer install it setgid. This means that it can no longer lock\nyour mailbox properly on systems for which you need group mail to\nwrite to the mailspool, but it will still work for sending email.\n
This has been fixed in mailx version 8.1.1-10.1.5. If you have\nsuidmanager installed you can also make this manually with the\nfollowing command:\nsuidregister /usr/bin/mail root root 0755\n
Note: DSA-046-1 included an incorrectly compiled sparc package, which\nthe second edition fixed.\n
All these problems are fixed in the 2.2.19 kernel, and it is highly\nrecommend that you upgrade machines to this kernel.\n
Please note that kernel upgrades are not done automatically. You will\nhave to explicitly tell the packaging system to install the right kernel\nfor your system.\n
Both problems have been fixed in version 2.0.7-3.2, and we recommend\nthat you upgrade your samba package immediately. (This problem is also fixed\nin the Samba 2.2 codebase.)\n
Note: DSA-048-1 included an incorrectly compiled sparc package, which\nthe second edition fixed.\n
The third edition of the advisory was made because Marc Jacobsen from HP\ndiscovered that the security fixes from samba 2.0.8 did not fully fix the\n/tmp symlink attack problem. The samba team released version 2.0.9 to fix\nthat, and those fixes have been added to version 2.0.7-3.3 of the Debian\nsamba packages.\n
This has been fixed in version 1.4.1-1.1, and we recommend that you\nupgrade your cfingerd package immediately.\n
Note: this advisory was previously posted as DSA-048-1 by mistake.\n
We recommend you upgrade your sendfile packages immediately.\n
Since we haven't received source code for these packages, they are not\npart of the Debian GNU/Linux distribution, but are packaged up as `.deb'\nfiles for a convenient installation.\n
We recommend that you upgrade your Netscape packages immediately and\nremove older versions.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nWe recommend that you upgrade your sendfile package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 5.02-7.1.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 3.0pl1-57.3 (or 3.0pl1-67 for unstable).\nNo exploits are known to exist, but we recommend that you upgrade your\ncron packages immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis hotfix has been added in version 2.1.6-10, and we highly recommend\nthat you upgrade your zope package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 2.3.16-3, and we recommend that you\nupgrade your man-db package immediately. If you use suidmanager\nyou can also use that to make sure man and mandb are not installed\nsuid which protects you from this problem. This can be done with the\nfollowing commands:\n
\n suidregister /usr/lib/man-db/man root root 0755\n suidregister /usr/lib/man-db/mandb root root 0755\n\n
Of course even when using suidmanager an upgrade is still strongly\nrecommended.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 2.0.6a-3.1, and we recommend that you\nupgrade your gftp package.\n
Note: this advisory was posted as DSA-055-1 by mistake.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis problem has been fixed in version 3.12-10.1. Since that code is\nnot turned on by default a standard installation is not vulnerable,\nbut we still recommend to upgrade your exim package.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\ndrop_effective_privs() and regain_effective_privs() correctly which\nwould cause it to regain privileges too early. This could be abused\nto make man create files as user man.\nThis has been fixed in version 2.3.16-4, and we recommend that you\nupgrade your man-db package immediately. If you use suidmanager you\ncan also use that to make sure man and mandb are not installed suid\nwhich protects you from this problem. This can be done with the\nfollowing commands:\n
\n suidregister /usr/lib/man-db/man root root 0755\n suidregister /usr/lib/man-db/mandb root root 0755\n\n
\nOf course even when using suidmanager an upgrade is still strongly\nrecommended.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 5.3.3-1.2, and we recommend that\nyou upgrade your fetchmail package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nBoth problems have been fixed in version 1.0.6-0potato1.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\ntt_printf() function. A local user could abuse this making rxvt\nprint a special string using that function, for example by using\nthe -T or -name command-line options.\nThat string would cause a\nstack overflow and contain code which rxvt will execute.\nSince rxvt is installed sgid utmp an attacker could use this\nto gain utmp which would allow them to modify the utmp file.\n
This has been fixed in version 2.6.2-2.1, and we recommend that\nyou upgrade your rxvt package.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAnother problem is that xinetd sets it umask to 0. As a result any\nprograms that xinetd start that are not careful with file permissions\nwill create world-writable files.\n
Both problems have been fixed in version 2.1.8.8.p3-1.1.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 0.1.10+0.1.11pre+kokb23-4, and we\nrecommend that you upgrade your w3m package.\n
By itself that is not a problem, except if Samba is configured to\nwrite log-files to a file that includes the NetBIOS name of the\nremote side by using the `%m' macro in the `log file' command. In\nthat case an attacker could use a NetBIOS name like '../tmp/evil'.\nIf the log-file was set to \"/var/log/samba/%s\" Samba would then\nwrite to /var/tmp/evil.\n
Since the NetBIOS name is limited to 15 characters and the `log\nfile' command could have an extension to the filename the results\nof this are limited. However if the attacker is also able to create\nsymbolic links on the Samba server they could trick Samba into\nappending any data they want to all files on the filesystem which\nSamba can write to.\n
The Debian GNU/Linux packaged version of Samba has a safe\nconfiguration and is not vulnerable.\n
As temporary workaround for systems that are vulnerable change all\noccurrences of the `%m' macro in smb.conf to `%l' and restart Samba.\n
This has been fixed in version 2.0.7-3.4, and we recommend that you\nupgrade your Samba package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSince ALLOW_LINE_PARSING is enabled in the default /etc/cfingerd.conf\nlocal users could use this to gain root access.\n
This has been fixed in version 1.4.1-1.2, and we recommend that you upgrade\nyour cfingerd package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis vulnerability was announced to bugtraq by Dan Harkless.\n
Quoting the SecurityFocus entry for this vulnerability:\n
\n\nA problem in the package could allow directory indexing, and path\n discovery. In a default configuration, Apache enables mod_dir,\n mod_autoindex, and mod_negotiation. However, by placing a custom\n crafted request to the Apache server consisting of a long path name\n created artificially by using numerous slashes, this can cause these\n modules to misbehave, making it possible to escape the error page,\n and gain a listing of the directory contents.\n
This vulnerability makes it possible for a malicious remote user\n to launch an information gathering attack, which could potentially\n result in compromise of the system. Additionally, this vulnerability\n affects all releases of Apache previous to 1.3.19.\n
This problem has been fixed in apache-ssl 1.3.9-13.3 and\napache 1.3.9-14. We recommend that you upgrade your packages\nimmediately.
\nWarning: The MD5Sum of the .dsc and .diff.gz file don't match\nsince they were copied from the stable release afterwards, the\ncontent of the .diff.gz file is the same, though, checked.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe problem is that slapd did not handle packets which had\nBER fields of invalid length and would crash if it received them.\nAn attacker could use this to mount a remote denial of service attack.\n
This problem has been fixed in version 1.2.12-1, and we recommend\nthat you upgrade your slapd package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nxloadimage (a graphics files viewer for X) that was\nshipped in Debian GNU/Linux 2.2 has a buffer overflow in the code that\nhandles FACES format images. This could be exploited by an attacker by\ntricking someone into viewing a specially crafted image using xloadimage\nwhich would allow them to execute arbitrary code.\nThis problem was fixed in version 4.1-5potato1.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\ntelnetd package version\n0.16-4potato1, which is shipped with\nthe \"stable\" (2.2, potato) distribution of Debian GNU/Linux, is vulnerable to an\nexploitable overflow in its output handling.\n\nThe original bug was found by <scut@nb.in-berlin.de>, and announced to\nbugtraq on Jul 18 2001. At that time, netkit-telnet versions after 0.14 were\nnot believed to be vulnerable.\n
\nOn Aug 10 2001, zen-parse posted an advisory based on the same problem, for\nall netkit-telnet versions below 0.17.\n
\nMore details can be found on http://online.securityfocus.com/archive/1/203000.\nAs Debian uses the `telnetd' user to run in.telnetd, this is not a remote\nroot compromise on Debian systems; however, the user `telnetd' can be compromised.\n
We strongly advise you update your telnetd package to the versions\nlisted below.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nfetchmail while doing a security audit. In both the IMAP code\nand the POP3 code, the input isn't verified even though it's used to store\na number in an array. Since\nno bounds checking is done this can be used by an attacker to write\narbitrary data in memory. An attacker can use this if they can get a user\nto transfer mail from a custom IMAP or POP3 server they control.\nThis has been fixed in version 5.3.3-3, we recommend that you\nupdate your fetchmail packages immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\ngroff (the GNU version of\ntroff). The pic command was vulnerable to a printf format attack\nwhich made it possible to circumvent the `-S' option and execute\narbitrary code.\nThis has been fixed in version 1.15.2-2, and we recommend that you upgrade\nyour groff packages immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 2:2.2.6-0.potato.1. Please note that you\nwill also need to upgrade the horde package to the same version.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 0.61.1-4.1 of the Debian package, and\nupstream version 0.65.1. We recommend that you update your Window\nMaker package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nOn Aug 10 2001, zen-parse posted an advisory based on the same problem, for\nall netkit-telnet versions below 0.17.\n
More details can be found on\nSecurityFocus.\nAs Debian uses the 'telnetd' user to run in.telnetd, this is not a remote\nroot compromise on Debian systems; the 'telnetd' user can be compromised.\n
We strongly advise you update your netkit-telnet-ssl packages to the versions\nlisted below.\n
MD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
This has been fixed in the upstream version 4.9.2 and an updated\nversion of 4.9.0 for Debian GNU/Linux 2.2.\n
We recommend that you upgrade your most package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 2.2.5-3.2. This problem is logged\nas bug 233 in the squid bugtracker and will also be fixed in\nfuture squid releases.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\n\n\n\n When trying to decode binaries, the built-in code executes any shell\n scripts the article might contain, apparently assuming they would be\n some kind of self-extracting archive.\n
\n
This problem has been fixed in version 0.9.6.2-9potato2 by removing\nthis feature.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nZenith Parsec discovered a security hole in Taylor UUCP 1.06.1. It\npermits a local user to copy any file to anywhere which is writable by\nthe uucp uid, which effectively means that a local user can completely\nsubvert the UUCP subsystem, including stealing mail, etc.
\nIf a remote user with UUCP access is able to create files on the local\nsystem, and can successfully make certain guesses about the local\ndirectory structure layout, then the remote user can also subvert the\nUUCP system. A default installation of UUCP will permit a remote user\nto create files on the local system if the UUCP public directory has\nbeen created with world write permissions.
\nObviously this security hole is serious for anybody who uses UUCP on a\nmulti-user system with untrusted users, or anybody who uses UUCP and\npermits connections from untrusted remote systems.
\nIt was thought that this problem has been fixed with DSA 079-1, but\nthat didn't fix all variations of the problem. The problem is fixed\nin version 1.06.1-11potato2 of uucp which uses a patch from the\nupstream author Ian Lance Taylor.
\nWe recommend that you upgrade your uucp package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA malicious user could point htsearch to a file like\n/dev/zero and\nlet the server run in an endless loop, trying to read config\nparameters. If the user has write permission on the server they can\npoint the program to it and retrieve any file readable by the webserver\nuser id.\n
This problem has been fixed in version 3.1.5-2.0potato.1 for Debian\nGNU/Linux 2.2.\n
We recommend that you upgrade your htdig package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nIn SNS Advisory No. 32 a buffer overflow vulnerability has been\nreported in the routine which parses MIME headers that are returned\nfrom web servers. A malicious web server administrator could exploit\nthis and let the client web browser execute arbitrary code.
\nw3m handles MIME headers included in the request/response message of\nHTTP communication like any other web browser. A buffer overflow will\noccur when w3m receives a MIME encoded header with base64 format.
\nThis problem has been fixed by the maintainer in version\n0.1.10+0.1.11pre+kokb23-4 of w3m and w3m-ssl (for the SSL-enabled\nversion), both for Debian GNU/Linux 2.2.
\nWe recommend that you upgrade your w3m packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
This problem has been fixed by the maintainer in version 2.1-13 of xvt\nfor Debian unstable and 2.1-13.0potato.1 for the stable Debian\nGNU/Linux 2.2.\n
We recommend that you upgrade your xvt package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis problem has been fixed in version 3.20 by the upstream\nmaintainer, included in Debian unstable, and was ported back to\nversion 3.15.2 which is available for the stable Debian GNU/Linux\n2.2.\n
We recommend that you upgrade your procmail package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis problem has been fixed by the Security Team in version 2.0.6a-3.2\nfor the stable Debian GNU/Linux 2.2.\n
We recommend that you upgrade your gftp package.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis problem has been fixed in version 1.79-16a.1 for nvi and\n1.79+19991117-2.3 for nvi-m17n for the stable Debian GNU/Linux 2.2.\n
Even if we don't believe that this could lead into somebody gaining\naccess of another users account if they haven't lost their brain, we\nrecommend that you upgrade your nvi packages.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nWe have received reports that the \"SSH CRC-32 compensation attack\ndetector vulnerability\" is being actively exploited. This is the same\ninteger type error previously corrected for OpenSSH in DSA-027-1.\nOpenSSH (the Debian ssh package) was fixed at that time, but\nssh-nonfree and ssh-socks were not.
\nThough packages in the non-free section of the archive are not\nofficially supported by the Debian project, we are taking the unusual\nstep of releasing updated ssh-nonfree/ssh-socks packages for those\nusers who have not yet migrated to OpenSSH. However, we do recommend\nthat our users migrate to the regularly supported, DFSG-free \"ssh\"\npackage as soon as possible. ssh 1.2.3-9.3 is the OpenSSH package\navailable in Debian 2.2r4.
\nThe fixed ssh-nonfree/ssh-socks packages are available in version\n1.2.27-6.2 for use with Debian 2.2 (potato) and version 1.2.27-8 for\nuse with the Debian unstable/testing distribution. Note that the new\nssh-nonfree/ssh-socks packages remove the setuid bit from the ssh\nbinary, disabling rhosts-rsa authentication. If you need this\nfunctionality, run
\nchmod u+s /usr/bin/ssh1
after installing the new package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been corrected in version 2.6.0-6 of the wu-ftpd package.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 3.0+beta.20000106-5, and we recommend\nthat you upgrade your fml package to that version. Upgrading will\nautomatically regenerate the index pages.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe icecast-server (a streaming music server) package as distributed\nin Debian GNU/Linux 2.2 has several security problems:
\nThese have been fixed in version 1.3.10-1, and we strongly recommend\nthat you upgrade your icecast-server package immediately.\n
The i386 package mentioned in the DSA-089-1 advisory was incorrectly\ncompiled and will not run on Debian GNU/Linux potato machines. This\nhas been corrected in version 1.3.10-1.1.\n
MD5 checksums of the listed files are available in the original advisory.\n(DSA-089-2)\n
\n\n\nThe xtel (an X emulator for minitel) package as distributed with Debian\nGNU/Linux 2.2 has two possible symlink attacks:
\nBoth problems have been fixed in version 3.2.1-4.potato.1 .\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nPlease note that the default configuration for Debian does not\nhave UseLogin enabled.\n
This has been fixed in version 1:1.2.3-9.4.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nwmtv can optionally run a command if you double-click on the TV\nwindow. This command can be specified using the -e command line\noption. However, since wmtv is installed suid root, this command\nwas also run as root, which gives local users a very simple way\nto get root access.\n
This has been fixed in version 0.6.5-2potato1 by dropping root\nprivileges before executing the command. We recommend that you\nupgrade your wmtv package immediately.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 0.0.19991231pl11-2.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThese have been fixed upstream in version 2.0.8, and the relevant\npatches have been backported to version 1.1-10 in Debian.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\ngpm-root program, which can be used to\ncreate mouse-activated menus on the console.\nAmong other problems, the gpm-root program contains a format string\nvulnerability, which allows an attacker to gain root privileges.\nThis has been fixed in version 1.17.8-18.1, and we recommend that you upgrade\nyour 1.17.8-18 package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed upstream in version 1.2.5.1 and 1.3.25. The\nrelevant patch has been added to version 1.2.5-5 of the Debian\npackage.\n
MD5 checksums of the listed files are available in the original advisory.\n(DSA-096-2)\n
\n\n\nPatrice Fournier discovered a bug in all versions of Exim older than\nExim 3.34 and Exim 3.952.
\nThe Exim maintainer, Philip Hazel,\nwrites about this issue: \"The\nproblem exists only in the case of a run time configuration which\ndirects or routes an address to a pipe transport without checking the\nlocal part of the address in any way. This does not apply, for\nexample, to pipes run from alias or forward files, because the local\npart is checked to ensure that it is the name of an alias or of a\nlocal user. The bug's effect is that, instead of obeying the correct\npipe command, a broken Exim runs the command encoded in the local part\nof the address.\"
\nThis problem has been fixed in Exim version 3.12-10.2 for the stable\ndistribution Debian GNU/Linux 2.2 and 3.33-1.1 for the testing and\nunstable distribution. We recommend that you upgrade your exim\npackage.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTwo different problems where found in libgtop-daemon:
\nSince libgtop_daemon runs as user nobody both bugs could be used\nto gain access as the nobody user to a system running libgtop_daemon.
\nBoth problems have been fixed in version 1.0.6-1.1 and we recommend\nyou upgrade your libgtop-daemon package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nzen-parse found a vulnerability in the XChat IRC client that allows an\nattacker to take over the users IRC session.
\nIt is possible to trick XChat IRC clients into sending arbitrary\ncommands to the IRC server they are on, potentially allowing social\nengineering attacks, channel takeovers, and denial of service. This\nproblem exists in versions 1.4.2 and 1.4.3. Later versions of XChat\nare vulnerable as well, but this behaviour is controlled by the\nconfiguration variable \u00bbpercascii\u00ab, which defaults to 0. If it is set\nto 1 then the problem becomes apparent in 1.6/1.8 as well.
\nThis problem has been fixed in upstream version 1.8.7 and in version\n1.4.3-1 for the current stable Debian release (2.2) with a patch\nprovided from the upstream author Peter Zelezny. We recommend that\nyou upgrade your XChat packages immediately, since this problem is\nalready actively being exploited.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nGOBBLES found a buffer overflow in gzip that occurs when compressing\nfiles with really long filenames. Even though GOBBLES claims to have\ndeveloped an exploit to take advantage of this bug, it has been said\nby others that this problem is not likely to be exploitable as other\nsecurity incidents.
\nAdditionally, the Debian version of gzip from the stable release does\nnot segfault, and hence does not directly inherit this problem.\nHowever, better be safe than sorry, so we have prepared an update for\nyou.
\nPlease make sure you are running an up-to-date version from\nstable/unstable/testing with at least version 1.2.4-33.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSebastian Krahmer from SuSE found a vulnerability in sudo which could\neasily lead into a local root exploit.
This problem has been fixed in upstream version 1.6.4 as well as in\nversion 1.6.2p2-2.1 for the stable release of Debian GNU/Linux.
\nWe recommend that you upgrade your sudo packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nzen-parse found a bug in the current implementation of at which leads\ninto a heap corruption vulnerability which in turn could potentially\nlead into an exploit of the daemon user.
\nWe recommend that you upgrade your at packages.
\nUnfortunately, the bugfix from DSA 102-1 wasn't propagated properly due\nto a packaging bug. While the file parsetime.y was fixed, and yy.tab.c\nshould be generated from it, yy.tab.c from the original source was still\nused. This has been fixed in DSA-102-2.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA buffer overflow has been found in the globbing code for glibc.\nThis is the code which is used to glob patterns for filenames and is\ncommonly used in applications like shells and FTP servers.
\nThis has been fixed in version 2.1.3-20 and we recommend that\nyou upgrade your libc package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nLarry McVoy found a bug in the packet handling code for the CIPE\nVPN package: it did not check if a received packet was too short\nand could crash.
\nThis has been fixed in version 1.3.0-3, and we recommend that you\nupgrade your CIPE packages immediately.
\nPlease note that the package only contains the required kernel patch,\nyou will have to manually build the kernel modules for your kernel with the\nupdated source from the cipe-source package.
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe version of enscript (a tool to convert ASCII text to different\nformats) in potato has been found to create temporary files insecurely.
\nThis has been fixed in version 1.6.2-4.1.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThis has been fixed in version 2.3.2-1.3 and we recommend you upgrade\nyour rsync package immediately.
\nUnfortunately the patch used to fix that problem broke rsync.\nThis has been fixed in version 2.3.2-1.5 and we recommend you\nupgrade to that version immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n(DSA-106-2)\n
\n\n\nThe old advisory said:\n
Zenith Parse found a security problem in groff (the GNU version of\ntroff). The pic command was vulnerable to a printf format attack\nwhich made it possible to circumvent the `-S' option and execute\narbitrary code.\n
MD5 checksums of the listed files are available in the original advisory.\n
\n\n\nNicolas Boullis found some security problems in the wmtv package (a\ndockable video4linux TV player for windowmaker) which is distributed\nin Debian GNU/Linux 2.2. With the current version of wmtv, the\nconfiguration file is written back as the superuser, and without any\nfurther checks. A malicious user might use that to damage important\nfiles.
\nThis problem has been fixed in version 0.6.5-2potato2 for the stable\ndistribution by dropping privileges as soon as possible and only\nregaining them where required. In the current testing/unstable\ndistribution this problem has been fixed in version 0.6.5-9 and above\nby not requiring privileges anymore. Both contain fixes for two\npotential buffer overflows as well.
\nWe recommend that you upgrade your wmtv packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nDue to unescaped HTML code Faq-O-Matic returned unverified scripting\ncode to the browser. With some tweaking this enables an attacker to\nsteal cookies from one of the Faq-O-Matic moderators or the admin.
\nCross-Site Scripting is a type of problem that allows a malicious\nperson to make another person run some JavaScript in their browser.\nThe JavaScript is executed on the victims machine and is in the\ncontext of the website running the Faq-O-Matic Frequently Asked\nQuestion manager.
\nThis problem has been fixed in version 2.603-1.2 for the stable Debian\ndistribution and version 2.712-2 for the current testing/unstable\ndistribution.
\nWe recommend that you upgrade your faqomatic package if you have it\ninstalled.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe authors of CUPS, the Common UNIX Printing System, have found a\npotential buffer overflow bug in the code of the CUPS daemon where it\nreads the names of attributes. This affects all versions of CUPS.
\nThis problem has been fixed in version 1.0.4-10 for the stable Debian\ndistribution and version 1.1.13-2 for the current testing/unstable\ndistribution.
\nWe recommend that you upgrade your CUPS packages immediately if you\nhave them installed.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe Secure Programming Group of the Oulu University did a study on\nSNMP implementations and uncovered multiple problems which can\ncause problems ranging from Denial of Service attacks to remote\nexploits.
\nNew UCD-SNMP packages have been prepared to fix these problems\nas well as a few others. The complete list of fixed problems is:
\n(thanks to Caldera for most of the work on those patches)
\nThe new version is 4.1.1-2.1 and we recommend you upgrade your\nsnmp packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA set of buffer overflow problems have been found in hanterm, a Hangul\nterminal for X11 derived from xterm, that will read and display Korean\ncharacters in its terminal window. The font handling code in hanterm\nuses hard limited string variables but didn't check for boundaries.
\nThis problem can be exploited by a malicious user to gain access to\nthe utmp group which is able to write the wtmp and utmp files. These\nfiles record login and logout activities.
\nThis problem has been fixed in version 3.3.1p17-5.2 for the stable\nDebian distribution. A fixed package for the current testing/unstable\ndistribution is not yet available but will have a version number\nhigher than 3.3.1p18-6.1.
\nWe recommend that you upgrade your hanterm packages immediately if you\nhave them installed. Known exploits are already available.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSeveral buffer overflows were fixed in the \"ncurses\" library in November\n2000. Unfortunately, one was missed. This can lead to crashes when using\nncurses applications in large windows.
\nThe Common Vulnerabilities and\nExposures project has assigned the name\nCAN-2002-0062 to this issue.
\nThis problem has been fixed for the stable release of Debian in version\n5.0-6.0potato2. The testing and unstable releases contain ncurses 5.2,\nwhich is not affected by this problem.
\nThere are no known exploits for this problem, but we recommend that all\nusers upgrade ncurses immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThomas Springer found a vulnerability in GNUJSP, a Java servlet that\nallows you to insert Java source code into HTML files. The problem\ncan be used to bypass access restrictions in the web server. An\nattacker can view the contents of directories and download files\ndirectly rather then receiving their HTML output. This means that the\nsource code of scripts could also be revealed.
\nThe problem was fixed by Stefan Gybas, who maintains the Debian\npackage of GNUJSP. It is fixed in version 1.0.0-5 for the stable\nrelease of Debian GNU/Linux.
\nThe versions in testing and unstable are the same as the one in stable\nso they are vulnerable, too. You can install the fixed version this\nadvisory refers to on these systems to solve the problem as this\npackage is architecture independent.
\nWe recommend that you upgrade your gnujsp package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nStefan Esser, who is also a member of the PHP team, found several\nflaws\nin the way PHP handles multipart/form-data POST requests (as\ndescribed in RFC1867) known as POST fileuploads. Each of the flaws\ncould allow an attacker to execute arbitrary code on the victim's\nsystem.
\nFor PHP3 flaws contain a broken boundary check and an arbitrary heap\noverflow. For PHP4 they consist of a broken boundary check and a heap\noff by one error.
\nFor the stable release of Debian these problems are fixed in version\n3.0.18-0potato1.1 of PHP3 and version 4.0.3pl1-0potato3 of PHP4.
\nFor the unstable and testing release of Debian these problems are\nfixed in version 3.0.18-22 of PHP3 and version 4.1.2-1 of PHP4.
\nThere is no PHP4 in the stable and unstable distribution for the arm\narchitecture due to a compiler error.
\nWe recommend that you upgrade your PHP packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nZorgon found several buffer overflows in cfsd, a daemon that pushes\nencryption services into the Unix(tm) file system. We are not yet\nsure if these overflows can successfully be exploited to gain root\naccess to the machine running the CFS daemon. However, since cfsd can\neasily be forced to die, a malicious user can easily perform a denial\nof service attack to it.
\nThis problem has been fixed in version 1.3.3-8.1 for the stable Debian\ndistribution and in version 1.4.1-5 for the testing and unstable\ndistribution of Debian.
\nWe recommend that you upgrade your cfs package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nKim Nielsen recently found an internal problem with the CVS server and\nreported it to the vuln-dev mailing list. The problem is triggered by\nan improperly initialized global variable. A user exploiting this can\ncrash the CVS server, which may be accessed through the pserver\nservice and running under a remote user id. It is not yet clear if\nthe remote account can be exposed, though.
\nThis problem has been fixed in version 1.10.7-9 for the stable Debian\ndistribution with help of Niels Heinen and in versions newer\nthan 1.11.1p1debian-3 for the\ntesting and unstable distribution of Debian (not yet uploaded,\nthough).
\nWe recommend that you upgrade your CVS package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTim Waugh found several insecure uses of temporary files in the xsane\nprogram, which is used for scanning. This was fixed for Debian/stable\nby moving those files into a securely created directory within the\n/tmp directory.
\nThis problem has been fixed in version 0.50-5.1 for the stable Debian\ndistribution and in version 0.84-0.1 for the testing and unstable\ndistribution of Debian.
\nWe recommend that you upgrade your xsane package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJoost Pol reports that OpenSSH\nversions 2.0 through 3.0.2 have an off-by-one bug in the channel allocation\ncode. This vulnerability can be exploited by authenticated users to gain\nroot privilege or by a malicious server exploiting a client with this\nbug.
\nSince Debian 2.2 (potato) shipped with OpenSSH (the \"ssh\" package)\nversion 1.2.3, it is not vulnerable to this exploit. No fix is required\nfor Debian 2.2 (potato).
\nThe Debian unstable and testing archives do include a more recent OpenSSH\n(ssh) package. If you are running these pre-release distributions you should\nensure that you are running version 3.0.2p1-8, a patched version which was\nadded to the unstable archive today, or a later version.
\nEd Moyle recently\nfound a buffer overflow in Apache-SSL and mod_ssl.\nWith session caching enabled, mod_ssl will serialize SSL session\nvariables to store them for later use. These variables were stored in\na buffer of a fixed size without proper boundary checks.
\nTo exploit the overflow, the server must be configured to require client\ncertificates, and an attacker must obtain a carefully crafted client\ncertificate that has been signed by a Certificate Authority which is\ntrusted by the server. If these conditions are met, it would be possible\nfor an attacker to execute arbitrary code on the server.
\nThis problem has been fixed in version 1.3.9.13-4 of Apache-SSL and\nversion 2.4.10-1.3.9-1potato1 of libapache-mod-ssl for the stable\nDebian distribution as well as in version 1.3.23.1+1.47-1 of\nApache-SSL and version 2.8.7-1 of libapache-mod-ssl for the testing\nand unstable distribution of Debian.
\nWe recommend that you upgrade your Apache-SSL and mod_ssl packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSeveral security related problems have been found in the xtell\npackage, a simple messaging client and server. In detail, these\nproblems contain several buffer overflows, a problem in connection\nwith symbolic links, unauthorized directory traversal when the path\ncontains \"..\". These problems could lead into an attacker being able\nto execute arbitrary code on the server machine. The server runs with\nnobody privileges by default, so this would be the account to be\nexploited.
\nThey have been corrected by backporting changes from a newer upstream\nversion by the Debian maintainer for xtell. These problems are fixed\nin version 1.91.1 in the stable distribution of Debian and in version\n2.7 for the testing and unstable distribution of Debian.
\nWe recommend that you upgrade your xtell packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe compression library zlib has a flaw in which it attempts to free\nmemory more than once under certain conditions. This can possibly be\nexploited to run arbitrary code in a program that includes zlib. If a\nnetwork application running as root is linked to zlib, this could\npotentially lead to a remote root compromise. No exploits are known at\nthis time. This vulnerability is assigned the CVE candidate name of\nCAN-2002-0059.
\nThe zlib vulnerability is fixed in the Debian zlib package version\n1.1.3-5.1. A number of programs either link statically to zlib or include\na private copy of zlib code. These programs must also be upgraded\nto eliminate the zlib vulnerability. The affected packages and fixed\nversions follow:
\nThose using the pre-release (testing) version of Debian should upgrade\nto zlib 1.1.3-19.1 or a later version. Note that since this version of\nDebian has not yet been released it may not be available immediately for\nall architectures. Debian 2.2 (potato) is the latest supported release.
\nWe recommend that you upgrade your packages immediately. Note that you\nshould restart all programs that use the shared zlib library in order\nfor the fix to take effect. This is most easily done by rebooting the\nsystem.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJanusz Niewiadomski and Wojciech Purczynski reported a buffer overflow\nin the address_match of listar (a listserv style mailing-list manager).
\nThis has been fixed in version 0.129a-2.potato1.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe authors of mtr released a new upstream version, noting a\nnon-exploitable buffer overflow in their ChangeLog. Przemyslaw\nFrasunek, however, found an easy way to exploit this bug, which allows\nan attacker to gain access to the raw socket, which makes IP spoofing\nand other malicious network activity possible.
\nThe problem has been fixed by the Debian maintainer in version 0.41-6\nfor the stable distribution of Debian by backporting the upstream fix\nand in version 0.48-1 for the testing/unstable distribution.
\nWe recommend that you upgrade your mtr package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nYuji Takahashi discovered a bug in analog which allows a cross-site\nscripting type attack. It is easy for an attacker to insert arbitrary\nstrings into any web server logfile. If these strings are then\nanalysed by analog, they can appear in the report. By this means an\nattacker can introduce arbitrary Javascript code, for example, into an\nanalog report produced by someone else and read by a third person.\nAnalog already attempted to encode unsafe characters to avoid this\ntype of attack, but the conversion was incomplete.
\nThis problem has been fixed in the upstream version 5.22 of analog.\nUnfortunately patching the old version of analog in the stable\ndistribution of Debian instead is a very large job that defeats us.
\nWe recommend that you upgrade your analog package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA cross-site scripting (CSS) problem was discovered in Horde and IMP (a web\nbased IMAP mail package). This was fixed upstream in Horde version 1.2.8\nand IMP version 2.2.8. The relevant patches have been back-ported to\nversion 1.2.6-0.potato.5 of the horde package and version 2.2.6-0.potato.5\nof the imp package.
\nThis release also fixes a bug introduced by the PHP security fix from\nDSA-115-1: Postgres support for PHP was changed\nin a subtle way which broke the Postgres support from IMP.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAn internal audit by the xpilot (a multi-player tactical manoeuvring\ngame for X) maintainers revealed a buffer overflow in xpilot server.\nThis overflow can be abused by remote attackers to gain access to\nthe server under which the xpilot server is running.
\nThis has been fixed in upstream version 4.5.1 and version\n4.1.0-4.U.4alpha2.4.potato1 of the Debian package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nfc found a buffer overflow in the variable expansion code\nused by sudo for its prompt. Since sudo is necessarily installed suid\nroot a local user can use this to gain root access.
\nThis has been fixed in version 1.6.2-2.2 for the stable distribution\nof Debian and version 1.6.6-1 for the testing/unstable distribution.\nWe recommend that you upgrade your sudo package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nWe have received reports that in.uucpd, an authentication agent in the\nuucp package, does not properly terminate certain long input strings.\nThis has been corrected in uucp package version 1.06.1-11potato3 for\nDebian 2.2 (potato) and in version 1.06.1-18 for the upcoming (woody)\nrelease.
\nWe recommend you upgrade your uucp package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nEthereal versions prior to 0.9.3 were vulnerable to an allocation error\nin the ASN.1 parser. This can be triggered when analyzing traffic using\nthe SNMP, LDAP, COPS, or Kerberos protocols in ethereal. This\nvulnerability was announced in the ethereal security advisory\nenpa-sa-00003.\nThis issue has been corrected in ethereal version 0.8.0-3potato for\nDebian 2.2 (potato).
\nAdditionally, a number of vulnerabilities were discussed in ethereal\nsecurity advisory\nenpa-sa-00004;\nthe version of ethereal in Debian 2.2\n(potato) is not vulnerable to the issues raised in this later advisory.\nUsers of the not-yet-released woody distribution should ensure that they\nare running ethereal 0.9.4-1 or a later version.
\nWe recommend you upgrade your ethereal package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMark Litchfield found a denial of service attack in the Apache\nweb-server. While investigating the problem the Apache Software\nFoundation discovered that the code for handling invalid requests which\nuse chunked encoding also might allow arbitrary code execution on 64\nbit architectures.
\nThis has been fixed in version 1.3.9-14.1 of the Debian apache package,\nas well as upstream versions 1.3.26 and 2.0.37. We strongly recommend\nthat you upgrade your apache package immediately.
\nThe package upgrade does not restart the apache server automatically,\nthis will have to be done manually. Please make sure your\nconfiguration is correct (\"apachectl configtest\" will verify that for\nyou) and restart it using \"/etc/init.d/apache restart\"
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMark Litchfield found a denial of service attack in the Apache\nweb-server. While investigating the problem the Apache Software\nFoundation discovered that the code for handling invalid requests which\nuse chunked encoding also might allow arbitrary code execution on 64 bit\narchitectures.
\nThis has been fixed in version 1.3.9.13-4.1 of the Debian apache-ssl\npackage and we recommend that you upgrade your apache-ssl package\nimmediately.
\nAn update for the soon to be released Debian GNU/Linux 3.0/woody\ndistribution is not available at the moment.
\nMore Information:\nCVE-2002-0392,\nVU#944335.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMark Litchfield found a denial of service attack in the Apache\nweb-server. While investigating the problem the Apache Software\nFoundation discovered that the code for handling invalid requests which\nuse chunked encoding also might allow arbitrary code execution.
\nThis has been fixed in version 1.3.9-14.1-1.21.20000309-1 of the Debian\napache-perl package and we recommend that you upgrade your apache-perl\npackage immediately.
\nAn update for the soon to be released Debian GNU/Linux 3.0/woody\ndistribution will be available soon.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nISS X-Force released an advisory about an OpenSSH \"Remote Challenge\nVulnerability\". Unfortunately, the advisory was incorrect on some\npoints, leading to widespread confusion about the impact of this\nvulnerability. No version of OpenSSH in Debian is affected by the\nSKEY and BSD_AUTH authentication methods described in the ISS\nadvisory. However, Debian does include OpenSSH servers with the PAM\nfeature described as vulnerable in the later advisory by the OpenSSH\nteam. (This vulnerable feature is authentication using PAM via the\nkeyboard-interactive mechanism [kbdint].) This vulnerability affects\nOpenSSH versions 2.3.1 through 3.3. No exploit is currently known for\nthe PAM/kbdint vulnerability, but the details are publicly known. All\nof these vulnerabilities were corrected in OpenSSH 3.4.
\nIn addition to the vulnerabilities fixes outlined above, our OpenSSH\npackages version 3.3 and higher support the new privilege separation\nfeature from Niels Provos, which changes ssh to use a separate\nnon-privileged process to handle most of the work. Vulnerabilities in\nthe unprivileged parts of OpenSSH will lead to compromise of an\nunprivileged account restricted to an empty chroot, rather than a\ndirect root compromise. Privilege separation should help to mitigate\nthe risks of any future OpenSSH compromise.
\nDebian 2.2 (potato) shipped with an ssh package based on OpenSSH\n1.2.3, and is not vulnerable to the vulnerabilities covered by this\nadvisory. Users still running a version 1.2.3 ssh package do not have\nan immediate need to upgrade to OpenSSH 3.4. Users who upgraded to the\nOpenSSH version 3.3 packages released in previous iterations of\nDSA-134 should upgrade to the new version 3.4 OpenSSH packages, as the\nversion 3.3 packages are vulnerable. We suggest that users running\nOpenSSH 1.2.3 consider a move to OpenSSH 3.4 to take advantage of the\nprivilege separation feature. (Though, again, we have no specific\nknowledge of any vulnerability in OpenSSH 1.2.3. Please carefully read\nthe caveats listed below before upgrading from OpenSSH 1.2.3.) We\nrecommend that any users running a back-ported version of OpenSSH\nversion 2.0 or higher on potato move to OpenSSH 3.4.
\nThe current pre-release version of Debian (woody) includes an OpenSSH\nversion 3.0.2p1 package (ssh), which is vulnerable to the PAM/kbdint\nproblem described above. We recommend that users upgrade to OpenSSH\n3.4 and enable privilege separation. Please carefully read the release\nnotes below before upgrading. Updated packages for ssh-krb5 (an\nOpenSSH package supporting kerberos authentication) are currently\nbeing developed. Users who cannot currently upgrade their OpenSSH\npackages may work around the known vulnerabilities by disabling the\nvulnerable features: make sure the following lines are uncommented and\npresent in /etc/ssh/sshd_config and restart ssh
\n\n PAMAuthenticationViaKbdInt no\n ChallengeResponseAuthentication no\n\n
There should be no other PAMAuthenticationViaKbdInt or\nChallengeResponseAuthentication entries in sshd_config.
\nThat concludes the vulnerability section of this advisory. What\nfollows are release notes related to the OpenSSH 3.4 package and the\nprivilege separation feature. URLs for the OpenSSH 3.4 packages are at\nthe bottom.
\nSome notes on possible issues associated with this upgrade:
\nSome issues from previous OpenSSH 3.3p1 packages corrected in this\nadvisory (not a complete changelog):
\nAgain, we regret having to release packages with larger changes and\nless testing than is our usual practice; given the potential severity\nand non-specific nature of the original threat we decided that our users were\nbest served by having packages available for evaluation as quickly as\npossible. We will send additional information as it comes to us, and\nwill continue to work on the outstanding issues.
\nMD5 checksums of the listed files are available in the original advisory.\n(DSA-134-2)\n(DSA-134-3)\n(DSA-134-4)\n
\n\n\nThe libapache-mod-ssl package provides SSL capability to the apache\nwebserver.\nRecently, a problem has been found in the handling of .htaccess files,\nallowing arbitrary code execution as the web server user (regardless of\nExecCGI / suexec settings), DoS attacks (killing off apache children), and\nallowing someone to take control of apache child processes - all through\nspecially crafted .htaccess files.
\nThis has been fixed in the libapache-mod-ssl_2.4.10-1.3.9-1potato2 package\n(for potato), and the libapache-mod-ssl_2.8.9-2 package (for woody).\nWe recommend you upgrade as soon as possible.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe OpenSSL development team has announced that a security audit by A.L.\nDigital Ltd and The Bunker, under the DARPA CHATS program, has revealed\nremotely exploitable buffer overflow conditions in the OpenSSL code.\nAdditionally, the ASN1 parser in OpenSSL has a potential DoS attack\nindependently discovered by Adi Stav and James Yonan.
\nCAN-2002-0655 references overflows in buffers used to hold ASCII\nrepresentations of integers on 64 bit platforms. CAN-2002-0656\nreferences buffer overflows in the SSL2 server implementation (by\nsending an invalid key to the server) and the SSL3 client implementation\n(by sending a large session id to the client). The SSL2 issue was also\nnoticed by Neohapsis, who have privately demonstrated exploit code for\nthis issue. CAN-2002-0659 references the ASN1 parser DoS issue.
\nThese vulnerabilities have been addressed for Debian 3.0 (woody) in\nopenssl094_0.9.4-6.woody.2, openssl095_0.9.5a-6.woody.1 and\nopenssl_0.9.6c-2.woody.1.
\nThese vulnerabilities are also present in Debian 2.2 (potato). Fixed\npackages are available in openssl094_0.9.4-6.potato.2 and\nopenssl_0.9.6c-0.potato.4.
\nA worm is actively exploiting this issue on internet-attached hosts;\nwe recommend you upgrade your OpenSSL as soon as possible. Note that you\nmust restart any daemons using SSL. (E.g., ssh or ssl-enabled apache.)\nIf you are uncertain which programs are using SSL you may choose to\nreboot to ensure that all running daemons are using the new libraries.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nMarcus Meissner and Sebastian Krahmer discovered and fixed a temporary\nfile vulnerability in the mm shared memory library. This problem can\nbe exploited to gain root access to a machine running Apache which is\nlinked against this library, if shell access to the user \u201cwww-data\u201d\nis already available (which could easily be triggered through PHP).
\nThis problem has been fixed in the upstream version 1.2.0 of mm, which\nwill be uploaded to the unstable Debian distribution while this\nadvisory is released. Fixed packages for potato (Debian 2.2) and\nwoody (Debian 3.0) are linked below.
\nWe recommend that you upgrade your libmm packages immediately and\nrestart your Apache server.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem was found in gallery (a web-based photo album toolkit): it\nwas possible to pass in the GALLERY_BASEDIR variable remotely. This\nmade it possible to execute commands under the uid of web-server.
\nThis has been fixed in version 1.2.5-7 of the Debian package and upstream\nversion 1.3.1.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nGOBBLES found an insecure use of format strings in the super package.\nThe included program super is intended to provide access to certain\nsystem users for particular users and programs, similar to the program\nsudo. Exploiting this format string vulnerability a local user can\ngain unauthorized root access.
\nThis problem has been fixed in version 3.12.2-2.1 for the old stable\ndistribution (potato), in version 3.16.1-1.1 for the current stable\ndistribution (woody) and in version 3.18.0-3 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your super package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nDevelopers of the PNG library have fixed a buffer overflow in the\nprogressive reader when the PNG datastream contains more IDAT data\nthan indicated by the IHDR chunk. Such deliberately malformed\ndatastreams would crash applications which could potentially allow an\nattacker to execute malicious code. Programs such as Galeon,\nKonqueror and various others make use of these libraries.
\nIn addition to that, the packages below fix another\npotential buffer overflow. The PNG libraries implement a safety\nmargin which is also included in a newer upstream release. Thanks to\nGlenn Randers-Pehrson for informing us.
\nTo find out which packages depend on this library, you may want to\nexecute the following commands:
\n\n apt-cache showpkg libpng2\n apt-cache showpkg libpng3\n\n
This problem has been fixed in version 1.0.12-3.woody.2 of libpng and\nversion 1.2.1-1.1.woody.2 of libpng3 for the current stable\ndistribution (woody) and in version 1.0.12-4 of libpng and version\n1.2.1-2 of libpng3 for the unstable distribution (sid).\nThe potato release of Debian does not seem to be vulnerable.
\nWe recommend that you upgrade your libpng packages immediately and\nrestart programs and daemons that link to these libraries and read\nexternal data, such as web browsers.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nEckehard Berns discovered a buffer overflow in the munpack program\nwhich is used for decoding (respectively) binary files in MIME\n(Multipurpose Internet Mail Extensions) format mail messages. If\nmunpack is run on an appropriately malformed email (or news article)\nthen it will crash, and perhaps can be made to run arbitrary code.
\nHerbert Xu reported a second vulnerability which affected malformed\nfilenames that refer to files in upper directories like \"../a\". The\nsecurity impact is limited, though, because only a single leading\n\"../\" was accepted and only new files can be created (i.e. no files\nwill be overwritten).
\nBoth problems have been fixed in version 1.5-5potato2 for the old\nstable distribution (potato), in version 1.5-7woody2 for the current\nstable distribution (woody) and in version 1.5-9 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your mpack package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAn integer overflow bug has been discovered in the RPC library used by\nthe OpenAFS database server, which is derived from the SunRPC library.\nThis bug could be exploited to crash certain OpenAFS servers\n(volserver, vlserver, ptserver, buserver) or to obtain unauthorized\nroot access to a host running one of these processes. No exploits are\nknown to exist yet.
\nThis problem has been fixed in version 1.2.3final2-6 for the current\nstable distribution (woody) and in version 1.2.6-1 for the unstable\ndistribution (sid). Debian 2.2 (potato) is not affected since it\ndoesn't contain OpenAFS packages.
\nOpenAFS is only available for the architectures alpha, i386, powerpc,\ns390, sparc. Hence, we only provide fixed packages for these\narchitectures.
\nWe recommend that you upgrade your openafs packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAn integer overflow bug has been discovered in the RPC library used by\nthe Kerberos 5 administration system, which is derived from the SunRPC\nlibrary. This bug could be exploited to gain unauthorized root access\nto a KDC host. It is believed that the attacker needs to be able to\nauthenticate to the kadmin daemon for this attack to be successful.\nNo exploits are known to exist yet.
\nThis problem has been fixed in version 1.2.4-5woody1 for the current\nstable distribution (woody) and in version 1.2.5-2 for the unstable\ndistribution (sid). Debian 2.2 (potato) is not affected since it\ndoesn't contain krb5 packages.
\nWe recommend that you upgrade your kerberos packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem with wwwoffle has been discovered. The web proxy didn't\nhandle input data with negative Content-Length settings properly which\ncauses the processing child to crash. It is at this time not obvious\nhow this can lead to an exploitable vulnerability; however, it's better\nto be safe than sorry, so here's an update.
\nAdditionally, in the woody version empty passwords will be treated as\nwrong when trying to authenticate. In the woody version we also\nreplaced CanonicaliseHost() with the latest routine from 2.7d, offered\nby upstream. This stops bad IPv6 format IP addresses in URLs from\ncausing problems (memory overwriting, potential exploits).
\nThis problem has been fixed in version 2.5c-10.4 for the old stable\ndistribution (potato), in version 2.7a-1.2 for the current stable\ndistribution (woody) and in version 2.7d-1 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your wwwoffle packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe authors of tinyproxy, a lightweight HTTP proxy, discovered a bug\nin the handling of some invalid proxy requests. Under some\ncircumstances, an invalid request may result in allocated memory\nbeing freed twice. This can potentially result in the execution of\narbitrary code.
\nThis problem has been fixed in version 1.4.3-2woody2 for the current\nstable distribution (woody) and in version 1.4.3-3 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected by this problem.
\nWe recommend that you upgrade your tinyproxy package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAn integer overflow bug has been discovered in the RPC library used by\ndietlibc, a libc optimized for small size, which is derived from the\nSunRPC library. This bug could be exploited to gain unauthorized root\naccess to software linking to this code. The packages below also fix\ninteger overflows in the calloc, fread and fwrite code. They are also\nmore strict regarding hostile DNS packets that could lead to a\nvulnerability otherwise.
\nThese problems have been fixed in version 0.12-2.4 for the current\nstable distribution (woody) and in version 0.20-0cvs20020808 for the\nunstable distribution (sid). Debian 2.2 (potato) is not affected\nsince it doesn't contain dietlibc packages.
\nWe recommend that you upgrade your dietlibc packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA cross-site scripting vulnerability was discovered in mailman, a\nsoftware to manage electronic mailing lists. When a properly crafted\nURL is accessed with Internet Explorer (other browsers don't seem to\nbe affected), the resulting webpage is rendered similar to the real\none, but the javascript component is executed as well, which could be\nused by an attacker to get access to sensitive information. The new\nversion for Debian 2.2 also includes backports of security related\npatches from mailman 2.0.11.
\nThis problem has been fixed in version 2.0.11-1woody4 for the current\nstable distribution (woody), in version 1.1-10.1 for the old stable\ndistribution (potato) and in version 2.0.12-1 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your mailman package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nA set of problems have been discovered in Hylafax, a flexible\nclient/server fax software distributed with many GNU/Linux\ndistributions. Quoting SecurityFocus the problems are in detail:
\nThese problems have been fixed in version 4.0.2-14.3 for the old\nstable distribution (potato), in version 4.1.1-1.1 for the current\nstable distribution (woody) and in version 4.1.2-2.1 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your hylafax packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAn integer overflow bug has been discovered in the RPC library used by\nGNU libc, which is derived from the SunRPC library. This bug could be\nexploited to gain unauthorized root access to software linking to this\ncode. The packages below also fix integer overflows in the malloc\ncode. They also contain a fix from Andreas Schwab to reduce\nlinebuflen in parallel to bumping up the buffer pointer in the NSS DNS\ncode.
\nThis problem has been fixed in version 2.1.3-23 for the old stable\ndistribution (potato), in version 2.2.5-11.1 for the current stable\ndistribution (woody) and in version 2.2.5-13 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your libc6 packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem has been discovered in Interchange, an e-commerce and\ngeneral HTTP database display system, which can lead to an attacker\nbeing able to read any file to which the user of the Interchange\ndaemon has sufficient permissions, when Interchange runs in \"INET\nmode\" (internet domain socket). This is not the default setting in\nDebian packages, but configurable with Debconf and via configuration\nfile. We also believe that this bug cannot exploited on a regular\nDebian system.
\nThis problem has been fixed by the package maintainer in version\n4.8.3.20020306-1.woody.1 for the current stable distribution (woody)\nand in version 4.8.6-1 for the unstable distribution (sid). The old\nstable distribution (potato) is not affected, since it doesn't ship\nthe Interchange system.
\nWe recommend that you upgrade your interchange packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSolar Designer found a vulnerability in xinetd, a replacement for the\nBSD derived inetd. File descriptors for the signal pipe introduced in\nversion 2.3.4 are leaked into services started from xinetd. The\ndescriptors could be used to talk to xinetd resulting in crashing it\nentirely. This is usually called a denial of service.
\nThis problem has been fixed by the package maintainer in version\n2.3.4-1.2 for the current stable distribution (woody) and in version\n2.3.7-1 for the unstable distribution (sid). The old stable\ndistribution (potato) is not affected, since it doesn't contain the\nsignal pipe.
\nWe recommend that you upgrade your xinetd packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nCurrent versions of l2tpd, a layer 2 tunneling client/server program,\nforgot to initialize the random generator which made it vulnerable\nsince all generated random number were 100% guessable. When dealing\nwith the size of the value in an attribute value pair, too many bytes\nwere able to be copied, which could lead into the vendor field being\noverwritten.
\nThese problems have been fixed in version 0.67-1.1 for the current\nstable distribution (woody) and in version 0.68-1 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected, since it doesn't contain the l2tpd package.
\nWe recommend that you upgrade your l2tpd packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJoao Gouveia discovered an uninitialized variable which was insecurely\nused with file inclusions in the mantis package, a php based bug\ntracking system. The Debian Security Team found even more similar\nproblems. When these occasions are exploited, a remote user is able\nto execute arbitrary code under the webserver user id on the web\nserver hosting the mantis system.
\nJeroen Latour discovered that Mantis did not check all user input,\nespecially if they do not come directly from form fields. This opens\nup a wide variety of SQL poisoning vulnerabilities on systems without\nmagic_quotes_gpc enabled. Most of these vulnerabilities are only\nexploitable in a limited manner, since it is no longer possible to\nexecute multiple queries using one call to mysql_query(). There is\none query which can be tricked into changing an account's access\nlevel.
\nJeroen Latour also reported that it is possible to instruct Mantis to\nshow reporters only the bugs that they reported, by setting the\nlimit_reporters option to ON. However, when formatting the output\nsuitable for printing, the program did not check the limit_reporters\noption and thus allowed reporters to see the summaries of bugs they\ndid not report.
\nJeroen Latour discovered that the page responsible for displaying a\nlist of bugs in a particular project, did not check whether the user\nactually has access to the project, which is transmitted by a cookie\nvariable. It accidentally trusted the fact that only projects\naccessible to the user were listed in the drop-down menu. This\nprovides a malicious user with an opportunity to display the bugs of a\nprivate project selected.
\nThese problems have been fixed in version 0.17.1-2.2 for the current\nstable distribution (woody) and in version 0.17.4a-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected, since it doesn't contain the mantis package.
\nAdditional information:
\nWe recommend that you upgrade your mantis packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA flaw\nwas discovered in FAM's group handling. In the effect users\nare unable to read FAM directories they have group read and execute\npermissions on. However, also unprivileged users can potentially\nlearn names of files that only users in root's group should be able to\nview.
\nThis problem been fixed in version 2.6.6.1-5.2 for the current stable\nstable distribution (woody) and in version 2.6.8-1 (or any later\nversion) for the unstable distribution (sid). The old stable\ndistribution (potato) is not affected, since it doesn't contain fam\npackages.
\nWe recommend that you upgrade your fam packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nDue to a security engineering oversight, the SSL library from KDE,\nwhich Konqueror uses, doesn't check whether an intermediate\ncertificate for a connection is signed by the certificate authority as\nsafe for the purpose, but accepts it when it is signed. This makes it\npossible for anyone with a valid VeriSign SSL site certificate to\nforge any other VeriSign SSL site certificate, and abuse Konqueror\nusers.
\nA local root exploit using artsd has been discovered which exploited\nan insecure use of a format string. The exploit wasn't working on a\nDebian system since artsd wasn't running setuid root. Neither artsd\nnor artswrapper need to be setuid root anymore since current computer\nsystems are fast enough to handle the audio data in time.
\nThese problems have been fixed in version 2.2.2-13.woody.2 for the\ncurrent stable distribution (woody). The old stable\ndistribution (potato) is not affected, since it doesn't contain KDE\npackages. The unstable distribution (sid) is not yet fixed, but new\npackages are expected in the future, the fixed version will be version\n2.2.2-14 or higher.
\nWe recommend that you upgrade your kdelibs and libarts packages and\nrestart Konqueror.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAll versions of the EPIC script Light prior to 2.7.30p5 (on the 2.7\nbranch) and prior to 2.8pre10 (on the 2.8 branch) running on any\nplatform are vulnerable to a remotely-exploitable bug, which can lead\nto nearly arbitrary code execution.
\nThis problem has been fixed in version 2.7.30p5-1.1 for the current\nstable distribution (woody) and in version 2.7.30p5-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected, since it doesn't contain the Light package.
\nWe recommend that you upgrade your epic4-script-light package and\nrestart your IRC client.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe IRC client irssi is vulnerable to a denial of service condition.\nThe problem occurs when a user attempts to join a channel that has an\noverly long topic description. When a certain string is appended to\nthe topic, irssi will crash.
\nThis problem has been fixed in version 0.8.4-3.1 for the current\nstable distribution (woody) and in version 0.8.5-2 for the\nunstable distribution (sid). The old stable distribution (potato) is\nnot affected, since the corresponding portions of code are not\npresent. The same applies to irssi-gnome and irssi-gtk, which don't\nseem to be affected as well.
\nWe recommend that you upgrade your irssi-text package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe developers of Gaim, an instant messenger client that combines\nseveral different networks, found a vulnerability in the hyperlink\nhandling code. The 'Manual' browser command passes an untrusted\nstring to the shell without escaping or reliable quoting, permitting\nan attacker to execute arbitrary commands on the users machine.\nUnfortunately, Gaim doesn't display the hyperlink before the user\nclicks on it. Users who use other inbuilt browser commands aren't\nvulnerable.
\nThis problem has been fixed in version 0.58-2.2 for the current\nstable distribution (woody) and in version 0.59.1-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since it doesn't ship the Gaim program.
\nThe fixed version of Gaim no longer passes the user's manual browser\ncommand to the shell. Commands which contain the %s in quotes will\nneed to be amended, so they don't contain any quotes. The 'Manual'\nbrowser command can be edited in the 'General' pane of the\n'Preferences' dialog, which can be accessed by clicking 'Options' from\nthe login window, or 'Tools' and then 'Preferences' from the menu bar\nin the buddy list window.
\nWe recommend that you upgrade your gaim package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nZack Weinberg discovered an insecure use of a temporary file in\nos._execvpe from os.py. It uses a predictable name which could lead\nexecution of arbitrary code.
\nThis problem has been fixed in several versions of Python: For the\ncurrent stable distribution (woody) it has been fixed in version\n1.5.2-23.1 of Python 1.5, in version 2.1.3-3.1 of Python 2.1 and in\nversion 2.2.1-4.1 of Python 2.2. For the old stable distribution\n(potato) this has been fixed in version 1.5.2-10potato12 for Python\n1.5. For the unstable distribution (sid) this has been fixed in\nversion 1.5.2-24 of Python 1.5, in version 2.1.3-6a of Python 2.1 and\nin version 2.2.1-8 of Python 2.2. Python 2.3 is not affected by this\nproblem.
\nWe recommend that you upgrade your Python packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSpybreak discovered a problem in scrollkeeper, a free electronic\ncataloging system for documentation. The scrollkeeper-get-cl program\ncreates temporary files in an insecure manner in /tmp using guessable\nfilenames. Since scrollkeeper is called automatically when a user\nlogs into a Gnome session, an attacker with local access can easily\ncreate and overwrite files as another user.
\nThis problem has been fixed in version 0.3.6-3.1 for the current\nstable distribution (woody) and in version 0.3.11-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected, since it doesn't contain the scrollkeeper package.
\nWe recommend that you upgrade your scrollkeeper packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem with user privileges has been discovered in the Mantis\npackage, a PHP based bug tracking system. The Mantis system didn't\ncheck whether a user is permitted to view a bug, but displays it right\naway if the user entered a valid bug id.
\nAnother bug in Mantis caused the 'View Bugs' page to list bugs from\nboth public and private projects when no projects are accessible to\nthe current user.
\nThese problems have been fixed in version 0.17.1-2.5 for the current\nstable distribution (woody) and in version 0.17.5-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected, since it doesn't contain the mantis package.
\nAdditional information:
\n\nWe recommend that you upgrade your mantis packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nEthereal developers discovered a buffer overflow in the ISIS protocol\ndissector. It may be possible to make Ethereal crash or hang by\ninjecting a purposefully malformed packet onto the wire, or by\nconvincing someone to read a malformed packet trace file. It may be\npossible to make Ethereal run arbitrary code by exploiting the buffer\nand pointer problems.
\nThis problem has been fixed in version 0.9.4-1woody2 for the current\nstable distribution (woody), in version 0.8.0-4potato.1 for\nthe old stable distribution (potato) and in version 0.9.6-1 for the\nunstable distribution (sid).
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJason Molenda and Hiromitsu Takagi\nfound\nways to exploit cross site\nscripting bugs in mhonarc, a mail to HTML converter. When processing\nmaliciously crafted mails of type text/html mhonarc does not\ndeactivate all scripting parts properly. This is fixed in upstream\nversion 2.5.3.
\nIf you are worried about security, it is recommended that you disable\nsupport of text/html messages in your mail archives. There is no\nguarantee that the mhtxthtml.pl library is robust enough to eliminate\nall possible exploits that can occur with HTML data.
\nTo exclude HTML data, you can use the MIMEEXCS resource. For example:
\n\n <MIMEExcs>\n text/html\n text/x-html\n </MIMEExcs>\n\n
The type \"text/x-html\" is probably not used any more, but is good to\ninclude it, just-in-case.
\nIf you are concerned that this could block out the entire contents of\nsome messages, then you could do the following instead:
\n\n <MIMEFilters>\n text/html; m2h_text_plain::filter; mhtxtplain.pl\n text/x-html; m2h_text_plain::filter; mhtxtplain.pl\n </MIMEFilters>\n\n
This treats the HTML as text/plain.
\nThe above problems have been fixed in version 2.5.2-1.1 for the\ncurrent stable distribution (woody), in version 2.4.4-1.1 for\nthe old stable distribution (potato) and in version 2.5.11-1 for the\nunstable distribution (sid).
\nWe recommend that you upgrade your mhonarc packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem in cacti, a PHP based frontend to rrdtool for monitoring\nsystems and services, has been discovered. This could lead into cacti\nexecuting arbitrary program code under the user id of the web server.\nThis problem, however, is only persistent to users who already have\nadministrator privileges in the cacti system.
\nThis problem has been fixed by removing any dollar signs and backticks\nfrom the title string in version 0.6.7-2.1 for the current stable\ndistribution (woody) and in version 0.6.8a-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since it doesn't contain the cacti package.
\nWe recommend that you upgrade your cacti package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMordred Labs and others found several vulnerabilities in PostgreSQL,\nan object-relational SQL database. They are inherited from several\nbuffer overflows and integer overflows. Specially crafted long date\nand time input, currency, repeat data and long timezone names could\ncause the PostgreSQL server to crash as well as specially crafted\ninput data for lpad() and rpad(). More buffer/integer overflows were\nfound in circle_poly(), path_encode() and path_addr().
\nExcept for the last three, these problems are fixed in the upstream\nrelease 7.2.2 of PostgreSQL which is the recommended version to use.
\nMost of these problems do not exist in the version of PostgreSQL that\nDebian ships in the potato release since the corresponding\nfunctionality is not yet implemented. However, PostgreSQL 6.5.3 is\nquite old and may bear more risks than we are aware of, which may\ninclude further buffer overflows, and certainly include bugs that\nthreaten the integrity of your data.
\nYou are strongly advised not to use this release but to upgrade your\nsystem to Debian 3.0 (stable) including PostgreSQL release 7.2.1\ninstead, where many bugs have been fixed and new features introduced\nto increase compatibility with the SQL standards.
\nIf you consider an upgrade, please make sure to dump the entire\ndatabase system using the pg_dumpall utility. Please take into\nconsideration that the newer PostgreSQL is more strict in its input\nhandling. This means that tests like \"foo = NULL\" which are not valid\nwon't be accepted anymore. It also means that when using UNICODE\nencoding, ISO 8859-1 and ISO 8859-15 are no longer valid encodings to\nuse when inserting data into the relation. In such a case you are\nadvised to convert the dump in question using\nrecode latin1..utf-16.
\nThese problems have been fixed in version 7.2.1-2woody2 for the\ncurrent stable distribution (woody) and in version 7.2.2-2 for the\nunstable distribution (sid). The old stable distribution (potato) is\npartially affected and we ship a fixed version 6.5.3-27.2 for it.
\nWe recommend that you upgrade your PostgreSQL packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTwo buffer overflows have been discovered in purity, a game for nerds\nand hackers, which is installed setgid games on a Debian system. This\nproblem could be exploited to gain unauthorized access to the group\ngames. A malicious user could alter the highscore of several games.
\nThis problem has been fixed in version 1-14.2 for the current stable\ndistribution (woody), in version 1-9.1 for the old stable distribution\n(potato) and in version 1-16 for the unstable distribution (sid).
\nWe recommend that you upgrade your purity packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA cross site scripting problem has been discovered in Konqueror, a\nfamous browser for KDE and other programs using KHTML. The KDE team\nreports\nthat Konqueror's cross site scripting protection fails to\ninitialize the domains on sub-(i)frames correctly. As a result,\nJavaScript is able to access any foreign subframe which is defined in\nthe HTML source. Users of Konqueror and other KDE software that uses\nthe KHTML rendering engine may become victim of a cookie stealing and\nother cross site scripting attacks.
\nThis problem has been fixed in version 2.2.2-13.woody.3 for the\ncurrent stable distribution (woody) and in version 2.2.2-14 for the\nunstable distribution (sid). The old stable distribution (potato) is\nnot affected since it didn't ship KDE.
\nWe recommend that you upgrade your kdelibs package and restart\nKonqueror.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nWojciech Purczynski found out that it is possible for scripts to pass\narbitrary text to sendmail as commandline extension when sending a\nmail through PHP even when safe_mode is turned on. Passing 5th\nargument should be disabled if PHP is configured in safe_mode, which\nis the case for newer PHP versions and for the versions below. This\ndoes not affect PHP3, though.
\nWojciech Purczynski also found out that arbitrary ASCII control\ncharacters may be injected into string arguments of the mail() function.\nIf mail() arguments are taken from user's input it may give the user\nability to alter message content including mail headers.
\nUlf H\u00e4rnhammar discovered that file() and fopen() are vulnerable to\nCRLF injection. An attacker could use it to escape certain\nrestrictions and add arbitrary text to alleged HTTP requests that are\npassed through.
\nHowever this only happens if something is passed to these functions\nwhich is neither a valid file name nor a valid url. Any string that\ncontains control chars cannot be a valid url. Before you pass a\nstring that should be a url to any function you must use urlencode()\nto encode it.
\nThree problems have been identified in PHP:
\nThese problems have been fixed in version 3.0.18-23.1woody1 for PHP3\nand 4.1.2-5 for PHP4 for the current stable distribution (woody), in\nversion 3.0.18-0potato1.2 for PHP3 and 4.0.3pl1-0potato4 for PHP4 in\nthe old stable distribution (potato) and in version 3.0.18-23.2 for\nPHP3 and 4.2.3-3 for PHP4 for the unstable distribution (sid).
\nWe recommend that you upgrade your PHP packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nUlf H\u00e4rnhammar\ndiscovered a problem in ht://Check's PHP interface.\nThe PHP interface displays information unchecked which was gathered\nfrom crawled external web servers. This could lead into a cross site\nscripting attack if somebody has control over the server responses of\na remote web server which is crawled by ht://Check.
\nThis problem has been fixed in version 1.1-1.1 for the current stable\ndistribution (woody) and in version 1.1-1.2 for the unstable release\n(sid). The old stable release (potato) does not contain the htcheck\npackage.
\nWe recommend that you upgrade your htcheck package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA security vulnerability has been found in all Tomcat 4.x releases.\nThis problem allows an attacker to use a specially crafted URL to\nreturn the unprocessed source code of a JSP page, or, under special\ncircumstances, a static resource which would otherwise have been\nprotected by security constraints, without the need for being properly\nauthenticated.
\nThis problem has been fixed in version 4.0.3-3woody1 for the current\nstable distribution (woody) and in version 4.1.12-1 for the unstable\nrelease (sid). The old stable release (potato) does not contain\ntomcat packages. Also, packages for tomcat3 are not vulnerable to\nthis problem.
\nWe recommend that you upgrade your tomcat package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nStefan Esser discovered several buffer overflows and a broken boundary\ncheck within fetchmail. If fetchmail is running in multidrop mode\nthese flaws can be used by remote attackers to crash it or to execute\narbitrary code under the user id of the user running fetchmail.\nDepending on the configuration this even allows a remote root\ncompromise.
\nThese problems have been fixed in version 5.9.11-6.1 for both\nfetchmail and fetchmail-ssl for the current stable distribution\n(woody), in version 5.3.3-4.2 for fetchmail for the old stable\ndistribution (potato) and in version 6.1.0-1 for both fetchmail and\nfetchmail-ssl for the unstable distribution (sid). There are no\nfetchmail-ssl packages for the old stable distribution (potato) and\nthus no updates.
\nWe recommend that you upgrade your fetchmail packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nIt has been discovered that tkmail creates temporary files insecurely.\nExploiting this an attacker with local access can easily create and\noverwrite files as another user.
\nThis problem has been fixed in version 4.0beta9-8.1 for the current\nstable distribution (woody), in version 4.0beta9-4.1 for the old\nstable distribution (potato) and in version 4.0beta9-9 for the\nunstable distribution (sid).
\nWe recommend that you upgrade your tkmail packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe developers of Bugzilla, a web-based bug tracking system,\ndiscovered a problem in the handling of more than 47 groups. When a\nnew product is added to an installation with 47 groups or more and\n\"usebuggroups\" is enabled, the new group will be assigned a groupset\nbit using Perl math that is not exact beyond 248.\nThis results in\nthe new group being defined with a \"bit\" that has several bits set.\nAs users are given access to the new group, those users will also gain\naccess to spurious lower group privileges. Also, group bits were not\nalways reused when groups were deleted.
\nThis problem has been fixed in version 2.14.2-0woody2 for the current\nstable distribution (woody) and will soon be fixed in the unstable\ndistribution (sid). The old stable distribution (potato) doesn't\ncontain a bugzilla package.
\nWe recommend that you upgrade your bugzilla package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nNathan Wallwork discovered a buffer overflow in heartbeat, a subsystem\nfor High-Availability Linux. A remote attacker could send a specially\ncrafted UDP packet that overflows a buffer, leaving heartbeat to\nexecute arbitrary code as root.
\nThis problem has been fixed in version 0.4.9.0l-7.2 for the current\nstable distribution (woody) and version 0.4.9.2-1 for the unstable\ndistribution (sid). The old stable distribution (potato) doesn't\ncontain a heartbeat package.
\nWe recommend that you upgrade your heartbeat package immediately if\nyou run internet connected servers that are heartbeat-monitored.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nBalazs Scheidler discovered a problem in the way syslog-ng handles macro\nexpansion. When a macro is expanded a static length buffer is used\naccompanied by a counter. However, when constant characters are\nappended, the counter is not updated properly, leading to incorrect\nboundary checking. An attacker may be able to use specially crafted\nlog messages inserted via UDP which overflows the buffer.
\nThis problem has been fixed in version 1.5.15-1.1 for the current\nstable distribution (woody), in version 1.4.0rc3-3.2 for the old\nstable distribution (potato) and version 1.5.21-1 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your syslog-ng package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nZen-parse discovered a buffer overflow in gv, a PostScript and PDF\nviewer for X11. This problem is triggered by scanning the PostScript\nfile and can be exploited by an attacker sending a malformed\nPostScript or PDF file. The attacker is able to cause arbitrary code\nto be run with the privileges of the victim.
\nThis problem has been fixed in version 3.5.8-26.1 for the current\nstable distribution (woody), in version 3.5.8-17.1 for the old stable\ndistribution (potato) and version 3.5.8-27 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your gv package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA serious security violation in PAM was discovered.\nDisabled passwords (i.e. those with '*' in the\npassword file) were classified as empty password and access to such\naccounts is granted through the regular login procedure (getty,\ntelnet, ssh). This works for all such accounts whose shell field in\nthe password file does not refer to /bin/false.\nOnly version 0.76 of PAM seems to be affected by this problem.
This problem has been fixed in version 0.76-6 for the current unstable\ndistribution (sid). The stable distribution (woody), the old stable\ndistribution (potato) and the testing distribution (sarge) are not\naffected by this problem.
\nAs stated in the Debian security team FAQ, testing\nand unstable are rapidly moving targets and the security team does not\nhave the resources needed to properly support those. This security\nadvisory is an exception to that rule, due to the seriousness of the\nproblem.
\nWe recommend that you upgrade your PAM packages immediately if you are\nrunning Debian/unstable.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe SuSE Security Team has reviewed critical parts of the Heimdal\npackage such as the kadmind and kdc server. While doing so several\npotential buffer overflows and other bugs have been uncovered and\nfixed. Remote attackers can probably gain remote root access on\nsystems without fixes. Since these services usually run on\nauthentication servers these bugs are considered very serious.
\nThese problems have been fixed in version 0.4e-7.woody.4 for the\ncurrent stable distribution (woody), in version 0.2l-7.4 for the old\nstable distribution (potato) and version 0.4e-21 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your Heimdal packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nZen-parse discovered a buffer overflow in gv, a PostScript and PDF\nviewer for X11. The same code is present in gnome-gv. This problem\nis triggered by scanning the PostScript file and can be exploited by\nan attacker sending a malformed PostScript or PDF file. The attacker\nis able to cause arbitrary code to be run with the privileges of the\nvictim.
\nThis problem has been fixed in version 1.1.96-3.1 for the current\nstable distribution (woody), in version 0.82-2.1 for the old stable\ndistribution (potato) and version 1.99.7-9 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your gnome-gv package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThorsten Kukuck discovered a problem in the ypserv program which is\npart of the Network Information Services (NIS). A memory leak in all\nversions of ypserv prior to 2.5 is remotely exploitable. When a\nmalicious user could request a non-existing map the server will leak\nparts of an old domainname and mapname.
\nThis problem has been fixed in version 3.9-6.1 for the current stable\ndistribution (woody), in version 3.8-2.1 for the old stable\ndistribution (potato) and in version 3.9-6.2 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your nis package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJoe Orton discovered a cross site scripting problem in mod_ssl, an\nApache module that adds Strong cryptography (i.e. HTTPS support) to\nthe webserver. The module will return the server name unescaped in\nthe response to an HTTP request on an SSL port.
\nLike the other recent Apache XSS bugs, this only affects servers using\na combination of \"UseCanonicalName off\" (default in the Debian package\nof Apache) and wildcard DNS. This is very unlikely to happen, though.\nApache 2.0/mod_ssl is not vulnerable since it already escapes this\nHTML.
\nWith this setting turned on, whenever Apache needs to construct a\nself-referencing URL (a URL that refers back to the server the\nresponse is coming from) it will use ServerName and Port to form a\n\"canonical\" name. With this setting off, Apache will use the\nhostname:port that the client supplied, when possible. This also\naffects SERVER_NAME and SERVER_PORT in CGI scripts.
\nThis problem has been fixed in version 2.8.9-2.1 for the current\nstable distribution (woody), in version 2.4.10-1.3.9-1potato4 for the\nold stable distribution (potato) and version 2.8.9-2.3 for the\nunstable distribution (sid).
\nWe recommend that you upgrade your libapache-mod-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nZen-parse discovered a buffer overflow in gv, a PostScript and PDF\nviewer for X11. The same code is present in kghostview which is part\nof the KDE-Graphics package. This problem is triggered by scanning\nthe PostScript file and can be exploited by an attacker sending a\nmalformed PostScript or PDF file. The attacker is able to cause\narbitrary code to be run with the privileges of the victim.
\nThis problem has been fixed in version 2.2.2-6.8 for the current\nstable distribution (woody) and in version 2.2.2-6.9 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since no KDE is included.
\nWe recommend that you upgrade your kghostview package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTom Yu and Sam Hartman of MIT discovered another stack buffer overflow\nin the kadm_ser_wrap_in function in the Kerberos v4 administration\nserver. This kadmind bug has a working exploit code circulating,\nhence it is considered serious. The MIT krb5 implementation\nincludes support for version 4, including a complete v4 library,\nserver side support for krb4, and limited client support for v4.
\nThis problem has been fixed in version 1.2.4-5woody3 for the current\nstable distribution (woody) and in version 1.2.6-2 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since no krb5 packages are included.
\nWe recommend that you upgrade your krb5 packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTom Yu and Sam Hartman of MIT discovered another stack buffer overflow\nin the kadm_ser_wrap_in function in the Kerberos v4 administration\nserver. This kadmind bug has a working exploit code circulating,\nhence it is considered serious.
\nThis problem has been fixed in version 1.1-8-2.2 for the current\nstable distribution (woody), in version 1.0-2.2 for the old stable\ndistribution (potato) and in version 1.1-11-8 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your krb4 packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA stack buffer overflow in the kadm_ser_wrap_in function in the\nKerberos v4 administration server was discovered, which is provided by\nHeimdal as well. A working exploit for this kadmind bug is already\ncirculating, hence it is considered serious. The broken library also\ncontains a vulnerability which could lead to another root exploit.
\nThese problems have been fixed in version 0.4e-7.woody.5 for the\ncurrent stable distribution (woody), in version 0.2l-7.6 for the old\nstable distribution (potato) and in version 0.4e-22 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your heimdal packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nEnrico Zini discovered a buffer overflow in log2mail, a daemon for\nwatching logfiles and sending lines with matching patterns via mail.\nThe log2mail daemon is started upon system boot and runs as root. A\nspecially crafted (remote) log message could overflow a static buffer,\npotentially leaving log2mail to execute arbitrary code as root.
\nThis problem has been fixed in version 0.2.5.1 the current\nstable distribution (woody) and in version 0.2.6-1 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since it doesn't contain a log2mail package.
\nWe recommend that you upgrade your log2mail package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAccording to David Wagner, iDEFENSE and the Apache HTTP Server\nProject, several remotely exploitable vulnerabilities have been found\nin the Apache package, a commonly used webserver. These\nvulnerabilities could allow an attacker to enact a denial of service\nagainst a server or execute a cross scripting attack. The Common\nVulnerabilities and Exposures (CVE) project identified the following\nvulnerabilities:
\nThis is the same vulnerability as CAN-2002-1233, which was fixed in\n potato already but got lost later and was never applied upstream.
These problems have been fixed in version 1.3.26-0woody3 for the\ncurrent stable distribution (woody) and in 1.3.9-14.3 for the old\nstable distribution (potato). Corrected packages for the unstable\ndistribution (sid) are expected soon.
\nWe recommend that you upgrade your Apache package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAccording to David Wagner, iDEFENSE and the Apache HTTP Server\nProject, several vulnerabilities have been found in the Apache\npackage, a commonly used webserver. Most of the code is shared\nbetween the Apache and Apache-SSL packages, so vulnerabilities are\nshared as well. These vulnerabilities could allow an attacker to\nenact a denial of service against a server or execute a cross\nscripting attack, or steal cookies from other web site users.\nVulnerabilities in the included legacy programs htdigest, htpasswd and\nApacheBench can be exploited when called via CGI. Additionally the\ninsecure temporary file creation in htdigest and htpasswd can also be\nexploited locally. The Common Vulnerabilities and Exposures (CVE)\nproject identified the following vulnerabilities:
\nThis is the same vulnerability as CAN-2002-1233, which was fixed in\n potato already but got lost later and was never applied upstream.\n (binaries not included in apache-ssl package though)
These problems have been fixed in version 1.3.26.1+1.48-0woody3 for\nthe current stable distribution (woody) and in 1.3.9.13-4.2 for the\nold stable distribution (potato). Corrected packages for the unstable\ndistribution (sid) are expected soon.
\nWe recommend that you upgrade your Apache-SSL package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\niDEFENSE reported about a vulnerability in LuxMan, a maze game for\nGNU/Linux, similar to the PacMan arcade game. When successfully\nexploited a local attacker gains read-write access to the memory,\nleading to a local root compromise in many ways, examples of which\ninclude scanning the file for fragments of the master password file\nand modifying kernel memory to re-map system calls.
\nThis problem has been fixed in version 0.41-17.1 for the current stable\ndistribution (woody) and in version 0.41-19 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since it doesn't contain a luxman package.
\nWe recommend that you upgrade your luxman package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAl Viro found a problem in the image handling code use in Window Maker,\na popular NEXTSTEP like window manager. When creating an image it would\nallocate a buffer by multiplying the image width and height, but did not\ncheck for an overflow. This makes it possible to overflow the buffer.\nThis could be exploited by using specially crafted image files (for\nexample when previewing themes).
\nThis problem has been fixed in version 0.80.0-4.1 for the current stable\ndistribution (woody). Packages for the mipsel architecture are not yet\navailable.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSeveral cross site scripting vulnerabilities have been found in\nsquirrelmail, a feature-rich webmail package written in PHP4. The\nCommon Vulnerabilities and Exposures (CVE) project identified the\nfollowing vulnerabilities:
\nThese problems have been fixed in version 1.2.6-1.1 for the current stable\ndistribution (woody) and in version 1.2.8-1.1 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since it doesn't contain a squirrelmail package.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe SuSE Security Team found a vulnerability in html2ps, an HTML to\nPostScript converter, that opened files based on unsanitized input\ninsecurely. This problem can be exploited when html2ps is installed\nas filter within lprng and the attacker has previously gained access\nto the lp account.
\nThese problems have been fixed in version 1.0b3-1.1 for the current\nstable distribution (woody), in version 1.0b1-8.1 for the old stable\ndistribution (potato) and in version 1.0b3-2 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your html2ps package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\niDEFENSE reports a security vulnerability in the klisa package, that\nprovides a LAN information service similar to \"Network Neighbourhood\",\nwhich was discovered by Texonet. It is possible for a local attacker\nto exploit a buffer overflow condition in resLISa, a restricted\nversion of KLISa. The vulnerability exists in the parsing of the\nLOGNAME environment variable, an overly long value will overwrite the\ninstruction pointer thereby allowing an attacker to seize control of\nthe executable.
\nThis problem has been fixed in version 2.2.2-14.2 for the current stable\ndistribution (woody) and in version 2.2.2-14.3 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since it doesn't contain a kdenetwork package.
\nWe recommend that you upgrade your klisa package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA set of buffer overflows have been discovered in masqmail, a mail\ntransport agent for hosts without permanent internet connection. In\naddition to this privileges were dropped only after reading a user\nsupplied configuration file. Together this could be exploited to gain\nunauthorized root access to the machine on which masqmail is\ninstalled.
\nThese problems have been fixed in version 0.1.16-2.1 for the current\nstable distribution (woody) and in version 0.2.15-1 for the unstable\ndistribution (sid). The old stable distribution (potato) is not\naffected since it doesn't contain a masqmail package.
\nWe recommend that you upgrade your masqmail package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAccording to David Wagner, iDEFENSE and the Apache HTTP Server\nProject, several vulnerabilities have been found in the Apache server\npackage, a commonly used webserver. Most of the code is shared\nbetween the Apache and Apache-Perl packages, so vulnerabilities are\nshared as well.
\nThese vulnerabilities could allow an attacker to enact a denial of\nservice against a server or execute a cross site scripting attack, or\nsteal cookies from other web site users. The Common Vulnerabilities\nand Exposures (CVE) project identified the following vulnerabilities:
\nThese problems have been fixed in version 1.3.26-1-1.26-0woody2 for\nthe current stable distribution (woody), in\n1.3.9-14.1-1.21.20000309-1.1 for the old stable distribution (potato)\nand in version 1.3.26-1.1-1.27-3-1 for the unstable distribution\n(sid).
\nWe recommend that you upgrade your Apache-Perl package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\n[Bind version 9, the bind9 package, is not affected by these problems.]
\nISS X-Force has discovered several serious vulnerabilities in the Berkeley\nInternet Name Domain Server (BIND). BIND is the most common implementation\nof the DNS (Domain Name Service) protocol, which is used on the vast\nmajority of DNS servers on the Internet. DNS is a vital Internet protocol\nthat maintains a database of easy-to-remember domain names (host names) and\ntheir corresponding numerical IP addresses.
\nCircumstantial evidence suggests that the Internet Software Consortium\n(ISC), maintainers of BIND, was made aware of these issues in mid-October.\nDistributors of Open Source operating systems, including Debian, were\nnotified of these vulnerabilities via CERT about 12 hours before the release\nof the advisories on November 12th. This notification did not include any\ndetails that allowed us to identify the vulnerable code, much less prepare\ntimely fixes.
\nUnfortunately ISS and the ISC released their security advisories with only\ndescriptions of the vulnerabilities, without any patches. Even though there\nwere no signs that these exploits are known to the black-hat community, and\nthere were no reports of active attacks, such attacks could have been\ndeveloped in the meantime - with no fixes available.
\nWe can all express our regret at the inability of the ironically named\nInternet Software Consortium to work with the Internet community in handling\nthis problem. Hopefully this will not become a model for dealing with\nsecurity issues in the future.
\nThe Common Vulnerabilities and Exposures (CVE) project identified the\nfollowing vulnerabilities:
\nThese problems have been fixed in version 8.3.3-2.0woody1 for the current\nstable distribution (woody), in version 8.2.3-0.potato.3 for the previous stable\ndistribution (potato) and in version 8.3.3-3 for the unstable distribution\n(sid). The fixed packages for unstable will enter the archive today.
\nWe recommend that you upgrade your bind package immediately, update to\nbind9, or switch to another DNS server implementation.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem in the Courier sqwebmail package, a CGI program to grant\nauthenticated access to local mailboxes, has been discovered. The\nprogram did not drop permissions fast enough upon startup under\ncertain circumstances so a local shell user can execute the sqwebmail\nbinary and manage to read an arbitrary file on the local filesystem.
\nThis problem has been fixed in version 0.37.3-2.3 for the current\nstable distribution (woody) and in version 0.40.0-1 for the unstable\ndistribution (sid). The old stable distribution (potato) does not\ncontain Courier sqwebmail packages. courier-ssl packages\nare also not affected since they don't expose an sqwebmail package.
We recommend that you upgrade your sqwebmail package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem has been discovered in nullmailer, a simple relay-only mail\ntransport agent for hosts that relay mail to a fixed set of smart\nrelays. When a mail is to be delivered locally to a user that doesn't\nexist, nullmailer tries to deliver it, discovers a user unknown error\nand stops delivering. Unfortunately, it stops delivering entirely,\nnot only this mail. Hence, it's very easy to craft a denial of service.
\nThis problem has been fixed in version 1.00RC5-16.1woody2 for the\ncurrent stable distribution (woody) and in version 1.00RC5-17 for the\nunstable distribution (sid). The old stable distribution (potato)\ndoes not contain a nullmailer package.
\nWe recommend that you upgrade your nullmailer package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteven Christey discovered a cross site scripting vulnerability in\nmhonarc, a mail to HTML converter. Carefully crafted message headers\ncan introduce cross site scripting when mhonarc is configured to\ndisplay all headers lines on the web. However, it is often useful to\nrestrict the displayed header lines to To, From and Subject, in which\ncase the vulnerability cannot be exploited.
\nThis problem has been fixed in version 2.5.2-1.2 for the current\nstable distribution (woody), in version 2.4.4-1.2 for the old stable\ndistribution (potato) and in version 2.5.13-1 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your mhonarc package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Langasek found an exploitable bug in the password handling\ncode in samba: when converting from DOS code-page to little endian\nUCS2 unicode a buffer length was not checked and a buffer could\nbe overflowed. There is no known exploit for this, but an upgrade\nis strongly recommended.
\nThis problem has been fixed in version 2.2.3a-12 of the Debian\nsamba packages and upstream version 2.2.7.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nBindview discovered a problem in several IPSEC implementations that do\nnot properly handle certain very short packets. IPSEC is a set of\nsecurity extensions to IP which provide authentication and encryption.\nFree/SWan in Debian is affected by this and is said to cause a kernel\npanic.
\nThis problem has been fixed in version 1.96-1.4 for the current stable\ndistribution (woody) and in version 1.99-1 for the unstable\ndistribution (sid). The old stable distribution (potato) does not\ncontain Free/SWan packages.
\nWe recommend that you upgrade your freeswan package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTatsuya Kinoshita discovered that IM, which contains interface\ncommands and Perl libraries for E-mail and NetNews, creates temporary\nfiles insecurely.
\nThese problems have been fixed in version 141-18.1 for the current\nstable distribution (woody), in version 133-2.2 of the old stable\ndistribution (potato) and in version 141-20 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your IM package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nRobert Luberda found a security problem in smb2www, a Windows Network\nclient that is accessible through a web browser. This could lead a\nremote attacker to execute arbitrary programs under the user id\nwww-data on the host where smb2www is running.
\nThis problem has been fixed in version 980804-16.1 for the current\nstable distribution (woody), in version 980804-8.1 of the old stable\ndistribution (potato) and in version 980804-17 for the unstable\ndistribution (sid).
\nWe recommend that you upgrade your smb2www package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team has discovered a vulnerability in the support for various\nnetwork protocols via the KIO. The implementation of the rlogin and telnet\nprotocols allows a carefully crafted URL in an HTML page, HTML email or\nother KIO-enabled application to execute arbitrary commands on the\nsystem using the victim's account on the vulnerable machine.
\nThis problem has been fixed by disabling rlogin and telnet in version\n2.2.2-13.woody.5 for the current stable distribution (woody). The old\nstable distribution (potato) is not affected since it doesn't contain\nKDE. A correction for the package in the unstable distribution (sid)\nis not yet available.
\nWe recommend that you upgrade your kdelibs3 package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp and James Antill found several buffer overflows in the\ngtetrinet (a multiplayer tetris-like game) package as shipped in\nDebian GNU/Linux 3.0, which could be abused by a malicious server.
\nThis has been fixed in upstream version 0.4.4 and release\n0.4.1-9woody1.1 of the Debian package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe BGP decoding routines for tcpdump used incorrect bounds checking\nwhen copying data. This could be abused by introducing malicious traffic\non a sniffed network for a denial of service attack against tcpdump,\nor possibly even remote code execution.
\nThis has been fixed in version 3.6.2-2.2.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe SuSE security team discovered a vulnerability in kpathsea library\n(libkpathsea) which is used by xdvi and dvips. Both programs call the\nsystem() function insecurely, which allows a remote attacker to\nexecute arbitrary commands via cleverly crafted DVI files.
\nIf dvips is used in a print filter, this allows a local or remote\nattacker with print permission execute arbitrary code as the printer\nuser (usually lp).
\nThis problem has been fixed in version 1.0.7+20011202-7.1 for the\ncurrent stable distribution (woody), in version 1.0.6-7.3 for the old\nstable distribution (potato) and in version 1.0.7+20021025-4 for the\nunstable distribution (sid). xdvik-ja and dvipsk-ja are vulnerable as\nwell, but link to the kpathsea library dynamically and will\nautomatically be fixed after a new libkpathsea is installed.
\nWe recommend that you upgrade your tetex-lib package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA security hole has been discovered in Safe.pm which is used in all\nversions of Perl. The Safe extension module allows the creation of\ncompartments in which perl code can be evaluated in a new namespace\nand the code evaluated in the compartment cannot refer to variables\noutside this namespace. However, when a Safe compartment has already\nbeen used, there's no guarantee that it is Safe any longer, because\nthere's a way for code to be executed within the Safe compartment to\nalter its operation mask. Thus, programs that use a Safe compartment\nonly once aren't affected by this bug.
\nThis problem has been fixed in version 5.6.1-8.2 for the current\nstable distribution (woody), in version 5.004.05-6.2 and 5.005.03-7.2\nfor the old stable distribution (potato) and in version 5.8.0-14 for\nthe unstable distribution (sid).
\nWe recommend that you upgrade your Perl packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTwo problems have been found in the wget package as distributed in\nDebian GNU/Linux:
\nBoth problems have been fixed in version 1.5.3-3.1 for Debian GNU/Linux\n2.2/potato and version 1.8.1-6.1 for Debian GNU/Linux 3.0/woody.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nlynx (a text-only web browser) did not properly check for illegal\ncharacters in all places, including processing of command line options,\nwhich could be used to insert extra HTTP headers in a request.
\nFor Debian GNU/Linux 2.2/potato this has been fixed in version 2.8.3-1.1\nof the lynx package and version 2.8.3.1-1.1 of the lynx-ssl package.
\nFor Debian GNU/Linux 3.0/woody this has been fixed in version 2.8.4.1b-3.2\nof the lynx package and version 1:2.8.4.1b-3.1 of the lynx-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nR\u00fcdiger Kuhlmann, upstream developer of mICQ, a text based ICQ client,\ndiscovered a problem in mICQ. Receiving certain ICQ message types\nthat do not contain the required 0xFE separator causes all versions to\ncrash.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.4.9-0woody3.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 0.4.3-4.1.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 0.4.9.4-1.
\nWe recommend that you upgrade your micq package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nWhile performing an audit of MySQL e-matters found several problems:
\nFor Debian GNU/Linux 3.0/woody this has been fixed in version 3.23.49-8.2\nand version 3.22.32-6.3 for Debian GNU/Linux 2.2/potato.
\nWe recommend that you upgrade your mysql packages as soon as possible.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nGlenn Randers-Pehrson discovered a problem in connection with 16-bit\nsamples from libpng, an interface for reading and writing PNG\n(Portable Network Graphics) format files. The starting offsets for\nthe loops are calculated incorrectly which causes a buffer overrun\nbeyond the beginning of the row buffer.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.0.12-3.woody.3 for libpng and in version\n1.2.1-1.1.woody.3 for libpng3.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 1.0.5-1.1 for libpng. There are no other libpng packages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.12-7 for libpng and in version 1.2.5-8 for libpng3.
\nWe recommend that you upgrade your libpng packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nOlaf Kirch from SuSE Linux AG discovered another vulnerability in the\nklisa package, that provides a LAN information service similar to\n\"Network Neighbourhood\". The lisa daemon contains a buffer overflow\nvulnerability which potentially enables any local user, as well as\nany remote attacker on the LAN who is able to gain control of the LISa\nport (7741 by default), to obtain root privileges. In addition, a\nremote attacker potentially may be able to gain access to a victim's\naccount by using an \"rlan://\" URL in an HTML page or via another KDE\napplication.
\nThis problem has been fixed in version 2.2.2-14.5 for the current\nstable distribution (woody) and in version 2.2.2-14.20 for the\nunstable distribution (sid). The old stable distribution (potato) is\nnot affected since it doesn't contain a kdenetwork package.
\nWe recommend that you upgrade your klisa package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTimo Sirainen discovered a buffer overflow in the Cyrus IMAP server,\nwhich could be exploited by a remote attacker prior to logging in. A\nmalicious user could craft a request to run commands on the server under\nthe UID and GID of the cyrus server.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.5.19-9.1.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 1.5.19-2.2.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 1.5.19-9.10. Current cyrus21-imapd packages are not\nvulnerable.
\nWe recommend that you upgrade your cyrus-imapd package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nStefan Esser of e-matters discovered a buffer overflow in fetchmail,\nan SSL enabled POP3, APOP and IMAP mail gatherer/forwarder. When\nfetchmail retrieves a mail all headers that contain addresses are\nsearched for local addresses. If a hostname is missing, fetchmail\nappends it but doesn't reserve enough space for it. This heap\noverflow can be used by remote attackers to crash it or to execute\narbitrary code with the privileges of the user running fetchmail.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 5.9.11-6.2 of fetchmail and fetchmail-ssl.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 5.3.3-4.3.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 6.2.0-1 of fetchmail and fetchmail-ssl.
\nWe recommend that you upgrade your fetchmail packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem has been discovered in the typespeed, a game that lets you\nmeasure your typematic speed. By overflowing a buffer a local\nattacker could execute arbitrary commands under the group id games.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.4.1-2.1.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 0.4.0-5.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.4.2-2.
\nWe recommend that you upgrade your typespeed package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA cross site scripting vulnerability has been reported for Bugzilla, a\nweb-based bug tracking system. Bugzilla does not properly sanitize\nany input submitted by users for use in quips. As a result, it is possible for a\nremote attacker to create a malicious link containing script code\nwhich will be executed in the browser of a legitimate user, in the\ncontext of the website running Bugzilla. This issue may be exploited\nto steal cookie-based authentication credentials from legitimate users\nof the website running the vulnerable software.
\nThis vulnerability only affects users who have the 'quips' feature\nenabled and who upgraded from version 2.10 which did not exist inside\nof Debian. The Debian package history of Bugzilla starts with 1.13\nand jumped to 2.13. However, users could have installed version 2.10\nprior to the Debian package.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.14.2-0woody3.
\nThe old stable distribution (potato) does not contain a Bugzilla\npackage.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your bugzilla packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSimon Kelly discovered a vulnerability in dhcpcd, an RFC2131 and\nRFC1541 compliant DHCP client daemon, that runs with root privileges\non client machines. A malicious administrator of the regular or an\nuntrusted DHCP server may execute any command with root privileges on\nthe DHCP client machine by sending the command enclosed in shell\nmetacharacters in one of the options provided by the DHCP server.
\nThis problem has been fixed in version 1.3.17pl2-8.1 for the old\nstable distribution (potato) and in version 1.3.22pl2-2 for the\ntesting (sarge) and unstable (sid) distributions. The current stable\ndistribution (woody) does not contain a dhcpcd package.
\nWe recommend that you upgrade your dhcpcd package (on the client\nmachine).
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA cross site scripting vulnerability has been discovered in\nsquirrelmail, a feature-rich webmail package written in PHP4.\nSquirrelmail doesn't sanitize user provided variables in all places,\nleaving it vulnerable to a cross site scripting attack.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.2.6-1.3. The old stable distribution (potato) is\nnot affected since it doesn't contain a squirrelmail package.
\nAn updated package for the unstable distribution (sid) is\nexpected soon.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nEarl Hood, author of mhonarc, a mail to HTML converter, discovered a\ncross site scripting vulnerability in this package. A specially\ncrafted HTML mail message can introduce foreign scripting content in\narchives, by-passing MHonArc's HTML script filtering.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.5.2-1.3.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 2.4.4-1.3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.5.14-1.
\nWe recommend that you upgrade your mhonarc package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\niDEFENSE discovered an integer overflow in the pdftops filter from the\nxpdf package that can be exploited to gain the privileges of the\ntarget user. This can lead to gaining unauthorized access to the 'lp'\nuser if the pdftops program is part of the print filter.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.00-3.1.
\nFor the old stable distribution (potato) this problem has been\nfixed in version 0.90-8.1.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 2.01-2.
\nWe recommend that you upgrade your xpdf package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA security issue has been discovered by Daniel de Rauglaudre, upstream\nauthor of geneweb, a genealogical software with web interface. It\nruns as a daemon on port 2317 by default. Paths are not properly\nsanitized, so a carefully crafted URL lead geneweb to read and display\narbitrary files of the system it runs on.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 4.06-2.
\nThe old stable distribution (potato) is not affected.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 4.09-1.
\nWe recommend that you upgrade your geneweb package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSeveral vulnerabilities have been discovered in canna, a Japanese\ninput system. The Common Vulnerabilities and Exposures (CVE) project\nidentified the following vulnerabilities:
\nFor the current stable distribution (woody) these problems have been\nfixed in version 3.5b2-46.2.
\nFor the old stable distribution (potato) these problems have been\nfixed in version 3.5b2-25.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.6p1-1.
\nWe recommend that you upgrade your canna packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA security vulnerability has been confirmed to exist in Apache Tomcat\n4.0.x releases, which allows to use a specially crafted URL to return\nthe unprocessed source of a JSP page, or, under special circumstances,\na static resource which would otherwise have been protected by a\nsecurity constraint, without the need for being properly\nauthenticated. This is based on a variant of the exploit that was\nidentified as CAN-2002-1148.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 4.0.3-3woody2.
\nThe old stable distribution (potato) does not contain tomcat packages.
\nFor the unstable distribution (sid) this problem does not exist in the\ncurrent version 4.1.16-1.
\nWe recommend that you upgrade your tomcat packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\niDEFENSE discovered an integer overflow in the pdftops filter from the\nxpdf and xpdf-i packages that can be exploited to gain the privileges\nof the target user. This can lead to gaining unauthorized access to the\n'lp' user if the pdftops program is part of the print filter.
\nFor the current stable distribution (woody) xpdf-i is only a dummy\npackage and the problem was fixed in xpdf already.
\nFor the old stable distribution (potato) this problem has been\nfixed in version 0.90-8.1.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 2.01-2.
\nWe recommend that you upgrade your xpdf-i package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe SuSE Security Team reviewed critical parts of openldap2, an\nimplementation of the Lightweight Directory Access Protocol (LDAP)\nversion 2 and 3, and found several buffer overflows and other bugs\nremote attackers could exploit to gain access on systems running\nvulnerable LDAP servers. In addition to these bugs, various local\nexploitable bugs within the OpenLDAP2 libraries have been fixed.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 2.0.23-6.3.
\nThe old stable distribution (potato) does not contain OpenLDAP2\npackages.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.27-3.
\nWe recommend that you upgrade your openldap2 packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nIlia Alshanetsky discovered several buffer overflows in libmcrypt, a\ndecryption and encryption library, that originates from improper or\nlacking input validation. By passing input which is longer than\nexpected to a number of functions (multiple functions are affected)\nthe user can successfully make libmcrypt crash and may be able to insert\narbitrary, malicious code which will be executed under the user\nlibmcrypt runs as, e.g. inside a web server.
\nAnother vulnerability exists in the way libmcrypt loads algorithms via\nlibtool. When different algorithms are loaded dynamically, each time\nan algorithm is loaded a small part of memory is leaked. In a\npersistent environment (web server) this could lead to a memory\nexhaustion attack that will exhaust all available memory by launching\nrepeated requests at an application utilizing the mcrypt library.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 2.5.0-1woody1.
\nThe old stable distribution (potato) does not contain libmcrypt packages.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.5.5-1.
\nWe recommend that you upgrade your libmcrypt packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJouko Pynnonen discovered a problem with IMP, a web based IMAP mail\nprogram. Using carefully crafted URLs a remote attacker is able to\ninject SQL code into SQL queries without proper user authentication.\nEven though results of SQL queries aren't directly readable from the\nscreen, an attacker might update their mail signature to contain wanted\nquery results and then view it on the preferences page of IMP.
\nThe impact of SQL injection depends heavily on the underlying database\nand its configuration. If PostgreSQL is used, it's possible to\nexecute multiple complete SQL queries separated by semicolons. The\ndatabase contains session id's so the attacker might hijack sessions\nof people currently logged in and read their mail. In the worst case,\nif the hordemgr user has the required privilege to use the COPY SQL\ncommand (found in PostgreSQL at least), a remote user may read or\nwrite to any file the database user (postgres) can. The attacker may\nthen be able to run arbitrary shell commands by writing them to the\npostgres user's ~/.psqlrc; they'd be run when the user starts the psql\ncommand which under some configurations happens regularly from a cron\nscript.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.2.6-5.1.
\nFor the old stable distribution (potato) this problem has been\nfixed in version 2.2.6-0.potato.5.1.
\nFor the unstable distribution (sid) this problem have been fixed in\nversion 2.2.6-7.
\nWe recommend that you upgrade your IMP packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nTwo vulnerabilities have been discovered in Bugzilla, a web-based bug\ntracking system, by its authors. The Common Vulnerabilities and\nExposures Project identifies the following vulnerabilities:
\n\n The provided data collection\n script intended to be run as a nightly cron job changes the\n permissions of the data/mining directory to be world-writable every\n time it runs. This would enable local users to alter or delete the\n collected data.\n
\n\n The default .htaccess scripts\n provided by checksetup.pl do not block access to backups of the\n localconfig file that might be created by editors such as vi or\n emacs (typically these will have a .swp or ~ suffix). This allows\n an end user to download one of the backup copies and potentially\n obtain your database password.\n
\n\n This does not affect the Debian installation because there is no\n .htaccess as all data file aren't under the CGI path as they are on\n the standard Bugzilla package. Additionally, the configuration is\n in /etc/bugzilla/localconfig and hence outside of the web directory.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 2.14.2-0woody4.
\nThe old stable distribution (potato) does not contain a Bugzilla\npackage.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your bugzilla packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe Internet Software Consortium discovered several vulnerabilities\nduring an audit of the ISC DHCP Daemon. The vulnerabilities exist in\nerror handling routines within the minires library and may be\nexploitable as stack overflows. This could allow a remote attacker to\nexecute arbitrary code under the user id the dhcpd runs under, usually\nroot. Other DHCP servers than dhcp3 doesn't seem to be affected.
\nFor the stable distribution (woody) this problem has been\nfixed in version 3.0+3.0.1rc9-2.1.
\nThe old stable distribution (potato) does not contain dhcp3 packages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.0+3.0.1rc11-1.
\nWe recommend that you upgrade your dhcp3-server package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMultiple vulnerabilities were discovered in the Common Unix Printing\nSystem (CUPS). Several of these issues represent the potential for a\nremote compromise or denial of service. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\n/etc/cups/certs/\n allow local users with lp privileges to create or overwrite\n arbitrary files. This is not present in the potato version.Even though we tried very hard to fix all problems in the packages for\npotato as well, the packages may still contain other security related\nproblems. Hence, we advise users of potato systems using CUPS to\nupgrade to woody soon.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 1.1.14-4.3.
\nFor the old stable distribution (potato), these problems have been fixed\nin version 1.0.4-12.1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.1.18-1.
\nWe recommend that you upgrade your CUPS packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nStefan Esser discovered a problem in cvs, a concurrent versions\nsystem, which is used for many Free Software projects. The current\nversion contains a flaw that can be used by a remote attacker to\nexecute arbitrary code on the CVS server under the user id the CVS\nserver runs as. Anonymous read-only access is sufficient to exploit\nthis problem.
\nFor the stable distribution (woody) this problem has been\nfixed in version 1.11.1p1debian-8.1.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 1.10.7-9.2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your cvs package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-7.2.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-6.10.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-13.woody.6.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-14.6.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-5.2.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-3.2.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-2.2.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-9.2.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been fixed\nin version 2.2.2-14.2.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered several vulnerabilities in the K Desktop\nEnvironment. In some instances KDE fails to properly quote parameters\nof instructions passed to a command shell for execution. These\nparameters may incorporate data such as URLs, filenames and e-mail\naddresses, and this data may be provided remotely to a victim in an\ne-mail, a webpage or files on a network filesystem or other untrusted\nsource.
\nBy carefully crafting such data an attacker might be able to execute\narbitrary commands on a vulnerable system using the victim's account and\nprivileges. The KDE Project is not aware of any existing exploits of\nthese vulnerabilities. The patches also provide better safe guards\nand check data from untrusted sources more strictly in multiple\nplaces.
\nFor the current stable distribution (woody), these problems have been\nfixed in version 2.2.2-8.2. Please note that we are unable to provide\nupdated packages for both MIPS architectures since the compilation of\nkdemultimedia triggers an internal compiler error on these machines.
\nThe old stable distribution (potato) does not contain KDE packages.
\nFor the unstable distribution (sid), these problems will most probably\nnot be fixed but new packages for KDE 3.1 for sid are expected for\nthis year.
\nWe recommend that you upgrade your KDE packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nDan Jacobson noticed a problem in noffle, an offline news server, that\nleads to a segmentation fault. It is not yet clear whether this\nproblem is exploitable. However, if it is, a remote attacker could\ntrigger arbitrary code execution under the user that calls noffle,\nprobably news.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.1-1.1.
\nThe old stable distribution (potato) does not contain a noffle\npackage.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.2-1.
\nWe recommend that you upgrade your noffle package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nFlorian Lohoff discovered a bug in the dhcrelay causing it to send a\ncontinuing packet storm towards the configured DHCP server(s) in case\nof a malicious BOOTP packet, such as sent from buggy Cisco switches.
\nWhen the dhcp-relay receives a BOOTP request it forwards the request\nto the DHCP server using the broadcast MAC address ff:ff:ff:ff:ff:ff\nwhich causes the network interface to reflect the packet back into the\nsocket. To prevent loops the dhcrelay checks whether the\nrelay-address is its own, in which case the packet would be dropped.\nIn combination with a missing upper boundary for the hop counter an\nattacker can force the dhcp-relay to send a continuing packet storm\ntowards the configured dhcp server(s).
\nThis patch introduces a new command line switch -c maxcount and\npeople are advised to start the dhcp-relay with dhcrelay -c 10\nor a smaller number, which will only create that many packets.
\nThe dhcrelay program from the \"dhcp\" package does not seem to be\naffected since DHCP packets are dropped if they were apparently\nrelayed already.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.0+3.0.1rc9-2.2.
\nThe old stable distribution (potato) does not contain dhcp3 packages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.2-1.
\nWe recommend that you upgrade your dhcp3 package when you are using\nthe dhcrelay server.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe developers of tomcat discovered several problems in tomcat version\n3.x. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.3a-4woody.1.
\nThe old stable distribution (potato) does not contain tomcat packages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.3.1a-1.
\nWe recommend that you upgrade your tomcat package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe developers of courier, an integrated user side mail server,\ndiscovered a problem in the PostgreSQL auth module. Not all\npotentially malicious characters were sanitized before the username\nwas passed to the PostgreSQL engine. An attacker could inject\narbitrary SQL commands and queries exploiting this vulnerability. The\nMySQL auth module is not affected.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.37.3-3.3.
\nThe old stable distribution (potato) does not contain courier packages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.40.2-3.
\nWe recommend that you upgrade your courier-authpostgresql package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nUlf H\u00e4rnhammar discovered two problems in hypermail, a program to\ncreate HTML archives of mailing lists.
\nAn attacker could craft a long filename for an attachment that would\noverflow two buffers when a certain option for interactive use was\ngiven, opening the possibility to inject arbitrary code. This code\nwould then be executed under the user id hypermail runs as, mostly as\na local user. Automatic and silent use of hypermail does not seem to\nbe affected.
\nThe CGI program mail, which is not installed by the Debian package,\ndoes a reverse look-up of the user's IP number and copies the\nresulting hostname into a fixed-size buffer. A specially crafted DNS\nreply could overflow this buffer, opening the program to an exploit.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.1.3-2.0.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 2.0b25-1.1.
\nFor the unstable distribution (sid) this problem has been fixed\nin version 2.1.6-1.
\nWe recommend that you upgrade your hypermail packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nHironori Sakamoto, one of the w3m developers, found two security\nvulnerabilities in w3m and associated programs. The w3m browser does\nnot properly escape HTML tags in frame contents and img alt\nattributes. A malicious HTML frame or img alt attribute may deceive a\nuser to send their local cookies which are used for configuration. The\ninformation is not leaked automatically, though.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.3.p23.3-1.5. Please note that the update also contains an\nimportant patch to make the program work on the powerpc platform again.
\nThe old stable distribution (potato) is not affected by these\nproblems.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.3.p24.17-3 and later.
\nWe recommend that you upgrade your w3mmee packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nHironori Sakamoto, one of the w3m developers, found two security\nvulnerabilities in w3m and associated programs. The w3m browser does\nnot properly escape HTML tags in frame contents and img alt\nattributes. A malicious HTML frame or img alt attribute may deceive a\nuser to send their local cookies which are used for configuration. The\ninformation is not leaked automatically, though.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.3.p23.3-1.5. Please note that the update also contains an\nimportant patch to make the program work on the powerpc platform again.
\nThe old stable distribution (potato) is not affected by these\nproblems.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.3.p24.17-3 and later.
\nWe recommend that you upgrade your w3mmee-ssl packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nHironori Sakamoto, one of the w3m developers, found two security\nvulnerabilities in w3m and associated programs. The w3m browser does\nnot properly escape HTML tags in frame contents and img alt\nattributes. A malicious HTML frame or img alt attribute may deceive a\nuser to send their local cookies which are used for configuration. The\ninformation is not leaked automatically, though.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.3-2.4.
\nThe old stable distribution (potato) is not affected by these\nproblems.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.3.2.2-1 and later.
\nWe recommend that you upgrade your w3m and w3m-ssl packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem has been discovered in slocate, a secure locate replacement.\nA buffer overflow in the setgid program slocate can be used to execute\narbitrary code as group slocate. This can be used to alter the\nslocate database.
\nFor the stable distribution (woody) this problem has been\nfixed in version 2.6-1.3.1.
\nThe old stable distribution (potato) is not affected by this problem.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.7-1.
\nWe recommend that you upgrade your slocate package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA vulnerability has been discovered in OpenSSL, a Secure Socket Layer\n(SSL) implementation. In an upcoming paper, Brice Canvel (EPFL),\nAlain Hiltgen (UBS), Serge Vaudenay (EPFL), and Martin Vuagnoux (EPFL,\nIlion) describe and demonstrate a timing-based attack on CBC cipher\nsuites used in SSL and TLS. OpenSSL has been found to be vulnerable to\nthis attack.
\nFor the stable distribution (woody) this problem has been\nfixed in version 0.9.6c-2.woody.2.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 0.9.6c-0.potato.5. Please note that this updates the\nversion from potato-proposed-updates that supersedes the version in\npotato.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.7a-1.
\nWe recommend that you upgrade your openssl packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA vulnerability has been discovered in NANOG traceroute, an enhanced\nversion of the Van Jacobson/BSD traceroute program. A buffer overflow\noccurs in the 'get_origin()' function. Due to insufficient bounds\nchecking performed by the whois parser, it may be possible to corrupt\nmemory on the system stack. This vulnerability can be exploited by a\nremote attacker to gain root privileges on a target host. Though,\nmost probably not in Debian.
\nThe Common Vulnerabilities and Exposures (CVE) project additionally\nidentified the following vulnerabilities which were already fixed in\nthe Debian version in stable (woody) and oldstable (potato) and are\nmentioned here for completeness (and since other distributions had to\nrelease a separate advisory for them):
\nFortunately, the Debian package drops privileges quite early after\nstartup, so those problems are not likely to result in an exploit on a\nDebian machine.
\nFor the current stable distribution (woody) the above problem has been\nfixed in version 6.1.1-1.2.
\nFor the old stable distribution (potato) the above problem has been\nfixed in version 6.0-2.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 6.3.0-1.
\nWe recommend that you upgrade your traceroute-nanog package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAndrew Griffiths and iDEFENSE Labs discovered a problem in tcpdump, a\npowerful tool for network monitoring and data acquisition. An\nattacker is able to send a specially crafted network packet which\ncauses tcpdump to enter an infinite loop.
\nIn addition to the above problem the tcpdump developers discovered a\npotential infinite loop when parsing malformed BGP packets. They also\ndiscovered a buffer overflow that can be exploited with certain\nmalformed NFS packets.
\nFor the stable distribution (woody) these problems have been\nfixed in version 3.6.2-2.3.
\nThe old stable distribution (potato) does not seem to be affected\nby these problems.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.7.1-1.2.
\nWe recommend that you upgrade your tcpdump packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem has been discovered in adb2mhc from the mhc-utils package. The\ndefault temporary directory uses a predictable name. This adds a\nvulnerability that allows a local attacker to overwrite arbitrary\nfiles the users has write permissions for.
\nFor the stable distribution (woody) this problem has been\nfixed in version 0.25+20010625-7.1.
\nThe old stable distribution (potato) does not contain mhc\npackages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.25+20030224-1.
\nWe recommend that you upgrade your mhc-utils packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMark Dowd of ISS X-Force found a bug in the header parsing routines\nof sendmail: it could overflow a buffer overflow when encountering\naddresses with very long comments. Since sendmail also parses headers\nwhen forwarding emails this vulnerability can hit mail-servers which do\nnot deliver the email as well.
\nThis has been fixed in upstream release 8.12.8, version 8.12.3-5 of\nthe package for Debian GNU/Linux 3.0/woody and version 8.9.3-25 of the\npackage for Debian GNU/Linux 2.2/potato.
\nDSA-257-2: Updated sendmail-wide packages are available in package\nversion 8.9.3+3.2W-24 for Debian 2.2 (potato) and\nversion 8.12.3+3.5Wbeta-5.2 for Debian 3.0 (woody).
\nMD5 checksums of the listed files are available in the original advisory.\n(DSA-257-2)\n
\n\n\nGeorgi Guninski discovered a problem in ethereal, a network traffic\nanalyzer. The program contains a format string vulnerability that\ncould probably lead to execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.4-1woody3.
\nThe old stable distribution (potato) does not seem to be affected\nby this problem.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.9-2.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nFlorian Heinz heinz@cronon-ag.de posted to the Bugtraq mailing list an\nexploit for qpopper based on a bug in the included vsnprintf implementation.\nThe sample exploit requires a valid user account and password, and overflows a\nstring in the pop_msg() function to give the user \"mail\" group privileges and a\nshell on the system. Since the Qvsnprintf function is used elsewhere in\nqpopper, additional exploits may be possible.
\nThe qpopper package in Debian 2.2 (potato) does not include the vulnerable\nsnprintf implementation. For Debian 3.0 (woody) an updated package is available\nin version 4.0.4-2.woody.3. Users running an unreleased version of Debian\nshould upgrade to 4.0.4-9 or newer. We recommend you upgrade your qpopper\npackage immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\n\niDEFENSE discovered a buffer overflow vulnerability in the ELF format\nparsing of the \"file\" command, one which can be used to execute\narbitrary code with the privileges of the user running the command. The\nvulnerability can be exploited by crafting a special ELF binary which is\nthen input to file. This could be accomplished by leaving the binary on\nthe file system and waiting for someone to use file to identify it, or\nby passing it to a service that uses file to classify input. (For\nexample, some printer filters run file to determine how to process input\ngoing to a printer.)
\nFixed packages are available in version 3.28-1.potato.1 for Debian 2.2\n(potato) and version 3.37-3.1.woody.1 for Debian 3.0 (woody). We\nrecommend you upgrade your file package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem has been discovered in tcpdump, a powerful tool for network\nmonitoring and data acquisition. An attacker is able to send a\nspecially crafted RADIUS network packet which causes tcpdump to enter\nan infinite loop.
\nFor the stable distribution (woody) this problem has been\nfixed in version 3.6.2-2.4.
\nThe old stable distribution (potato) does not seem to be affected\nby this problem.
\nThe unstable distribution (sid) is not affected by this problem anymore.
\nWe recommend that you upgrade your tcpdump package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSebastian Krahmer of the SuSE security audit team found two problems\nin samba, a popular SMB/CIFS implementation. The problems are:
\nBoth problems have been fixed in upstream version 2.2.8, and version\n2.2.3a-12.1 of package for Debian GNU/Linux 3.0/woody.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAl Viro and Alan Cox discovered several maths overflow errors in\nNetPBM, a set of graphics conversion tools. These programs are not\ninstalled setuid root but are often installed to prepare data for\nprocessing. These vulnerabilities may allow remote attackers to cause\na denial of service or execute arbitrary code.
\nFor the stable distribution (woody) this problem has been\nfixed in version 9.20-8.2.
\nThe old stable distribution (potato) does not seem to be affected\nby this problem.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 9.20-9.
\nWe recommend that you upgrade your netpbm package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nUpstream developers of lxr, a general hypertext cross-referencing\ntool, have been alerted of a vulnerability that allows a remote\nattacker to read arbitrary files on the host system as user www-data.\nThis could disclose local files that were not meant to be shared with\nthe public.
\nFor the stable distribution (woody) this problem has been\nfixed in version 0.3-3.
\nThe old stable distribution (potato) is not affected since it does not\ncontain an lxr package.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 0.3-4.
\nWe recommend that you upgrade your lxr package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nR\u00e9mi Perrot fixed several security related bugs in the bonsai, the\nMozilla CVS query tool by web interface. Vulnerabilities include\narbitrary code execution, cross-site scripting and access to\nconfiguration parameters. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.3+cvs20020224-1woody1.
\nThe old stable distribution (potato) is not affected since it doesn't\ncontain bonsai.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3+cvs20030317-1.
\nWe recommend that you upgrade your bonsai package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSeveral vulnerabilities have been discovered in krb5, an\nimplementation of MIT Kerberos.
\nKerberos version 5 does not contain this cryptographic\n vulnerability. Sites are not vulnerable if they have Kerberos v4\n completely disabled, including the disabling of any krb5 to krb4\n translation services.
\n\nThis version of the krb5 package changes the default behavior and\ndisallows cross-realm authentication for Kerberos version 4. Because\nof the fundamental nature of the problem, cross-realm authentication\nin Kerberos version 4 cannot be made secure and sites should avoid its\nuse. A new option (-X) is provided to the krb5kdc and krb524d\ncommands to re-enable version 4 cross-realm authentication for those\nsites that must use this functionality but desire the other security\nfixes.\n
\nFor the stable distribution (woody) this problem has been\nfixed in version 1.2.4-5woody4.
\nThe old stable distribution (potato) does not contain krb5 packages.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your krb5 package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA buffer overflow has been discovered in lpr, a BSD lpr/lpd line\nprinter spooling system. This problem can be exploited by a local\nuser to gain root privileges, even if the printer system is set up\nproperly.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2000.05.07-4.3.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 0.48-1.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2000.05.07-4.20.
\nWe recommend that you upgrade your lpr package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nCore Security Technologies discovered a buffer overflow in the IMAP\ncode of Mutt, a text-oriented mail reader supporting IMAP, MIME, GPG,\nPGP and threading. This problem allows a remote malicious IMAP server\nto cause a denial of service (crash) and possibly execute arbitrary\ncode via a specially crafted mail folder.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.3.28-2.1.
\nThe old stable distribution (potato) is not affected by this problem.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.5.4-1.
\nWe recommend that you upgrade your mutt package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA cryptographic weakness in version 4 of the Kerberos protocol allows\nan attacker to use a chosen-plaintext attack to impersonate any\nprincipal in a realm. Additional cryptographic weaknesses in the krb4\nimplementation permit the use of cut-and-paste attacks to fabricate\nkrb4 tickets for unauthorized client principals if triple-DES keys are\nused to key krb4 services. These attacks can subvert a site's entire\nKerberos authentication infrastructure.
\nThis version of the heimdal package changes the default behavior and\ndisallows cross-realm authentication for Kerberos version 4. Because\nof the fundamental nature of the problem, cross-realm authentication\nin Kerberos version 4 cannot be made secure and sites should avoid its\nuse. A new option (--kerberos4-cross-realm) is provided to the kdc\ncommand to re-enable version 4 cross-realm authentication for those\nsites that must use this functionality but desire the other security\nfixes.
\nFor the stable distribution (woody) this problem has been\nfixed in version 0.4e-7.woody.8.
\nThe old stable distribution (potato) is not affected by this problem,\nsince it isn't compiled against kerberos 4.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 0.5.2-1.
\nWe recommend that you upgrade your heimdal packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nThe kernel module loader in Linux 2.2 and Linux 2.4 kernels has a flaw\nin ptrace. This hole allows local users to obtain root privileges by\nusing ptrace to attach to a child process that is spawned by the\nkernel. Remote exploitation of this hole is not possible.
\nThis advisory only covers kernel packages for the big and little endian MIPS\narchitectures. Other architectures will be covered by separate advisories.
\nFor the stable distribution (woody) this problem has been fixed in version\n2.4.17-0.020226.2.woody1 of kernel-patch-2.4.17-mips (mips+mipsel) and in\nversion 2.4.19-0.020911.1.woody1 of kernel-patch-2.4.19-mips (mips only).
\nThe old stable distribution (potato) is not affected by this problem\nfor these architectures since mips and mipsel were first released with\nDebian GNU/Linux 3.0 (woody).
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.4.19-0.020911.6 of kernel-patch-2.4.19-mips (mips+mipsel).
\nWe recommend that you upgrade your kernel-images packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA problem has been discovered in ecartis, a mailing list manager,\nformerly known as listar. This vulnerability enables an attacker to\nreset the password of any user defined on the list server, including\nthe list admins.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.129a+1.0.0-snap20020514-1.1 of ecartis.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 0.129a-2.potato3 of listar.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 1.0.0+cvs.20030321-1 of ecartis.
\nWe recommend that you upgrade your ecartis and listar packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\neEye Digital Security discovered an integer overflow in the\nxdrmem_getbytes() function of glibc, that is also present in dietlibc,\na small libc useful especially for small and embedded systems. This\nfunction is part of the XDR encoder/decoder derived from Sun's RPC\nimplementation. Depending upon the application, this vulnerability\ncan cause buffer overflows and could possibly be exploited to execute\narbitrary code.
\nFor the stable distribution (woody) this problem has been\nfixed in version 0.12-2.5.
\nThe old stable distribution (potato) does not contain dietlibc\npackages.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 0.22-2.
\nWe recommend that you upgrade your dietlibc packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA cryptographic weakness in version 4 of the Kerberos protocol allows\nan attacker to use a chosen-plaintext attack to impersonate any\nprincipal in a realm. Additional cryptographic weaknesses in the krb4\nimplementation permit the use of cut-and-paste attacks to fabricate\nkrb4 tickets for unauthorized client principals if triple-DES keys are\nused to key krb4 services. These attacks can subvert a site's entire\nKerberos authentication infrastructure.
\nFor the stable distribution (woody) this problem has been\nfixed in version 1.1-8-2.3.
\nFor the old stable distribution (potato) this problem has been\nfixed in version 1.0-2.3.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 1.2.2-1.
\nWe recommend that you upgrade your krb4 packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nByrial Jensen discovered a couple of off-by-one buffer overflow in the\nIMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME,\nGPG, PGP and threading. This problem could potentially allow a remote\nmalicious IMAP server to cause a denial of service (crash) and\npossibly execute arbitrary code via a specially crafted mail folder.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.3.28-2.2.
\nThe old stable distribution (potato) is also affected by this problem\nand an update will follow.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4.0 and above.
\nWe recommend that you upgrade your mutt package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nA buffer overflow has been discovered in lpr, a BSD lpr/lpd line\nprinter spooling system. This problem can be exploited by a local\nuser to gain root privileges, even if the printer system is set up\nproperly.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.72-2.1.
\nThe old stable distribution (potato) does not contain lpr-ppd packages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.72-3.
\nWe recommend that you upgrade your lpr-ppd package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe kernel module loader in Linux 2.2 and Linux 2.4 kernels has a flaw\nin ptrace. This hole allows local users to obtain root privileges by\nusing ptrace to attach to a child process that is spawned by the\nkernel. Remote exploitation of this hole is not possible.
\nThis advisory only covers kernel packages for the S/390 architecture.\nOther architectures will be covered by separate advisories.
\nFor the stable distribution (woody) this problem has been fixed in the\nfollowing versions:
\nThe old stable distribution (potato) is not affected by this problem\nfor this architecture since s390 was first released with Debian\nGNU/Linux 3.0 (woody).
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your kernel-images packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe controlling and management daemon apcupsd for APC's Unbreakable\nPower Supplies is vulnerable to several buffer overflows and format\nstring attacks. These bugs can be exploited remotely by an attacker to gain root\naccess to the machine apcupsd is running on.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.8.5-1.1.1.
\nFor the old stable distribution (potato) this problem does not seem to\nexist.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 3.8.5-1.2.
\nWe recommend that you upgrade your apcupsd packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMichal Zalewski discovered a buffer overflow, triggered by a char to\nint conversion, in the address parsing code in sendmail, a widely used\npowerful, efficient, and scalable mail transport agent. This problem\nis potentially remotely exploitable.
\nFor the stable distribution (woody) this problem has been\nfixed in version 8.12.3-6.3.
\nFor the old stable distribution (potato) this problem has been\nfixed in version 8.9.3-26.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 8.12.9-1.
\nWe recommend that you upgrade your sendmail packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nPaul Szabo and Matt Zimmerman discovered two similar problems in\nmetrics, a tools for software metrics. Two scripts in this package,\n\"halstead\" and \"gather_stats\", open temporary files without taking\nappropriate security precautions. \"halstead\" is installed as a user\nprogram, while \"gather_stats\" is only used in an auxiliary script\nincluded in the source code. These vulnerabilities could allow a\nlocal attacker to overwrite files owned by the user running the\nscripts, including root.
\nThe stable distribution (woody) is not affected since it doesn't\ncontain a metrics package anymore.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 1.0-1.1.
\nThe unstable distribution (sid) is not affected since it doesn't\ncontain a metrics package anymore.
\nWe recommend that you upgrade your metrics package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nDigital Defense, Inc. has alerted the Samba Team to a serious\nvulnerability in Samba, a LanManager-like file and printer server for Unix.\nThis vulnerability can lead to an anonymous user gaining root access\non a Samba serving system. An exploit for this problem is already\ncirculating and in use.
\nSince the packages for potato are quite old it is likely that they\ncontain more security-relevant bugs that we don't know of. You are\ntherefore advised to upgrade your systems running Samba to woody\nsoon.
\nUnofficial backported packages from the Samba maintainers for version\n2.2.8 of Samba for woody are available at\n~peloy and\n~vorlon.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.3a-12.3.
\nFor the old stable distribution (potato) this problem has been fixed in\nversion 2.0.7-5.1.
\nThe unstable distribution (sid) is not affected since it contains\nversion 3.0 packages already.
\nWe recommend that you upgrade your Samba packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nKnud Erik H\u00f8jgaard discovered a vulnerability in moxftp (and xftp\nrespectively), an Athena X interface to FTP. Insufficient bounds\nchecking could lead to execution of arbitrary code, provided by a\nmalicious FTP server. Erik Tews fixed this.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2-18.1.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 2.2-13.1.
\nFor the unstable distribution (sid) this problem has been fixed\nin version 2.2-18.20.
\nWe recommend that you upgrade your xftp package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\neEye Digital Security discovered an integer overflow in the\nxdrmem_getbytes() function which is also present in GNU libc. This\nfunction is part of the XDR (external data representation)\nencoder/decoder derived from Sun's RPC implementation. Depending upon\nthe application, this vulnerability can cause buffer overflows and\ncould possibly be exploited to execute arbitrary code.
\nFor the stable distribution (woody) this problem has been\nfixed in version 2.2.5-11.5.
\nFor the old stable distribution (potato) this problem has been\nfixed in version 2.1.3-25.
\nFor the unstable distribution (sid) this problem has been\nfixed in version 2.3.1-16.
\nWe recommend that you upgrade your libc6 packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nEthan Benson discovered a problem in xfsdump, that contains\nadministrative utilities for the XFS filesystem. When filesystem\nquotas are enabled xfsdump runs xfsdq to save the quota information\ninto a file at the root of the filesystem being dumped. The manner in\nwhich this file is created is unsafe.
\nWhile fixing this, a new option \u201c-f path\u201d has been added to xfsdq(8)\nto specify an output file instead of using the standard output stream.\nThis file is created by xfsdq and xfsdq will fail to run if it exists\nalready. The file is also created with a more appropriate mode than\nwhatever the umask happened to be when xfsdump(8) was run.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0.1-2.
\nThe old stable distribution (potato) is not affected since it doesn't\ncontain xfsdump packages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.8-1.
\nWe recommend that you upgrade your xfsdump package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered a vulnerability in the way KDE uses Ghostscript\nsoftware for processing of PostScript (PS) and PDF files. An attacker\ncould provide a malicious PostScript or PDF file via mail or websites\nthat could lead to executing arbitrary commands under the privileges\nof the user viewing the file or when the browser generates a directory\nlisting with thumbnails.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-6.11 of kdegraphics and associated packages.
\nThe old stable distribution (potato) is not affected since it does not\ncontain KDE.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nFor the unofficial backport of KDE 3.1.1 to woody by Ralf Nolden on\ndownload.kde.org, this problem has been fixed in version 3.1.1-0woody2\nof kdegraphics. Using the normal backport line for apt-get you will\nget the update:
\ndeb http://download.kde.org/stable/latest/Debian stable main
\nWe recommend that you upgrade your kdegraphics and associated packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nKarol Lewandowski discovered that psbanner, a printer filter that\ncreates a PostScript format banner and is part of LPRng, insecurely\ncreates a temporary file for debugging purpose when it is configured\nas filter. The program does not check whether this file already\nexists or is linked to another place, psbanner writes its current environment\nand called arguments to the file unconditionally with the user id\ndaemon.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.8.10-1.2.
\nThe old stable distribution (potato) is not affected by this problem.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.8.20-4.
\nWe recommend that you upgrade your lprng package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nPaul Szabo discovered insecure creation of a temporary file in\nps2epsi, a script that is distributed as part of gs-common which\ncontains common files for different Ghostscript releases. ps2epsi uses\na temporary file in the process of invoking ghostscript. This file\nwas created in an insecure fashion, which could allow a local attacker\nto overwrite files owned by a user who invokes ps2epsi.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.3.3.0woody1.
\nThe old stable distribution (potato) is not affected by this problem.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.3.3.1.
\nWe recommend that you upgrade your gs-common package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTimo Sirainen discovered several problems in EPIC, a popular client\nfor Internet Relay Chat (IRC). A malicious server could craft special\nreply strings, triggering the client to write beyond buffer\nboundaries. This could lead to a denial of service if the client only\ncrashes, but may also lead to executing of arbitrary code under the\nuser id of the chatting user.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.004-17.1.
\nFor the old stable distribution (potato) these problems have been\nfixed in version 3.004-16.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.004-19.
\nWe recommend that you upgrade your EPIC package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nResearchers discovered two flaws in OpenSSL, a Secure Socket Layer\n(SSL) library and related cryptographic tools. Applications that are\nlinked against this library are generally vulnerable to attacks that\ncould leak the server's private key or make the encrypted session\ndecryptable otherwise. The Common Vulnerabilities and Exposures (CVE)\nproject identified the following vulnerabilities:
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.9.6c-2.woody.3.
\nFor the old stable distribution (potato) these problems have been\nfixed in version 0.9.6c-0.potato.6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.9.7b-1 of openssl and version 0.9.6j-1 of openssl096.
\nWe recommend that you upgrade your openssl packages immediately and\nrestart the applications that use OpenSSL.
\nUnfortunately, RSA blinding is not thread-safe and will cause failures\nfor programs that use threads and OpenSSL such as stunnel. However,\nsince the proposed fix would change the binary interface (ABI),\nprograms that are dynamically linked against OpenSSL won't run\nanymore. This is a dilemma we can't solve.
\nYou will have to decide whether you want the security update which is\nnot thread-safe and recompile all applications that apparently fail\nafter the upgrade, or fetch the additional source packages at the end\nof this advisory, recompile it and use a thread-safe OpenSSL library\nagain, but also recompile all applications that make use of it (such\nas apache-ssl, mod_ssl, ssh etc.).
\nHowever, since only very few packages use threads and link against the\nOpenSSL library most users will be able to use packages from this\nupdate without any problems.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSam Hocevar discovered a security problem in rinetd, an IP connection\nredirection server. When the connection list is full, rinetd resizes\nthe list in order to store the new incoming connection. However, this\nis done improperly, resulting in a denial of service and potentially\nexecution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.61-1.1.
\nFor the old stable distribution (potato) this problem has been\nfixed in version 0.52-2.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.61-2
\nWe recommend that you upgrade your rinetd package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMichal Zalewski discovered a buffer overflow, triggered by a char to\nint conversion, in the address parsing code in sendmail, a widely used\npowerful, efficient, and scalable mail transport agent. This problem\nis potentially remotely exploitable.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 8.12.3+3.5Wbeta-5.4
\nFor the old stable distribution (potato) this problem has been\nfixed in version 8.9.3+3.2W-25
\nFor the unstable distribution (sid) this problem has been\nfixed in version 8.12.9+3.5Wbeta-1
\nWe recommend that you upgrade your sendmail-wide packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTimo Sirainen discovered several problems in ircII, a popular\nclient for Internet Relay Chat (IRC). A malicious server could\ncraft special reply strings, triggering the client to write beyond\nbuffer boundaries. This could lead to a denial of service if the\nclient only crashes, but may also lead to executing of arbitrary code\nunder the user id of the chatting user.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 20020322-1.1.
\nFor the old stable distribution (potato) these problems have been\nfixed in version 4.4M-1.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 20030315-1.
\nWe recommend that you upgrade your ircII package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nColin Phipps discovered several problems in mime-support, that contains\nsupport programs for the MIME control files 'mime.types' and 'mailcap'.\nWhen a temporary file is to be used it is created insecurely, allowing\nan attacker to overwrite arbitrary under the user id of the person\nexecuting run-mailcap.
\nWhen run-mailcap is executed on a file with a potentially\nproblematic filename, a temporary file is created (not insecurely\nanymore), removed and a symbolic link to this filename is created. An\nattacker could recreate the file before the symbolic link is created,\nforcing the display program to display different content.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.18-1.3.
\nFor the old stable distribution (potato) these problems have been\nfixed in version 3.9-1.3.
\nFor the unstable distribution (sid) these problems have been\nfixed in version 3.23-1.
\nWe recommend that you upgrade your mime-support packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nThe KDE team discovered a vulnerability in the way KDE uses Ghostscript\nsoftware for processing of PostScript (PS) and PDF files. An attacker\ncould provide a malicious PostScript or PDF file via mail or websites\nthat could lead to executing arbitrary commands under the privileges\nof the user viewing the file or when the browser generates a directory\nlisting with thumbnails.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-13.woody.7 of kdelibs and associated packages.
\nThe old stable distribution (potato) is not affected since it does not\ncontain KDE.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nFor the unofficial backport of KDE 3.1.1 to woody by Ralf Nolden on\ndownload.kde.org, this problem has been fixed in version 3.1.1-0woody3\nof kdelibs. Using the normal backport line for apt-get you will get\nthe update:
\ndeb http://download.kde.org/stable/latest/Debian stable main
\nWe recommend that you upgrade your kdelibs and associated packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nBrian Campbell discovered two security-related problems in\ngkrellm-newsticker, a plugin for the gkrellm system monitor program,\nwhich provides a news ticker from RDF feeds. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.3-3.1.
\nThe old stable distribution (potato) is not affected since it doesn't\ncontain gkrellm-newsticker packages.
\nFor the unstable distribution (sid) these problems is not yet fixed.
\nWe recommend that you upgrade your gkrellm-newsticker package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTimo Sirainen discovered a vulnerability in pptpd, a Point to Point\nTunneling Server, which implements PPTP-over-IPSEC and is commonly\nused to create Virtual Private Networks (VPN). By specifying a small\npacket length an attacker is able to overflow a buffer and execute\ncode under the user id that runs pptpd, probably root. An exploit for\nthis problem is already circulating.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.2-1.4.
\nFor the old stable distribution (potato) this problem has been\nfixed in version 1.0.0-4.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.4-0.b3.2.
\nWe recommend that you upgrade your pptpd package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe KDE team discovered a vulnerability in the way KDE uses Ghostscript\nsoftware for processing of PostScript (PS) and PDF files. An attacker\ncould provide a malicious PostScript or PDF file via mail or websites\nthat could lead to executing arbitrary commands under the privileges\nof the user viewing the file or when the browser generates a directory\nlisting with thumbnails.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-14.4 of kdebase and associated packages.
\nThe old stable distribution (potato) is not affected since it does not\ncontain KDE.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nFor the unofficial backport of KDE 3.1.1 to woody by Ralf Nolden on\ndownload.kde.org, this problem has been fixed in version 3.1.1-0woody3\nof kdebase. Using the normal backport line for apt-get you will get\nthe update:
\ndeb http://download.kde.org/stable/latest/Debian stable main
\nWe recommend that you upgrade your kdebase and associated packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTwo vulnerabilities have been discovered in Snort, a popular network\nintrusion detection system. Snort comes with modules and plugins that\nperform a variety of functions such as protocol analysis. The\nfollowing issues have been identified:
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.8.4beta1-3.1.
\nThe old stable distribution (potato) is not affected by these problems\nsince it doesn't contain the problematic code.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.0-1.
\nWe recommend that you upgrade your snort package immediately.
\nYou are also advised to upgrade to the most recent version of Snort,\nsince Snort, as any intrusion detection system, is rather useless if\nit is based on old and out-dated data and not kept up to date. Such\ninstallations would be unable to detect intrusions using modern\nmethods. The current version of Snort is 2.0.0, while the version in\nthe stable distribution (1.8) is quite old and the one in the old\nstable distribution is beyond hope.
\nSince Debian does not update arbitrary packages in stable releases,\neven Snort is not going to see updates other than to fix security\nproblems, you are advised to upgrade to the most recent version from\nthird party sources.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTimo Sirainen discovered several problems in EPIC4, a popular client\nfor Internet Relay Chat (IRC). A malicious server could craft special\nreply strings, triggering the client to write beyond buffer\nboundaries. This could lead to a denial of service if the client only\ncrashes, but may also lead to executing of arbitrary code under the\nuser id of the chatting user.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.1.2.20020219-2.1.
\nFor the old stable distribution (potato) these problems have been\nfixed in version pre2.508-2.3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.1.11.20030409-1.
\nWe recommend that you upgrade your EPIC4 package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMaurice Massar discovered that, due to a packaging error, the program\n/usr/bin/KATAXWR was inadvertently installed setuid root. This\nprogram was not designed to run setuid, and contained multiple\nvulnerabilities which could be exploited to gain root privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2-3.1.
\nThe old stable distribution (potato) does not contain a leksbot\npackage.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2-5.
\nWe recommend that you update your leksbot package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nByrial Jensen discovered a couple of off-by-one buffer overflow in the\nIMAP code of Mutt, a text-oriented mail reader supporting IMAP, MIME,\nGPG, PGP and threading. This code is imported in the Balsa package.\nThis problem could potentially allow a remote malicious IMAP server to\ncause a denial of service (crash) and possibly execute arbitrary code\nvia a specially crafted mail folder.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2.4-2.2.
\nThe old stable distribution (potato) does not seem to be affected by\nthis problem.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your balsa package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe gtop daemon, used for monitoring remote machines, contains a\nbuffer overflow which could be used by an attacker to execute\narbitrary code with the privileges of the daemon process. If started\nas root, the daemon process drops root privileges, assuming uid and\ngid 99 by default.
\nThis bug was previously fixed in DSA-098,\nbut one of the patches was not carried over to later versions of libgtop.
\nFor the stable distribution (woody), this problem has been fixed in\nversion 1.0.13-3.1.
\nFor the old stable distribution (potato), this problem was fixed in\nDSA-098.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.0.13-4.
\nWe recommend that you update your libgtop package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJoey Hess discovered that fuzz, a software stress-testing tool,\ncreates a temporary file without taking appropriate security\nprecautions. This bug could allow an attacker to gain the privileges\nof the user invoking fuzz, excluding root (fuzz does not allow itself\nto be invoked as root).
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.6-6woody1.
\nThe old stable distribution (potato) does not contain a fuzz package.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your fuzz package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nCAN-2003-0073: The mysql package contains a bug whereby dynamically\nallocated memory is freed more than once, which could be deliberately\ntriggered by an attacker to cause a crash, resulting in a denial of\nservice condition. In order to exploit this vulnerability, a valid\nusername and password combination for access to the MySQL server is\nrequired.
\nCAN-2003-0150: The mysql package contains a bug whereby a malicious\nuser, granted certain permissions within mysql, could create a\nconfiguration file which would cause the mysql server to run as root,\nor any other user, rather than the mysql user.
\nFor the stable distribution (woody) both problems have been fixed in\nversion 3.23.49-8.4.
\nThe old stable distribution (potato) is only affected by\nCAN-2003-0150, and this has been fixed in version 3.22.32-6.4.
\nFor the unstable distribution (sid), CAN-2003-0073 was fixed in\nversion 4.0.12-2, and CAN-2003-0150 will be fixed soon.
\nWe recommend that you update your mysql package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nLeonard Stiles discovered that lv, a multilingual file viewer, would\nread options from a configuration file in the current directory.\nBecause such a file could be placed there by a malicious user, and lv\nconfiguration options can be used to execute commands, this\nrepresented a security vulnerability. An attacker could gain the\nprivileges of the user invoking lv, including root.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.49.4-7woody2.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 4.49.3-4potato2.
\nFor the unstable distribution (sid) this problem is fixed in version\n4.49.5-2.
\nWe recommend that you update your lv package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nPaul Szabo discovered bugs in three scripts included in the sendmail\npackage where temporary files were created insecurely (expn,\nchecksendmail and doublebounce.pl). These bugs could allow an\nattacker to gain the privileges of a user invoking the script\n(including root).
\nFor the stable distribution (woody) these problems have been fixed in\nversion 8.12.3-6.4.
\nFor the old stable distribution (potato) these problems have been fixed\nin version 8.9.3-26.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 8.12.9-2.
\nWe recommend that you update your sendmail package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTimo Sirainen discovered several problems in BitchX, a popular client\nfor Internet Relay Chat (IRC). A malicious server could craft special\nreply strings, triggering the client to write beyond buffer boundaries\nor allocate a negative amount of memory. This could lead to a denial\nof service if the client only crashes, but may also lead to executing\nof arbitrary code under the user id of the chatting user.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.0-0c19-1.1.
\nFor the old stable distribution (potato) these problems have been\nfixed in version 1.0-0c16-2.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0-0c19-8.
\nWe recommend that you upgrade your BitchX package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\ngPS is a graphical application to watch system processes. In release\n1.1.0 of the gps package, several security vulnerabilities were fixed,\nas detailed in the changelog:
\nAll of these problems affect Debian's gps package version 0.9.4-1 in\nDebian woody. Debian potato also contains a gps package (version\n0.4.1-2), but it is not affected by these problems, as the relevant\nfunctionality is not implemented in that version.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.9.4-1woody1.
\nThe old stable distribution (potato) is not affected by these problems.
\nFor the unstable distribution (sid) these problems are fixed in\nversion 1.1.0-1.
\nWe recommend that you update your gps package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nPaul Szabo discovered that znew, a script included in the gzip\npackage, creates its temporary files without taking precautions to\navoid a symlink attack (CAN-2003-0367).
\nThe gzexe script has a similar vulnerability which was patched in an\nearlier release but inadvertently reverted.
\nFor the stable distribution (woody) both problems have been fixed in\nversion 1.3.2-3woody1.
\nFor the old stable distribution (potato) CAN-2003-0367 has been fixed\nin version 1.2.4-33.2. This version is not vulnerable to\nCVE-1999-1332 due to an earlier patch.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your gzip package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\n\"bazarr\" discovered that eterm is vulnerable to a buffer overflow of\nthe ETERMPATH environment variable. This bug can be exploited to gain\nthe privileges of the group \"utmp\" on a system where eterm is\ninstalled.
\nFor the stable distribution (woody), this problem has been fixed in\nversion 0.9.2-0pre2002042903.1.
\nThe old stable distribution (potato) is not affected by this bug.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your eterm package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nXaoS, a program for displaying fractal images, is installed setuid\nroot on certain architectures in order to use svgalib, which requires\naccess to the video hardware. However, it is not designed for secure\nsetuid execution, and can be exploited to gain root privileges.
\nIn these updated packages, the setuid bit has been removed from the\nxaos binary. Users who require the svgalib functionality should grant\nthese privileges only to a trusted group.
\nThis vulnerability is exploitable in version 3.0-18 (potato) on i386\nand alpha architectures, and in version 3.0-23 (woody) on the i386\narchitecture only.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.0-23woody1.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 3.0-18potato1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.1r-4.
\nWe recommend that you update your xaos package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA number of vulnerabilities have been discovered in the Linux kernel.
\nCVE-2002-0429: The iBCS routines in arch/i386/kernel/traps.c for\n Linux kernels 2.4.18 and earlier on x86 systems allow local users to\n kill arbitrary processes via a binary compatibility interface\n (lcall).
\nCAN-2003-0001: Multiple ethernet Network Interface Card (NIC) device\n drivers do not pad frames with null bytes, which allows remote\n attackers to obtain information from previous packets or kernel\n memory by using malformed packets.
\nCAN-2003-0127: The kernel module loader allows local users to gain\n root privileges by using ptrace to attach to a child process that is\n spawned by the kernel.
\nCAN-2003-0244: The route cache implementation in Linux 2.4, and the\n Netfilter IP conntrack module, allows remote attackers to cause a\n denial of service (CPU consumption) via packets with forged source\n addresses that cause a large number of hash table collisions related\n to the PREROUTING chain.
\nCAN-2003-0246: The ioperm system call in Linux kernel 2.4.20 and\n earlier does not properly restrict privileges, which allows local\n users to gain read or write access to certain I/O ports.
\nCAN-2003-0247: Vulnerability in the TTY layer of the Linux kernel\n 2.4 allows attackers to cause a denial of service (\"kernel oops\").
\nCAN-2003-0248: The mxcsr code in Linux kernel 2.4 allows attackers\n to modify CPU state registers via a malformed address.
\nCAN-2003-0364: The TCP/IP fragment reassembly handling in the Linux\n kernel 2.4 allows remote attackers to cause a denial of service (CPU\n consumption) via certain packets that cause a large number of hash\n table collisions.
\nThis advisory covers only the i386 (Intel IA32) architectures. Other\narchitectures will be covered by separate advisories.
\nFor the stable distribution (woody) on the i386 architecture, these\nproblems have been fixed in kernel-source-2.4.18 version 2.4.18-9,\nkernel-image-2.4.18-1-i386 version 2.4.18-8, and\nkernel-image-2.4.18-i386bf version 2.4.18-5woody1.
\nFor the unstable distribution (sid) these problems are fixed in the\n2.4.20 series kernels based on Debian sources.
\nWe recommend that you update your kernel packages.
\nIf you are using the kernel installed by the installation system when\nthe \"bf24\" option is selected (for a 2.4.x kernel), you should install\nthe kernel-image-2.4.18-bf2.4 package. If you installed a different\nkernel-image package after installation, you should install the\ncorresponding 2.4.18-1 kernel. You may use the table below as a\nguide.
\n\n| If \"uname -r\" shows: | Install this package:\n| 2.4.18-bf2.4 | kernel-image-2.4.18-bf2.4\n| 2.4.18-386 | kernel-image-2.4.18-1-386\n| 2.4.18-586tsc | kernel-image-2.4.18-1-586tsc\n| 2.4.18-686 | kernel-image-2.4.18-1-686\n| 2.4.18-686-smp | kernel-image-2.4.18-1-686-smp\n| 2.4.18-k6 | kernel-image-2.4.18-1-k6\n| 2.4.18-k7 | kernel-image-2.4.18-1-k7\n\n
NOTE: that this kernel is not binary compatible with the previous\nversion. For this reason, the kernel has a different version number\nand will not be installed automatically as part of the normal upgrade\nprocess. Any custom modules will need to be rebuilt in order to work\nwith the new kernel. New PCMCIA modules are provided for all of the\nabove kernels.
\nNOTE: A system reboot will be required immediately after the upgrade\nin order to replace the running kernel. Remember to read carefully\nand follow the instructions given during the kernel upgrade process.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA number of vulnerabilities have been discovered in the Linux kernel.
\nCVE-2002-0429: The iBCS routines in arch/i386/kernel/traps.c for\n Linux kernels 2.4.18 and earlier on x86 systems allow local users to\n kill arbitrary processes via a binary compatibility interface\n (lcall).
\nCAN-2003-0001: Multiple ethernet Network Interface Card (NIC) device\n drivers do not pad frames with null bytes, which allows remote\n attackers to obtain information from previous packets or kernel\n memory by using malformed packets.
\nCAN-2003-0127: The kernel module loader allows local users to gain\n root privileges by using ptrace to attach to a child process that is\n spawned by the kernel.
\nCAN-2003-0244: The route cache implementation in Linux 2.4, and the\n Netfilter IP conntrack module, allows remote attackers to cause a\n denial of service (CPU consumption) via packets with forged source\n addresses that cause a large number of hash table collisions related\n to the PREROUTING chain.
\nCAN-2003-0246: The ioperm system call in Linux kernel 2.4.20 and\n earlier does not properly restrict privileges, which allows local\n users to gain read or write access to certain I/O ports.
\nCAN-2003-0247: Vulnerability in the TTY layer of the Linux kernel\n 2.4 allows attackers to cause a denial of service (\"kernel oops\").
\nCAN-2003-0248: The mxcsr code in Linux kernel 2.4 allows attackers\n to modify CPU state registers via a malformed address.
\nCAN-2003-0364: The TCP/IP fragment reassembly handling in the Linux\n kernel 2.4 allows remote attackers to cause a denial of service (CPU\n consumption) via certain packets that cause a large number of hash\n table collisions.
\nThis advisory covers only the powerpc architecture. Other\narchitectures will be covered by separate advisories.
\nFor the stable distribution (woody) on the powerpc architecture, these\nproblems have been fixed in version 2.4.18-1woody1.
\nFor the unstable distribution (sid) these problems are fixed in\nversion 2.4.20-2.
\nWe recommend that you update your kernel packages.
\nNOTE: A system reboot will be required immediately after the upgrade\nin order to replace the running kernel. Remember to read carefully\nand follow the instructions given during the kernel upgrade process.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTimo Sirainen discovered several vulnerabilities in ethereal, a\nnetwork traffic analyzer. These include one-byte buffer overflows in\nthe AIM, GIOP Gryphon, OSPF, PPTP, Quake, Quake2, Quake3, Rsync, SMB,\nSMPP, and TSP dissectors, and integer overflows in the Mount and PPP\ndissectors.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.9.4-1woody4.
\nThe old stable distribution (potato) does not appear to contain these\nvulnerabilities.
\nFor the unstable distribution (sid) these problems are fixed in version\n0.9.12-1.
\nWe recommend that you update your ethereal package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nRick Patel discovered that atftpd is vulnerable to a buffer overflow\nwhen a long filename is sent to the server. An attacker could exploit\nthis bug remotely to execute arbitrary code on the server.
\nFor the stable distribution (woody), this problem has been fixed in\nversion 0.6.1.1.0woody1.
\nThe old stable distribution (potato) does not contain an atftp\npackage.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your atftp package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nBas Wijnen discovered that the gnocatan server is vulnerable to\nseveral buffer overflows which could be exploited to execute arbitrary\ncode on the server system.
\nFor the stable distribution (woody), this problem has been fixed in\nversion 0.6.1-5woody2.
\nThe old stable distribution (potato) does not contain a gnocatan package.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your gnocatan package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe nethack and slashem packages are vulnerable to a buffer overflow exploited via a\nlong '-s' command line option. This vulnerability could be used by an\nattacker to gain gid 'games' on a system where nethack is installed.
\nAdditionally, some setgid binaries in the nethack package have\nincorrect permissions, which could allow a user who gains gid 'games'\nto replace these binaries, potentially causing other users to execute\nmalicious code when they run nethack.
\nNote that slashem does not contain the file permission problem\nCAN-2003-0359.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.4.0-3.0woody3.
\nFor the old stable distribution (potato) these problems have been fixed in\nversion 3.3.0-7potato1.
\nFor the unstable distribution (sid) these problems are fixed in\nversion 3.4.1-1.
\nWe recommend that you update your nethack package.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.0.6E4F8-4.0woody3.
\nFor the old stable distribution (potato) these problems have been fixed in\nversion 0.0.5E7-3potato1.
\nFor the unstable distribution (sid) these problems are fixed in\nversion 0.0.6E4F8-6.
\nWe recommend that you update your slashem package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nThe CUPS print server in Debian is vulnerable to a denial of service\nwhen an HTTP request is received without being properly terminated.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.14-5.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 1.0.4-12.2.
\nFor the unstable distribution (sid) this problem is fixed in\nversion 1.1.19final-1.
\nWe recommend that you update your cupsys package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nCalle Dybedahl discovered a bug in lyskom-server which could result in\na denial of service where an unauthenticated user could cause the\nserver to become unresponsive as it processes a large query.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0.6-1woody1.
\nThe old stable distribution (potato) does not contain a lyskom-server package.
\nFor the unstable distribution (sid) this problem is fixed in version\n2.0.7-2.
\nWe recommend that you update your lyskom-server package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nminiserv.pl in the webmin package does not properly handle\nmetacharacters, such as line feeds and carriage returns, in\nBase64-encoded strings used in Basic authentication. This\nvulnerability allows remote attackers to spoof a session ID, and\nthereby gain root privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.94-7woody1.
\nThe old stable distribution (potato) does not contain a webmin package.
\nFor the unstable distribution (sid) this problem is fixed in version\n1.070-1.
\nWe recommend that you update your webmin package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nIngo Saitz discovered a bug in mikmod whereby a long filename inside\nan archive file can overflow a buffer when the archive is being read\nby mikmod.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.1.6-4woody3.
\nFor old stable distribution (potato) this problem has been fixed in\nversion 3.1.6-2potato3.
\nFor the unstable distribution (sid) this problem is fixed in version\n3.1.6-6.
\nWe recommend that you update your mikmod package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nradiusd-cistron contains a bug allowing a buffer overflow when a long\nNAS-Port attribute is received. This could allow a remote attacker to\nexecute arbitrary code on the server with the privileges of the RADIUS daemon\n(usually root).
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.6.6-1woody1.
\nFor the old stable distribution (potato), this problem will be fixed\nin a later advisory.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your radiusd-cistron package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\ntypespeed is a game which challenges the player to type words\ncorrectly and quickly. It contains a network play mode which allows\nplayers on different systems to play competitively. The network code\ncontains a buffer overflow which could allow a remote attacker to\nexecute arbitrary code under the privileges of the user invoking\ntypespeed, in addition to gid games.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.4.1-2.2.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 0.4.0-5.2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your typespeed package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJakob Lell discovered a bug in the 'noroff' script included in noweb\nwhereby a temporary file was created insecurely. During a review,\nseveral other instances of this problem were found and fixed. Any of\nthese bugs could be exploited by a local user to overwrite arbitrary\nfiles owned by the user invoking the script.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.9a-7.3.
\nFor old stable distribution (potato) this problem has been fixed in\nversion 2.9a-5.1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your noweb package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSeveral of the packet dissectors in ethereal contain string handling\nbugs which could be exploited using a maliciously crafted packet to\ncause ethereal to consume excessive amounts of memory, crash, or\nexecute arbitrary code.
\nThese vulnerabilities were announced in the following Ethereal security\nadvisory:
\nhttp://www.ethereal.com/appnotes/enpa-sa-00010.html
\nEthereal 0.9.4 in Debian 3.0 (woody) is affected by most of the\nproblems described in the advisory, including:
\nThe following problems do not affect this version:
\nas these modules are not present.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.9.4-1woody5.
\nFor the old stable distribution (potato) these problems will be fixed in a\nfuture advisory.
\nFor the unstable distribution (sid) these problems are fixed in\nversion 0.9.13-1.
\nWe recommend that you update your ethereal package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\neldav, a WebDAV client for Emacs, creates temporary files without\ntaking appropriate security precautions. This vulnerability could be\nexploited by a local user to create or overwrite files with the\nprivileges of the user running emacs and eldav.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.0.20020411-1woody1.
\nThe old stable distribution (potato) does not contain an eldav\npackage.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.7.2-1.
\nWe recommend that you update your eldav package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nOrville Write, a replacement for the standard write(1) command,\ncontains a number of buffer overflows. These could be exploited to\ngain either gid tty or root privileges, depending on the configuration\nselected when the package is installed.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.53-4woody1.
\nThe old stable distribution (potato) does not contain an orville-write\npackage.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nSee Debian bug report #170747.
\nWe recommend that you update your orville-write package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered several buffer overflows in xbl, a game, which\ncan be triggered by long command line arguments. This vulnerability\ncould be exploited by a local attacker to gain gid 'games'.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0k-3woody1.
\nFor the old stable distribution (potato) this problem has been fixed\nin version 1.0i-7potato1.
\nFor the unstable distribution (sid) this problem is fixed in version\n1.0k-5.
\nWe recommend that you update your xbl package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nwebfs, a lightweight HTTP server for static content, contains a buffer\noverflow whereby a long Request-URI in an HTTP request could cause\narbitrary code to be executed.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.17.1.
\nThe old stable distribution (potato) does not contain a webfs package.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your webfs package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered that osh, a shell intended to restrict the\nactions of the user, contains two buffer overflows, in processing\nenvironment variables and file redirections. These vulnerabilities\ncould be used to execute arbitrary code, overriding any restrictions\nplaced on the shell.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.7-11woody1.
\nThe old stable distribution (potato) is affected by this problem, and\nmay be fixed in a future advisory on a time-available basis.
\nFor the unstable distribution (sid) this problem is fixed in version\n1.7-12.
\nWe recommend that you update your osh package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\ntcptraceroute is a setuid-root program which drops root privileges\nafter obtaining a file descriptor used for raw packet capture.\nHowever, it did not fully relinquish all privileges, and in the event\nof an exploitable vulnerability, root privileges could be regained.
\nNo current exploit is known, but this safeguard is being repaired in\norder to provide a measure of containment in the event that an\nexploitable flaw should be discovered.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2-2.
\nThe old stable distribution (potato) does not contain a tcptraceroute\npackage.
\nFor the unstable distribution (sid) this problem is fixed in version\n1.4-4.
\nWe recommend that you update your tcptraceroute package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nimagemagick's libmagick library, under certain circumstances, creates\ntemporary files without taking appropriate security precautions. This\nvulnerability could be exploited by a local user to create or\noverwrite files with the privileges of another user who is invoking a\nprogram using this library.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4:5.4.4.5-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4:5.5.7-1.
\nWe recommend that you update your imagemagick package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA number of vulnerabilities have been discovered in the Linux kernel.
\nThis advisory provides corrected source code for Linux 2.4.17, and\ncorrected binary kernel images for the mips and mipsel architectures.\nOther versions and architectures will be covered by separate\nadvisories.
\nFor the stable distribution (woody), these problems have been fixed in\nkernel-source-2.4.17 version 2.4.17-1woody1 and\nkernel-patch-2.4.17-mips version 2.4.17-0.020226.2.woody2.
\nFor the unstable distribution (sid) these problems are fixed in\nkernel-source-2.4.20 version 2.4.20-8.
\nWe recommend that you update your kernel packages.
\nNOTE: A system reboot will be required immediately after the upgrade\nin order to replace the running kernel. Remember to read carefully\nand follow the instructions given during the kernel upgrade process.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nacm, a multi-player aerial combat simulation, uses a network protocol\nbased on the same RPC implementation used in many C libraries. This\nimplementation was found to contain an integer overflow vulnerability\nwhich could be exploited to execute arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 5.0-3.woody.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.0-10.
\nWe recommend that you update your acm package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered several buffer overflows in xgalaga, a game,\nwhich can be triggered by a long HOME environment variable. This\nvulnerability could be exploited by a local attacker to gain gid\n'games'.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0.34-19woody1.
\nFor the unstable distribution (sid) this problem is fixed in version\n2.0.34-22.
\nWe recommend that you update your xgalaga package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nmantis, a PHP/MySQL web based bug tracking system, stores the password\nused to access its database in a configuration file which is\nworld-readable. This could allow a local attacker to read the\npassword and gain read/write access to the database.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.17.1-3.
\nThe old stable distribution (potato) does not contain a mantis\npackage.
\nFor the unstable distribution (sid) this problem is fixed in version\n0.17.5-6.
\nWe recommend that you update your mantis package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA number of vulnerabilities have been discovered in the Linux kernel.
\nThis advisory provides updated 2.2.20 kernel source, and binary kernel\nimages for the i386 architecture. Other architectures and kernel\nversions will be covered by separate advisories.
\nFor the stable distribution (woody) on the i386 architecture, these\nproblems have been fixed in kernel-source-2.2.20 version\n2.2.20-5woody2 and kernel-image-i386 version 2.2.20-5woody3.
\nFor the unstable distribution (sid) these problems are fixed in\nkernel-source-2.2.25 and kernel-image-2.2.25-i386 version 2.2.25-2.
\nWe recommend that you update your kernel packages.
\nNOTE: A system reboot will be required immediately after the upgrade\nin order to replace the running kernel. Remember to read carefully\nand follow the instructions given during the kernel upgrade process.
\nNOTE: These kernels are not binary-compatible with the previous\nversion. Any loadable modules will need to be recompiled in order to\nwork with the new kernel.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nViliam Holub discovered a bug in gtksee whereby, when loading PNG\nimages of certain color depths, gtksee would overflow a heap-allocated\nbuffer. This vulnerability could be exploited by an attacker using a\ncarefully constructed PNG image to execute arbitrary code when the\nvictim loads the file in gtksee.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.5.0-6.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nRefer to Debian bug #76346.
\nWe recommend that you update your gtksee package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nrunlevel [runlevel@raregazz.org] reported that ProFTPD's PostgreSQL\nauthentication module is vulnerable to a SQL injection attack. This\nvulnerability could be exploited by a remote, unauthenticated attacker\nto execute arbitrary SQL statements, potentially exposing the\npasswords of other users, or to connect to ProFTPD as an arbitrary\nuser without supplying the correct password.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2.4+1.2.5rc1-5woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.8-8.
\nWe recommend that you update your proftpd package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nNOTE: due to a combination of administrative problems, this advisory\nwas erroneously released with the identifier \"DSA-337-1\". DSA-337-1\ncorrectly refers to an earlier advisory regarding gtksee.
\nsemi, a MIME library for GNU Emacs, does not take appropriate\nsecurity precautions when creating temporary files. This bug could\npotentially be exploited to overwrite arbitrary files with the\nprivileges of the user running Emacs and semi, potentially with\ncontents supplied by the attacker.
\nwemi is a fork of semi, and contains the same bug.
\nFor the stable distribution (woody) this problem has been fixed in\nsemi version 1.14.3.cvs.2001.08.10-1woody2 and wemi version\n1.14.0.20010802wemiko-1.3.
\nFor the unstable distribution (sid) this problem has been fixed in\nsemi version 1.14.5+20030609-1. The unstable distribution does not\ncontain a wemi package.
\nWe recommend that you update your semi and wemi packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nNOTE: due to a combination of administrative problems, this advisory\nwas erroneously released with the identifier \"DSA-338-1\". DSA-338-1\ncorrectly refers to an earlier advisory regarding proftpd.
\nx-face-el, a decoder for images included inline in X-Face email\nheaders, does not take appropriate security precautions when creating\ntemporary files. This bug could potentially be exploited to overwrite\narbitrary files with the privileges of the user running Emacs and\nx-face-el, potentially with contents supplied by the attacker.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.3.6.19-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.6.23-1.
\nWe recommend that you update your x-face-el package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nliece, an IRC client for Emacs, does not take appropriate security\nprecautions when creating temporary files. This bug could potentially\nbe exploited to overwrite arbitrary files with the privileges of the\nuser running Emacs and liece, potentially with contents supplied\nby the attacker.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0+0.20020217cvs-2.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0+0.20030527cvs-1.
\nWe recommend that you update your liece package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nmozart, a development platform based on the Oz language, includes MIME\nconfiguration data which specifies that Oz applications should be\npassed to the Oz interpreter for execution. This means that file\nmanagers, web browsers, and other programs which honor the mailcap\nfile could automatically execute Oz programs downloaded from untrusted\nsources. Thus, a malicious Oz program could execute arbitrary code\nunder the uid of a user running a MIME-aware client program if the\nuser selected a file (for example, choosing a link in a web browser).
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2.3.20011204-3woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.5.20030212-2.
\nWe recommend that you update your mozart package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nskk (Simple Kana to Kanji conversion program), does not take\nappropriate security precautions when creating temporary files. This\nbug could potentially be exploited to overwrite arbitrary files with\nthe privileges of the user running Emacs and skk.
\nddskk is derived from the same code, and contains the same bug.
\nFor the stable distribution (woody) this problem has been fixed in\nskk version 10.62a-4woody1 and ddskk version 11.6.rel.0-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nddskk version 12.1.cvs.20030622-1, and skk will be fixed soon.
\nWe recommend that you update your skk and ddskk packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA directory traversal vulnerability in UnZip 5.50 allows attackers to\nbypass a check for relative pathnames (\"../\") by placing certain invalid\ncharacters between the two \".\" characters. The fix which was\nimplemented in DSA-344-1 may not have protected against all methods of\nexploiting this vulnerability.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 5.50-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.50-3.
\nWe recommend that you update your unzip package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nAnother buffer overflow was discovered in xbl, distinct from the one\naddressed in DSA-327 (CAN-2003-0451), involving the\n-display command\nline option. This vulnerability could be exploited by a local\nattacker to gain gid 'games'.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0k-3woody2.
\nFor the unstable distribution (sid) this problem is fixed in version\n1.0k-6.
\nWe recommend that you update your xbl package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAlbert Puigsech Galicia ripe@7a69ezine.org reported that phpsysinfo,\na web-based program to display status information about the system,\ncontains two vulnerabilities which could allow local files to be read,\nor arbitrary PHP code to be executed, under the privileges of the web\nserver process (usually www-data). These vulnerabilities require\naccess to a writable directory on the system in order to be exploited.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0-3woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nSee Debian bug #200543.
\nWe recommend that you update your phpsysinfo package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nteapop, a POP-3 server, includes modules for authenticating users\nagainst a PostgreSQL or MySQL database. These modules do not properly\nescape user-supplied strings before using them in SQL queries. This\nvulnerability could be exploited to execute arbitrary SQL code under the\nprivileges of the database user as which teapop has authenticated.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.3.4-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.3.5-2.
\nWe recommend that you update your teapop package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\ntraceroute-nanog, an enhanced version of the common traceroute\nprogram, contains an integer overflow bug which could be exploited to\nexecute arbitrary code. traceroute-nanog is setuid root, but drops\nroot privileges immediately after obtaining raw ICMP and raw IP\nsockets. Thus, exploitation of this bug provides only access to these\nsockets, and not root privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 6.1.1-1.3.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nSee Debian bug #200875.
\nWe recommend that you update your traceroute-nanog package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe logging code in nfs-utils contains an off-by-one buffer overrun\nwhen adding a newline to the string being logged. This vulnerability\nmay allow an attacker to execute arbitrary code or cause a denial of\nservice condition by sending certain RPC requests.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1:1.0-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1:1.0.3-2.
\nWe recommend that you update your nfs-utils package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe falconseye package is vulnerable to a buffer overflow exploited\nvia a long -s command line option. This vulnerability could be used\nby an attacker to gain gid 'games' on a system where falconseye is\ninstalled.
\nNote that falconseye does not contain the file permission error\nCAN-2003-0359 which affected some other nethack packages.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.9.3-7woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.9.3-9.
\nWe recommend that you update your falconseye package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe transparent session ID feature in the php4 package does not\nproperly escape user-supplied input before inserting it into the\ngenerated HTML page. An attacker could use this vulnerability to\nexecute embedded scripts within the context of the generated page.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4:4.1.2-6woody3.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nRefer to Debian bug #200736.
\nWe recommend that you update your php4 package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nfdclone creates a temporary directory in /tmp as a workspace.\nHowever, if this directory already exists, the existing directory is\nused instead, regardless of its ownership or permissions. This would\nallow an attacker to gain access to fdclone's temporary files and\ntheir contents, or replace them with other files under the attacker's\ncontrol.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.00a-1woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.04-1.
\nWe recommend that you update your fdclone package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nsup, a package used to maintain collections of files in identical\nversions across machines, fails to take appropriate security\nprecautions when creating temporary files. A local attacker could\nexploit this vulnerability to overwrite arbitrary files with the\nprivileges of the user running sup.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.8-8woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.8-9.
\nWe recommend that you update your sup package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered a buffer overflow in xconq, in processing the\nUSER environment variable. In the process of fixing this bug, a\nsimilar problem was discovered with the DISPLAY environment\nvariable. This vulnerability could be exploited by a local attacker\nto gain gid 'games'.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 7.4.1-2woody2.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nRefer to Debian bug #202963.
\nWe recommend that you update your xconq package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nLarry Nguyen discovered a cross site scripting vulnerability in gallery,\na web-based photo album written in php. This security flaw can allow a\nmalicious user to craft a URL that executes Javascript code on your\nwebsite.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 1.25-8woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.4-3.
\nWe recommend that you update your gallery package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered two buffer overflows in xtokkaetama, a puzzle\ngame, when processing the -display command line option and the\nXTOKKAETAMADIR environment variable. These vulnerabilities could be\nexploited by a local attacker to gain gid 'games'.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 1.0b-6woody1.
\nFor the unstable distribution (sid) this problem is fixed in version\n1.0b-8.
\nWe recommend that you update your xtokkaetama package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\niSEC Security Research reports that wu-ftpd contains an off-by-one bug\nin the fb_realpath function which could be exploited by a logged-in user\n(local or anonymous) to gain root privileges. A demonstration exploit is\nreportedly available.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 2.6.2-3woody1.
\nFor the unstable distribution (sid) an update will be available shortly.
\nWe recommend you upgrade your wu-ftpd package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA number of vulnerabilities have been discovered in the Linux kernel.
\nThis advisory covers only the i386 and alpha architectures. Other\narchitectures will be covered by separate advisories.
\nFor the stable distribution (woody) on the i386 architecture, these\nproblems have been fixed in kernel-source-2.4.18 version 2.4.18-13,\nkernel-image-2.4.18-1-i386 version 2.4.18-11, and\nkernel-image-2.4.18-i386bf version 2.4.18-5woody4.
\nFor the stable distribution (woody) on the alpha architecture, these\nproblems have been fixed in kernel-source-2.4.18 version 2.4.18-13 and\nkernel-image-2.4.18-1-alpha version 2.4.18-10.
\nFor the unstable distribution (sid) these problems are fixed in\nkernel-source-2.4.20 version 2.4.20-9.
\nWe recommend that you update your kernel packages.
\nIf you are using the kernel installed by the installation system when\nthe \"bf24\" option is selected (for a 2.4.x kernel), you should install\nthe kernel-image-2.4.18-bf2.4 package. If you installed a different\nkernel-image package after installation, you should install the\ncorresponding 2.4.18-1 kernel. You may use the table below as a\nguide.
\n\n | If \"uname -r\" shows: | Install this package:\n | 2.4.18-bf2.4 | kernel-image-2.4.18-bf2.4\n | 2.4.18-386 | kernel-image-2.4.18-1-386\n | 2.4.18-586tsc | kernel-image-2.4.18-1-586tsc\n | 2.4.18-686 | kernel-image-2.4.18-1-686\n | 2.4.18-686-smp | kernel-image-2.4.18-1-686-smp\n | 2.4.18-k6 | kernel-image-2.4.18-1-k6\n | 2.4.18-k7 | kernel-image-2.4.18-1-k7\n\n
NOTE: This kernel is binary compatible with the previous kernel\nsecurity update, but not binary compatible with the corresponding\nkernel included in Debian 3.0r1. If you have not already applied the\nprevious security update (kernel-image-2.4.18-bf2.4 version\n2.4.18-5woody1 or any of the 2.4.18-1-* kernels), then any custom\nmodules will need to be rebuilt in order to work with the new kernel.\nNew PCMCIA modules are provided for all of the above kernels.
\nNOTE: A system reboot will be required immediately after the upgrade\nin order to replace the running kernel. Remember to read carefully\nand follow the instructions given during the kernel upgrade process.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nSteve Kemp discovered multiple buffer overflows in atari800, an Atari\nemulator. In order to directly access graphics hardware, one of the\naffected programs is setuid root. A local attacker could exploit this\nvulnerability to gain root privileges.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 1.2.2-1woody2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your atari800 package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nxfstt, a TrueType font server for the X window system was found to\ncontain two classes of vulnerabilities:
\nCAN-2003-0581: a remote attacker could send requests crafted to\n trigger any of several buffer overruns, causing a denial of service or\n possibly executing arbitrary code on the server with the privileges\n of the \"nobody\" user.
\nCAN-2003-0625: certain invalid data sent during the connection\n handshake could allow a remote attacker to read certain regions of\n memory belonging to the xfstt process. This information could be\n used for fingerprinting, or to aid in exploitation of a different\n vulnerability.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 1.2.1-3.
\nFor the unstable distribution (sid), CAN-2003-0581 is fixed in xfstt\n1.5-1, and CAN-2003-0625 will be fixed soon.
\nWe recommend that you update your xfstt package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTwo vulnerabilities were discovered in kdelibs:
\nThese vulnerabilities are described in the following security\nadvisories from KDE:
\nFor the current stable distribution (woody) these problems have been\nfixed in version 2.2.2-13.woody.8 of kdelibs and 2.2.2-6woody2 of\nkdelibs-crypto.
\nFor the unstable distribution (sid) these problems have been fixed in\nkdelibs version 4:3.1.3-1. The unstable distribution does not contain\na separate kdelibs-crypto package.
\nWe recommend that you update your kdelibs and kdelibs-crypto\npackages.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nmindi, a program for creating boot/root disks, does not take\nappropriate security precautions when creating temporary files. This\nbug could potentially be exploited to overwrite arbitrary files with\nthe privileges of the user running mindi.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.58.r5-1woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nRefer to Debian bug #203825.
\nWe recommend that you update your mindi package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe postfix mail transport agent in Debian 3.0 contains two\nvulnerabilities:
\nFor the current stable distribution (woody) these problems have been\nfixed in version 1.1.11-0.woody3.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you update your postfix package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nman-db provides the standard man(1) command on Debian systems. During\nconfiguration of this package, the administrator is asked whether\nman(1) should run setuid to a dedicated user (\"man\") in order to\nprovide a shared cache of preformatted manual pages. The default is\nfor man(1) NOT to be setuid, and in this configuration no known\nvulnerability exists. However, if the user explicitly requests setuid\noperation, a local attacker could exploit either of the following bugs to\nexecute arbitrary code as the \"man\" user.
\nAgain, these vulnerabilities do not affect the default configuration,\nwhere man is not setuid.
\n~/.manpath, which\n contained commands to be executed, would be honored even when\n running setuid, allowing any user to execute commands as the\n \"man\" user.For the current stable distribution (woody), these problems have been\nfixed in version 2.3.20-18.woody.4.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.4.1-13.
\nWe recommend that you update your man-db package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nSeveral vulnerabilities have been discovered in phpgroupware:
\nFor the stable distribution (woody), these problems have been fixed in\nversion 0.9.14-0.RC3.2.woody2.
\nFor the unstable distribution (sid), these problems will be fixed\nsoon. Refer to Debian bug #201980.
\nWe recommend that you update your phpgroupware package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\neroaster, a frontend for burning CD-R media using cdrecord, does not\ntake appropriate security precautions when creating a temporary file\nfor use as a lockfile. This bug could potentially be exploited to\noverwrite arbitrary files with the privileges of the user running\neroaster.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.1.0.0.3-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.0-0.5-1.
\nWe recommend that you update your eroaster package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAnother buffer overflow was discovered in xtokkaetama, involving the\n\"-nickname\" command line option. This vulnerability could be\nexploited by a local attacker to gain gid 'games'.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 1.0b-6woody2.
\nFor the unstable distribution (sid) this problem is fixed in version\n1.0b-9.
\nWe recommend that you update your xtokkaetama package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered a buffer overflow in xpcd-svga which can be\ntriggered by a long HOME environment variable. This vulnerability\ncould be exploited by a local attacker to gain root privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.08-8woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your xpcd package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered a buffer overflow in zblast-svgalib, when saving\nthe high score file. This vulnerability could be exploited by a local\nuser to gain gid 'games', if they can achieve a high score.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 1.2pre-5woody2.
\nFor the unstable distribution (sid) this problem is fixed in version\n1.2.1-7.
\nWe recommend that you update your zblast package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nFlorian Zumbiehl reported a vulnerability in pam-pgsql whereby the\nusername to be used for authentication is used as a format string when\nwriting a log message. This vulnerability may allow an attacker to\nexecute arbitrary code with the privileges of the program requesting\nPAM authentication.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.5.2-3woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.5.2-7.
\nWe recommend that you update your pam-pgsql package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA cross-site scripting vulnerability exists in the start_form()\nfunction in CGI.pm. This function outputs user-controlled data into\nthe action attribute of a form element without sanitizing it, allowing\na remote user to execute arbitrary web script within the context of\nthe generated page. Any program which uses this function in the\nCGI.pm module may be affected.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 5.6.1-8.3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.8.0-19.
\nWe recommend that you update your perl package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nShaun Colley discovered a buffer overflow vulnerability in netris, a\nnetwork version of a popular puzzle game. A netris client connecting\nto an untrusted netris server could be sent an unusually long data\npacket, which would be copied into a fixed-length buffer without\nbounds checking. This vulnerability could be exploited to gain the\nprivileges of the user running netris in client mode, if they connect\nto a hostile netris server.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 0.5-4woody1.
\nFor the unstable distribution (sid) this problem is fixed in version\n0.52-1.
\nWe recommend that you update your netris package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nChristian Jaeger discovered a buffer overflow in autorespond, an email\nautoresponder used with qmail. This vulnerability could potentially\nbe exploited by a remote attacker to gain the privileges of a user who\nhas configured qmail to forward messages to autorespond. This\nvulnerability is currently not believed to be exploitable due to\nincidental limits on the length of the problematic input, but there\nmay be situations in which these limits do not apply.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0.2-2woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your autorespond package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nlibpam-smb is a PAM authentication module which makes it possible to\nauthenticate users against a password database managed by Samba or a\nMicrosoft Windows server. If a long password is supplied, this can\ncause a buffer overflow which could be exploited to execute arbitrary\ncode with the privileges of the process which invokes PAM services.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.6-1.1woody1.
\nThe unstable distribution (sid) does not contain a libpam-smb\npackage.
\nWe recommend that you update your libpam-smb package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMorgan alias SM6TKY discovered and fixed several security related\nproblems in LinuxNode, an Amateur Packet Radio Node program. The\nbuffer overflow he discovered can be used to gain unauthorised root\naccess and can be remotely triggered.
\nFor the stable distribution (woody) this problem has been\nfixed in version 0.3.0a-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.3.2-1.
\nWe recommend that you upgrade your node packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA buffer overflow exists in exim, which is the standard mail transport\nagent in Debian. By supplying a specially crafted HELO or EHLO\ncommand, an attacker could cause a constant string to be written past\nthe end of a buffer allocated on the heap. This vulnerability is not\nbelieved at this time to be exploitable to execute arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nexim version 3.35-1woody2 and exim-tls version 3.35-3woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nexim version 3.36-8. The unstable distribution does not contain an\nexim-tls package.
\nWe recommend that you update your exim or exim-tls package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nwu-ftpd, an FTP server, implements a feature whereby multiple files\ncan be fetched in the form of a dynamically constructed archive file,\nsuch as a tar archive. The names of the files to be included are\npassed as command line arguments to tar, without protection against\nthem being interpreted as command-line options. GNU tar supports\nseveral command line options which can be abused, by means of this\nvulnerability, to execute arbitrary programs with the privileges of\nthe wu-ftpd process.
\nGeorgi Guninski pointed out that this vulnerability exists in Debian\nwoody.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.6.2-3woody2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your wu-ftpd package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nNicolas Boullis discovered two vulnerabilities in mah-jong, a\nnetwork-enabled game.
\nThis vulnerability could be exploited by a remote attacker to\n execute arbitrary code with the privileges of the user running the\n mah-jong server.
This vulnerability could be exploited by a remote attacker to cause\n the mah-jong server to enter a tight loop and stop responding to\n commands.
For the stable distribution (woody) these problems have been fixed in\nversion 1.4-2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.6-2.
\nWe recommend that you update your mah-jong package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAlexander Hvostov, Julien Blache and Aurelien Jarno discovered several\nsecurity-related problems in the sane-backends package, which contains\nan API library for scanners including a scanning daemon (in the\npackage libsane) that can be remotely exploited. These problems allow\na remote attacker to cause a segmentation fault and/or consume arbitrary\namounts of memory. The attack is successful, even if the attacker's\ncomputer isn't listed in saned.conf.
\nYou are only vulnerable if you actually run saned e.g. in xinetd or\ninetd. If the entries in the configuration file of xinetd or inetd\nrespectively are commented out or do not exist, you are safe.
\nTry \"telnet localhost 6566\" on the server that may run saned.\nIf you\nget \"connection refused\" saned is not running and you are safe.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:\n
saned checks the identity (IP address) of the remote host only\n after the first communication took place (SANE_NET_INIT). So\n everyone can send that RPC, even if the remote host is not allowed\n to scan (not listed in saned.conf).
saned lacks error checking nearly everywhere in the code. So\n connection drops are detected very late. If the drop of the\n connection isn't detected, the access to the internal wire buffer\n leaves the limits of the allocated memory. So random memory \"after\"\n the wire buffer is read which will be followed by a segmentation\n fault.
If saned expects strings, it mallocs the memory necessary to store\n the complete string after it receives the size of the string. If\n the connection was dropped before transmitting the size, malloc\n will reserve an arbitrary size of memory. Depending on that size\n and the amount of memory available either malloc fails (->saned\n quits nicely) or a huge amount of memory is allocated. Swapping\n and OOM measures may occur depending on the kernel.
saned doesn't check the validity of the RPC numbers it gets before\n getting the parameters.
If debug messages are enabled and a connection is dropped,\n non-null-terminated strings may be printed and segmentation faults\n may occur.
It's possible to allocate an arbitrary amount of memory on the\n server running saned even if the connection isn't dropped. At the\n moment this cannot easily be fixed according to the author.\n Better limit the total amount of memory saned may use (ulimit).
For the stable distribution (woody) this problem has been\nfixed in version 1.0.7-4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.11-1 and later.
\nWe recommend that you upgrade your libsane packages.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nFour vulnerabilities have been discovered in XFree86.
\nThe xterm package provides a terminal escape sequence that reports\n the window title by injecting it into the input buffer of the\n terminal window, as if the user had typed it. An attacker can craft\n an escape sequence that sets the title of a victim's xterm window to\n an arbitrary string (such as a shell command) and then reports that\n title. If the victim is at a shell prompt when this is done, the\n injected command will appear on the command line, ready to be run.\n Since it is not possible to embed a carriage return in the window\n title, the attacker would have to convince the victim to press Enter\n (or rely upon the victim's careless or confusion) for the shell or\n other interactive process to interpret the window title as user\n input. It is conceivable that the attacker could craft other escape\n sequences that might convince the victim to accept the injected\n input, however. The Common Vulnerabilities and Exposures project at\n cve.mitre.org has assigned the name\n CAN-2003-0063\n to this issue.
\nTo determine whether your version of xterm is vulnerable to abuse of\n the window title reporting feature, run the following command at a\n shell prompt from within an xterm window:
\necho -e \"\\e[21t\"\n
(The terminal bell may ring, and the window title may be prefixed\n with an \"l\".)
\nThis flaw is exploitable by anything that can send output to a\n terminal window, such as a text document. The xterm user has to\n take action to cause the escape sequence to be sent, however (such\n as by viewing a malicious text document with the \"cat\" command).\n Whether you are likely to be exposed to it depends on how you use\n xterm. Consider the following:
\necho -e '\\e]2;s && echo rm -rf *\\a' > /tmp/sploit\n echo -e '\\e[21t' >> /tmp/sploit\n cat /tmp/sploit\n
Debian has resolved this problem by disabling the window title\n reporting escape sequence in xterm; it is understood but ignored.\n The escape sequence to set the window title has not been disabled.
\nA future release of the xterm package will have a configuration\n option to permit the user to turn the window title reporting feature\n back on, but it will default off.
\nThe xterm package, since it emulates DEC VT-series text terminals,\n emulates a feature of DEC VT terminals known as \"User-Defined Keys\"\n (UDK for short). There is a bug in xterm's handling of DEC UDK\n escape sequences, however, and an ill-formed one can cause the xterm\n process to enter a tight loop. This causes the process to \"spin\",\n consuming CPU cycles uselessly, and refusing to handle signals (such\n as efforts to kill the process or close the window).
\nTo determine whether your version of xterm is vulnerable to this\n attack, run the following command at a shell prompt from within a\n \"sacrificial\" xterm window (i.e., one that doesn't have anything in\n the scrollback buffer you might need to see later):
\necho -e \"\\eP0;0|0A/17\\x9c\"\n
This flaw is exploitable by anything that can send output to a\n terminal window, such as a text document. The xterm user has to\n take action to cause the escape sequence to be sent, however (such\n as by viewing a malicious text document with the \"cat\" command).\n Whether you are likely to be exposed to it depends on how you use\n xterm.
\nDebian has resolved this problem by backporting an upstream fix\n to XFree86 4.1.0.
\nMost X servers descended from the MIT/X Consortium/X.Org Sample\n Implementation, including XFree86's X servers, support an extension\n to the X protocol called MIT-SHM, which enables X clients running on\n the same host as the X server to operate more quickly and\n efficiently by taking advantage of an operating system feature\n called shared memory where it is available. The Linux kernel, for\n example, supports shared memory.
\nBecause the X server runs with elevated privileges, the operating\n system's built-in access control mechanisms are ineffective to\n police the X server's usage of segments of shared memory. The X\n server has to implement its own access control. This was\n imperfectly done in previous releases of XFree86 (and the MIT/X\n Consortium/X.Org Sample Implementation before it), leaving\n opportunities for malicious X clients to read and alter shared\n memory segments to which they should not have access. The Common\n Vulnerabilities and Exposures project at cve.mitre.org has assigned\n the name\n CAN-2002-0164\n to this issue.
\nDebian's XFree86 4.1.0-16 packages shipped with an incomplete fix\n for the this flaw, only enforcing proper access control for X\n servers that were not started by a display manager (e.g., xdm).\n This update resolves that problem.
\nThe Debian Project knows of no exploits for this vulnerability. A\n malicious X client that abused the MIT-SHM extension could\n conceivably be written however, and run (deliberately or\n unwittingly) by a user able to run an X server on a host. The\n impact of this flaw depends on how shared memory is used on the\n system. See the ipcs(8) manual page for more information.
\nDebian has resolved this problem by backporting an upstream fix to\n XFree86 4.1.0.
\nSecurity researcher \"blexim\" wrote [paraphrased]:
\n\n\nI have identified several bugs in the font libraries of the\n current version of the XFree86 source code. These bugs could\n potentially lead to the execution of arbitrary code by a remote\n user in any process which calls the functions in question. The\n functions are related to the transfer and enumeration of fonts\n from font servers to clients, limiting the range of the exposure\n caused by these bugs.
\nSpecifically, several sizing variables passed from a font server\n to a client are not adequately checked, causing calculations on\n them to result in erroneous values. These erroneous calculations\n can lead to buffers on the heap and stack overflowing, potentially\n leading to arbitrary code execution. As stated before, the risk\n is limited by the fact that only clients can be affected by these\n bugs, but in some (non-default) configurations, both xfs and the X\n server can act as clients to remote font servers. In these\n configurations, both xfs and the X server could be potentially\n compromised.
\n
The Common Vulnerabilities and Exposures project at cve.mitre.org\n has assigned the name\n CAN-2003-0730\n to this issue.
\nThe Debian Project knows of no exploits for this vulnerability. By\n default in Debian, X servers are configured to listen only to a\n locally-running font server, which is not even used if the xfs\n package is not installed. The Debian default configuration of xfs\n uses only font directories on the local host, and does not attempt\n to connect to any external font servers.
\nDebian has resolved this problem by backporting an upstream fix to\n XFree86 4.1.0.
\nAll of the above problems also affect the xfree86v3 packages (in the\ncase of the first two flaws, the xterm source code contains the flaws,\nbut no xterm package is produced). Due to resource limitations and a\nlack of upstream support for this legacy code, Debian is unable to\ncontinue supporting version 3.3.6 of XFree86. To avoid exposure to\nthe latter two flaws in this advisory, we recommend that you remove\nthe following packages if you have them installed:
\n(You may also wish to remove the xext, xlib6, and xlib6-altdev packages,\nas support for them is being terminated along with the rest of the\nXFree86 3.3.6 packages, though they are not affected by the flaws in\nthis advisory.)
\nFor the stable distribution (woody) these problems have been fixed in\nversion 4.1.0-16woody1.
\nFor the unstable distribution (sid) all problems except\nCAN-2003-0730\nare fixed in version 4.2.1-11.\nCAN-2003-0730\nwill be fixed in 4.2.1-12, currently in preparation.
\nWe recommend that you update your xfree86 package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nMySQL, a popular relational database system, contains a buffer\noverflow condition which could be exploited by a user who has\npermission to execute \"ALTER TABLE\" commands on the tables in the\n\"mysql\" database. If successfully exploited, this vulnerability\ncould allow the attacker to execute arbitrary code with the\nprivileges of the mysqld process (by default, user \"mysql\"). Since\nthe \"mysql\" database is used for MySQL's internal record keeping, by\ndefault the mysql administrator \"root\" is the only user with\npermission to alter its tables.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.23.49-8.5.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nRefer to Debian bug #210403.
\nWe recommend that you update your mysql package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nA bug has been found in OpenSSH's buffer handling where a buffer could\nbe marked as grown when the actual reallocation failed.
\nDSA-382-2:\nThis advisory is an addition to the earlier DSA-382-1 advisory: two more\nbuffer handling problems have been found in addition to the one\ndescribed in DSA-382-1. It is not known if these bugs are exploitable,\nbut as a precaution an upgrade is advised.
\nDSA-382-3:\nThis advisory is an addition to the earlier DSA-382-1 and DSA-382-2\nadvisories: Solar Designer found four more bugs in OpenSSH that may be\nexploitable.
\nFor the Debian stable distribution (woody) these bugs have been fixed\nin version\n1:3.4p1-1.woody.3.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nSeveral bugs have been found in OpenSSH's buffer handling. It is not\nknown if these bugs are exploitable, but as a precaution an upgrade is\nadvised.
\nDSA-383-2:\nThis advisory is an addition to the earlier DSA-383-1 advisory: Solar\nDesigner found four more bugs in OpenSSH that may be exploitable.
\nFor the Debian stable distribution these bugs have been fixed in version\n1:3.4p1-0woody4.
\nWe recommend that you update your ssh-krb5 package.
\nMD5 checksums of the listed files are available in the original advisory.\n
MD5 checksums of the listed files are available in the revised advisory.\n
\n\n\nTwo vulnerabilities were reported in sendmail.
\nA \"potential buffer overflow in ruleset parsing\" for Sendmail\n 8.12.9, when using the nonstandard rulesets (1) recipient (2),\n final, or (3) mailer-specific envelope recipients, has unknown\n consequences.
The prescan function in Sendmail 8.12.9 allows remote attackers to\n execute arbitrary code via buffer overflow attacks, as demonstrated\n using the parseaddr function in parseaddr.c.
For the stable distribution (woody) these problems have been fixed in\nsendmail version 8.12.3-6.6 and sendmail-wide version\n8.12.3+3.5Wbeta-5.5.
\nFor the unstable distribution (sid) these problems have been fixed in\nsendmail version 8.12.10-1.
\nWe recommend that you update your sendmail package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJens Steube reported a pair of buffer overflow vulnerabilities in\nhztty, a program to translate Chinese character encodings in a\nterminal session. These vulnerabilities could be exploited by a local\nattacker to gain root privileges on a system where hztty is installed.
\nAdditionally, hztty had been incorrectly installed setuid root, when\nit only requires the privileges of group utmp. This has also been\ncorrected in this update.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0-5.2woody1.
\nFor the unstable distribution (sid) this problem will be fixed in\nversion 2.0-6.
\nWe recommend that you update your hztty package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe SuSE security team discovered during an audit a bug in\nMail::Mailer, a Perl module used for sending email, whereby\npotentially untrusted input is passed to a program such as mailx,\nwhich may interpret certain escape sequences as commands to be\nexecuted.
\nThis bug has been fixed by removing support for programs such as mailx\nas a transport for sending mail. Instead, alternative mechanisms are\nused.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.44-1woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your libmailtools-perl package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\ngopherd, a gopher server from the University of Minnesota, contains a\nnumber of buffer overflows which could be exploited by a remote\nattacker to execute arbitrary code with the privileges of the gopherd\nprocess (the \"gopher\" user by default).
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.0.3woody1.
\nThis program has been removed from the unstable distribution (sid).\ngopherd is deprecated, and users are recommended to use PyGopherd instead.
\nWe recommend that you update your gopherd package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTwo vulnerabilities were discovered in kdebase:
\nKDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred\n function call succeeds, which may allow attackers to gain root\n privileges by triggering error conditions within PAM modules, as\n demonstrated in certain configurations of the MIT pam_krb5 module.
KDM in KDE 3.1.3 and earlier uses a weak session cookie generation\n algorithm that does not provide 128 bits of entropy, which allows\n attackers to guess session cookies via brute force methods and gain\n access to the user session.
These vulnerabilities are described in the following security\nadvisory from KDE:
\nhttp://www.kde.org/info/security/advisory-20030916-1.txt
\nFor the current stable distribution (woody) these problems have been\nfixed in version 4:2.2.2-14.7.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you update your kdebase package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nipmasq is a package which simplifies configuration of Linux IP\nmasquerading, a form of network address translation which allows a\nnumber of hosts to share a single public IP address. Due to use of\ncertain improper filtering rules, traffic arriving on the external\ninterface addressed for an internal host would be forwarded,\nregardless of whether it was associated with an established\nconnection. This vulnerability could be exploited by an attacker\ncapable of forwarding IP traffic with an arbitrary destination address\nto the external interface of a system with ipmasq installed.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 3.5.10c.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.5.12.
\nWe recommend that you update your ipmasq package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered a buffer overflow in marbles, when processing\nthe HOME environment variable. This vulnerability could be exploited\nby a local user to gain gid 'games'.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 1.0.2-1woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your marbles package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered a buffer overflow in freesweep, when processing\nseveral environment variables. This vulnerability could be exploited\nby a local user to gain gid 'games'.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 0.88-4woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your freesweep package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJens Steube reported two vulnerabilities in webfs, a lightweight HTTP\nserver for static content.
\nCAN-2003-0832 - When virtual hosting is enabled, a remote client\n could specify \"..\" as the hostname in a request, allowing retrieval\n of directory listings or files above the document root.
\n CAN-2003-0833 - A long pathname could overflow a buffer allocated on\n the stack, allowing execution of arbitrary code. In order to exploit\n this vulnerability, it would be necessary to be able to create\n directories on the server in a location which could be accessed by\n the web server. In conjunction with CAN-2003-0832, this could be a\n world-writable directory such as /var/tmp.
For the current stable distribution (woody) these problems have been fixed\nin version 1.17.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.20.
\nWe recommend that you update your webfs package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nDr. Stephen Henson (steve@openssl.org), using a test suite\nprovided by NISCC (http://www.niscc.gov.uk/), discovered a number of\nerrors in the OpenSSL\nASN1 code. Combined with an error that causes the OpenSSL code to parse\nclient certificates even when it should not, these errors can cause a\ndenial of service (DoS) condition on a system using the OpenSSL code,\ndepending on how that code is used. For example, even though apache-ssl\nand ssh link to OpenSSL libraries, they should not be affected by this\nvulnerability. However, other SSL-enabled applications may be\nvulnerable and an OpenSSL upgrade is recommended.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 0.9.6c-2.woody.4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.9.7c-1.
\nWe recommend that you update your openssl package. Note that you will\nneed to restart services which use the libssl library for this update\nto take effect.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Henson of the OpenSSL core team identified and prepared fixes\nfor a number of vulnerabilities in the OpenSSL ASN1 code that were\ndiscovered after running a test suite by British National\nInfrastructure Security Coordination Centre (NISCC).
\nA bug in OpenSSLs SSL/TLS protocol was also identified which causes\nOpenSSL to parse a client certificate from an SSL/TLS client when it\nshould reject it as a protocol error.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nInteger overflow in OpenSSL that allows remote attackers to cause a\n denial of service (crash) via an SSL client certificate with\n certain ASN.1 tag values.
\nOpenSSL does not properly track the number of characters in certain\n ASN.1 inputs, which allows remote attackers to cause a denial of\n service (crash) via an SSL client certificate that causes OpenSSL\n to read past the end of a buffer when the long form is used.
\nDouble-free vulnerability allows remote attackers to cause a denial\n of service (crash) and possibly execute arbitrary code via an SSL\n client certificate with a certain invalid ASN.1 encoding. This bug\n was only present in OpenSSL 0.9.7 and is listed here only for\n reference.
\nFor the stable distribution (woody) this problem has been\nfixed in openssl095 version 0.9.5a-6.woody.3.
\nThis package is not present in the unstable (sid) or testing (sarge)\ndistribution.
\nWe recommend that you upgrade your libssl095a packages and restart\nservices using this library. Debian doesn't ship any packages that\nare linked against this library.
\nThe following commandline (courtesy of Ray Dassen) produces a list of\nnames of running processes that have libssl095 mapped into their\nmemory space:
\n\n find /proc -name maps -exec egrep -l 'libssl095' {} /dev/null \\; | sed -e 's/[^0-9]//g' | xargs --no-run-if-empty ps --no-headers -p | sed -e 's/^\\+//' -e 's/ \\+/ /g' | cut -d ' ' -f 5 | sort | uniq\n\nYou should restart the associated services.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nAldrin Martoq has discovered a denial of service (DoS) vulnerability in\nApache Tomcat 4.0.x. Sending several non-HTTP requests to Tomcat's HTTP\nconnector makes Tomcat reject further requests on this port until it is\nrestarted.
\nFor the current stable distribution (woody) this problem has been fixed\nin version 4.0.3-3woody3.
\nFor the unstable distribution (sid) this problem does not exist in the\ncurrent version 4.1.24-2.
\nWe recommend that you upgrade your tomcat4 packages and restart the\ntomcat server.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSeveral vulnerabilities have been discovered in thttpd, a tiny HTTP\nserver.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing vulnerabilities:
\nMarcus Breiing discovered that if thttpd it is used for virtual\n hosting, and an attacker supplies a specially crafted \u201cHost:\u201d\n header with a pathname instead of a hostname, thttpd will reveal\n information about the host system. Hence, an attacker can browse\n the entire disk.
Joel S\u00f6derberg and Christer \u00d6berg discovered a remote overflow which\n allows an attacker to partially overwrite the EBP register and\n hence execute arbitrary code.
For the stable distribution (woody) these problems have been fixed in\nversion 2.21b-11.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.23beta1-2.3.
\nWe recommend that you upgrade your thttpd package immediately.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nTom Lane discovered a buffer overflow in the to_ascii function in\nPostgreSQL. This allows remote attackers to execute arbitrary code on\nthe host running the database.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 7.2.1-2woody4.
\nThe unstable distribution (sid) does not contain this problem.
\nWe recommend that you upgrade your postgresql package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered a buffer overflow in the environment variable\nhandling of conquest, a curses based, real-time, multi-player space\nwarfare game, which could lead a local attacker to gain unauthorised\naccess to the group conquest.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 7.1.1-6woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 7.2-5.
\nWe recommend that you upgrade your conquest package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nJeremy Nelson discovered a remotely exploitable buffer overflow in\nEPIC4, a popular client for Internet Relay Chat (IRC). A malicious\nserver could craft a reply which triggers the client to allocate a\nnegative amount of memory. This could lead to a denial of service if\nthe client only crashes, but may also lead to executing of arbitrary\ncode under the user id of the chatting user.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.2.20020219-2.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.11.20030409-2.
\nWe recommend that you upgrade your epic4 package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nSteve Kemp discovered a buffer overflow in the commandline and\nenvironment variable handling of omega-rpg, a text-based rogue-style\ngame of dungeon exploration, which could lead a local attacker to gain\nunauthorised access to the group games.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.90-pa9-7woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.90-pa9-11.
\nWe recommend that you upgrade your omega-rpg package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nThe SuSE Security Team discovered several exploitable formats string\nvulnerabilities in hylafax, a flexible client/server fax system, which\ncould lead to executing arbitrary code as root on the fax server.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.1.1-1.3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.1.8-1.
\nWe recommend that you upgrade your hylafax packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA security-related problem has been discovered in minimalist, a\nmailing list manager, which allows a remote attacker to execute\narbitrary commands.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2-4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.4-1.
\nWe recommend that you upgrade your minimalist package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRecently multiple servers of the Debian project were compromised using a\nDebian developers account and an unknown root exploit. Forensics\nrevealed a burneye encrypted exploit. Robert van der Meulen managed to\ndecrypt the binary which revealed a kernel exploit. Study of the exploit\nby the Red Hat and SuSE kernel and security teams quickly revealed that\nthe exploit used an integer overflow in the brk system call. Using\nthis bug it is possible for a userland program to trick the kernel into\ngiving access to the full kernel address space. This problem was found\nin September by Andrew Morton, but unfortunately that was too late for\nthe 2.4.22 kernel release.
\nThis bug has been fixed in kernel version 2.4.23 for the 2.4 tree and\n2.6.0-test6 kernel tree. For Debian it has been fixed in version\n2.4.18-14 of the kernel source packages, version 2.4.18-12 of the i386\nkernel images and version 2.4.18-11 of the alpha kernel images.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe rsync team has received evidence that a vulnerability in all\nversions of rsync prior to 2.5.7, a fast remote file copy program, was\nrecently used in combination with a Linux kernel vulnerability to\ncompromise the security of a public rsync server.
\nWhile this heap overflow vulnerability could not be used by itself to\nobtain root access on an rsync server, it could be used in combination\nwith the recently announced do_brk() vulnerability in the Linux kernel\nto produce a full remote compromise.
\nPlease note that this vulnerability only affects the use of rsync as\nan \"rsync server\". To see if you are running a rsync server you\nshould use the command \"netstat -a -n\" to see if you are listening on\nTCP port 873. If you are not listening on TCP port 873 then you are\nnot running an rsync server.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.5.5-0.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.5.6-1.1.
\nHowever, since the Debian infrastructure is not yet fully functional\nafter the recent break-in, packages for the unstable distribution are\nnot able to enter the archive for a while. Hence they were placed in\nJoey's home directory on the security machine.
\nWe recommend that you upgrade your rsync package immediately if you\nare providing remote sync services. If you are running testing and\nprovide remote sync services please use the packages for woody.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered a problem in xsok, a single player strategy game\nfor X11, related to the Sokoban game, which leads a user to execute\narbitrary commands under the GID of games.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.02-9woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.02-11.
\nWe recommend that you upgrade your xsok package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered a buffer overflow in lftp, a set of\nsophisticated command-line FTP/HTTP client programs. An attacker\ncould create a carefully crafted directory on a website so that the\nexecution of an 'ls' or 'rels' command would lead to the execution of\narbitrary code on the client machine.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.4.9-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.6.10-1.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities were discovered upstream in ethereal, a\nnetwork traffic analyzer. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nA buffer overflow allows remote attackers to cause a denial of\n service and possibly execute arbitrary code via a malformed GTP\n MSISDN string.
\nVia certain malformed ISAKMP or MEGACO packets remote attackers are\n able to cause a denial of service (crash).
\nA heap-based buffer overflow allows remote attackers to cause a\n denial of service (crash) and possibly execute arbitrary code via\n the SOCKS dissector.
\nThe SMB dissector allows remote attackers to cause a denial of\n service via a malformed SMB packet that triggers a segmentation\n fault during processing of selected packets.
\nThe Q.931 dissector allows remote attackers to cause a denial of\n service (crash) via a malformed Q.931, which triggers a null\n dereference.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.4-1woody6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.10.0-1.
\nWe recommend that you upgrade your ethereal and tethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTimo Sirainen reported a vulnerability in screen, a terminal\nmultiplexor with VT100/ANSI terminal emulation, that can lead an\nattacker to gain group utmp privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.9.11-5woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.2-0.1.
\nWe recommend that you upgrade your screen package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in BIND, a domain name server, whereby\na malicious name server could return authoritative negative responses\nwith a large TTL (time-to-live) value, thereby rendering a domain name\nunreachable. A successful attack would require that a vulnerable BIND\ninstance submit a query to a malicious nameserver.
\nThe bind9 package is not affected by this vulnerability.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1:8.3.3-2.0woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1:8.4.3-1.
\nWe recommend that you update your bind package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in libnids, a library used to analyze\nIP network traffic, whereby a carefully crafted TCP datagram could\ncause memory corruption and potentially execute arbitrary code with\nthe privileges of the user executing a program which uses libnids\n(such as dsniff).
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.16-3woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your libnids package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in mpg321, a command-line mp3 player,\nwhereby user-supplied strings were passed to printf(3) unsafely. This\nvulnerability could be exploited by a remote attacker to overwrite\nmemory, and possibly execute arbitrary code. In order for this\nvulnerability to be exploited, mpg321 would need to play a malicious\nmp3 file (including via HTTP streaming).
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.2.10.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.2.10.3.
\nWe recommend that you update your mpg321 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities were discovered in nd, a command-line WebDAV\ninterface, whereby long strings received from the remote server could\noverflow fixed-length buffers. This vulnerability could be exploited\nby a remote attacker in control of a malicious WebDAV server to\nexecute arbitrary code if the server was accessed by a vulnerable\nversion of nd.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.5.0-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.8.2-1.
\nWe recommend that you update your nd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz discovered a flaw in bounds checking in mremap() in the\nLinux kernel (present in version 2.4.x and 2.6.x) which may allow\na local attacker to gain root privileges.\nVersion 2.2 is not affected by this bug, since it doesn't support the\nMREMAP_FIXED flag (as clarified later).
\nFor the stable distribution (woody) this problem has been fixed in\nkernel-source version 2.4.18-14.1 and kernel-images versions\n2.4.18-12.1 and 2.4.18-5woody6 (bf) for the i386 architecture.
\nFor the unstable distribution (sid) this problem will be fixed soon\nwith newly uploaded packages.
\nWe recommend that you upgrade your kernel packages. This problem has\nbeen fixed in the upstream version 2.4.24 as well.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in jabber, an instant messaging server,\nwhereby a bug in the handling of SSL connections could cause the\nserver process to crash, resulting in a denial of service.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.4.2a-1.1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4.3-1.
\nWe recommend that you update your jabber package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities were discovered in zebra, an IP routing daemon:
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.92a-5woody2.
\nThe zebra package has been obsoleted in the unstable distribution by\nGNU Quagga, where this problem was fixed in version 0.96.4x-4.
\nWe recommend that you update your zebra package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in fsp, client utilities for File Service Protocol (FSP), whereby a remote user could both\nescape from the FSP root directory (CAN-2003-1022), and also overflow\na fixed-length buffer to execute arbitrary code (CAN-2004-0011).
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.81.b3-3.1woody1.
\nFor the unstable distribution, this problem is fixed in version\n2.81.b18-1.
\nWe recommend that you update your fsp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz discovered a flaw in bounds checking in mremap() in the\nLinux kernel (present in version 2.4.x and 2.6.x) which may allow a\nlocal attacker to gain root privileges. Version 2.2 is not affected\nby this bug.
\nAndrew Morton discovered a missing boundary check for the brk system\ncall which can be used to craft a local root exploit.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.18-12 for the alpha architecture and in\nversion 2.4.18-1woody3 for the powerpc architecture.
\nFor the unstable distribution (sid) these problems will be fixed soon\nwith newly uploaded packages.
\nWe recommend that you upgrade your kernel packages. These problems have\nbeen fixed in the upstream version 2.4.24 as well.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nA bug was discovered in vbox3, a voice response system for isdn4linux,\nwhereby root privileges were not properly relinquished before\nexecuting a user-supplied tcl script. By exploiting this\nvulnerability, a local user could gain root privileges.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.1.7.1.
\nFor the unstable distribution, this problem has been fixed in version 0.1.8.
\nWe recommend that you update your vbox3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe authors of phpgroupware, a web based groupware system written in\nPHP, discovered several vulnerabilities. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nIn the \"calendar\" module, \"save extension\" was not enforced for\n holiday files. As a result, server-side php scripts may be placed\n in directories that then could be accessed remotely and cause the\n webserver to execute those. This was resolved by enforcing the\n extension \".txt\" for holiday files.
\nSome SQL injection problems (non-escaping of values used in SQL\n strings) the \"calendar\" and \"infolog\" modules.
\nAdditionally, the Debian maintainer adjusted the permissions on world\nwritable directories that were accidentally created by former postinst\nduring the installation.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.14-0.RC3.2.woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.14.007-4.
\nWe recommend that you upgrade your phpgroupware, phpgroupware-calendar\nand phpgroupware-infolog packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered a security related problem in jitterbug, a\nsimple CGI based bug tracking and reporting tool. Unfortunately the\nprogram executions do not properly sanitize input, which allows an\nattacker to execute arbitrary commands on the server hosting the bug\ndatabase. As mitigating factors these attacks are only available to\nnon-guest users, and accounts for these people must be setup by the\nadministrator making them \"trusted\".
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.6.2-4.2woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.6.2-4.5.
\nWe recommend that you upgrade your jitterbug package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDavid B Harris discovered a problem with mod-auth-shadow, an Apache\nmodule which authenticates users against the system shadow password\ndatabase, where the expiration status of the user's account and\npassword were not enforced. This vulnerability would allow an\notherwise authorized user to successfully authenticate, when the\nattempt should be rejected due to the expiration parameters.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.3-3.1woody.1
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4-1.
\nWe recommend that you update your mod-auth-shadow package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe account management of the CVS pserver (which is used to give remote\naccess to CVS repositories) uses a CVSROOT/passwd file in each\nrepository which contains the accounts and their authentication\ninformation as well as the name of the local unix account to use when a\npserver account is used. Since CVS performed no checking on what unix\naccount was specified anyone who could modify the CVSROOT/passwd\ncould gain access to all local users on the CVS server, including root.
\nThis has been fixed in upstream version 1.11.11 by preventing pserver\nfrom running as root. For Debian this problem is solved in version\n1.11.1p1debian-9 in two different ways:
\nAdditionally, CVS pserver had a bug in parsing module requests which\ncould be used to create files and directories outside a repository.\nThis has been fixed upstream in version 1.11.11 and Debian version\n1.11.1p1debian-9.
\nFinally, the umask used for \u201ccvs init\u201d and\n\u201ccvs-makerepos\u201d has been\nchanged to prevent repositories from being created with group write\npermissions.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe IA-64 maintainers fixed several security related bugs in the Linux\nkernel 2.4.17 used for the IA-64 architecture, mostly by backporting\nfixes from 2.4.18. The corrections are listed below with the\nidentification from the Common Vulnerabilities and Exposures (CVE)\nproject:
\nMultiple ethernet network interface card (NIC) device drivers do\n not pad frames with null bytes, which allows remote attackers to\n obtain information from previous packets or kernel memory by using\n malformed packets, as demonstrated by Etherleak.
\nLinux kernel 2.4.10 through 2.4.21-pre4 does not properly handle\n the O_DIRECT feature, which allows local attackers with write\n privileges to read portions of previously deleted files, or cause\n file system corruption.
\nThe kernel module loader in Linux kernel 2.2.x before 2.2.25, and\n 2.4.x before 2.4.21, allows local users to gain root privileges\n by using ptrace to attach to a child process which is spawned by\n the kernel.
\nThe virtual file /proc/tty/driver/serial in Linux 2.4.x reveals\n the exact number of characters used in serial links, which could\n allow local users to obtain potentially sensitive information such\n as the length of passwords.
\nA race condition in the way env_start and env_end pointers are\n initialized in the execve system call and used in fs/proc/base.c\n on Linux 2.4 allows local users to cause a denial of service\n (crash).
\nThe execve system call in Linux 2.4.x records the file descriptor\n of the executable process in the file table of the calling\n process, which allows local users to gain read access to\n restricted file descriptors.
\nThe /proc filesystem in Linux allows local users to obtain\n sensitive information by opening various entries in /proc/self\n before executing a setuid program, which causes the program to\n fail to change the ownership and permissions of those entries.
\nThe STP protocol, as enabled in Linux 2.4.x, does not provide\n sufficient security by design, which allows attackers to modify\n the bridge topology.
\nThe STP protocol implementation in Linux 2.4.x does not properly\n verify certain lengths, which could allow attackers to cause a\n denial of service.
\nLinux 2.4.x allows remote attackers to spoof the bridge Forwarding\n table via forged packets whose source addresses are the same as\n the target.
\nAn integer overflow in brk system call (do_brk function) for Linux\n kernel 2.4.22 and earlier allows local users to gain root\n privileges.
\nThe mremap system call (do_mremap) in Linux kernel 2.4 and 2.6\n does not properly perform boundary checks, which allows local\n users to cause a denial of service and possibly gain privileges by\n causing a remapping of a virtual memory area (VMA) to create a\n zero length VMA.
\nFor the stable distribution (woody) this problem has been fixed in\nversion kernel-image-2.4.17-ia64 for the ia64 architecture. Other\narchitectures are already or will be fixed separately.
\nFor the unstable distribution (sid) this problem will be fixed soon\nwith newly uploaded packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in Midnight Commander, a file manager,\nwhereby a malicious archive (such as a .tar file) could cause\narbitrary code to be executed if opened by Midnight Commander.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 4.5.55-1.2woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1:4.6.0-4.6.1-pre1-1.
\nWe recommend that you update your mc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities were discovered in tcpdump, a tool for\ninspecting network traffic. If a vulnerable version of tcpdump\nattempted to examine a maliciously constructed packet, a number of\nbuffer overflows could be exploited to crash tcpdump, or potentially\nexecute arbitrary code with the privileges of the tcpdump process.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 3.6.2-2.7.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you update your tcpdump package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nnetpbm is a graphics conversion toolkit made up of a large number of\nsingle-purpose programs. Many of these programs were found to create\ntemporary files in an insecure manner, which could allow a local\nattacker to overwrite files with the privileges of the user invoking a\nvulnerable netpbm tool.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 2:9.20-8.4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2:9.25-9.
\nWe recommend that you update your netpbm-free package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz discovered a flaw in bounds checking in mremap() in the\nLinux kernel (present in version 2.4.x and 2.6.x) which may allow a\nlocal attacker to gain root privileges. Version 2.2 is not affected\nby this bug.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.4.17-0.020226.2.woody3 the mips and mipsel architectures.
\nFor the unstable distribution (sid) this problem will be fixed soon\nwith newly uploaded packages.
\nWe recommend that you upgrade your kernel packages. This problem has\nbeen fixed in the upstream version 2.4.24 as well.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in slocate, a program to index and\nsearch for files, whereby a specially crafted database could overflow\na heap-based buffer. This vulnerability could be exploited by a local\nattacker to gain the privileges of the \"slocate\" group, which can\naccess the global database containing a list of pathnames of all files\non the system, including those which should only be visible to\nprivileged users.
\nThis problem, and a category of potential similar problems, have been\nfixed by modifying slocate to drop privileges before reading a\nuser-supplied database.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.6-1.3.2.
\nFor the unstable distribution (sid) this problem will be fixed soon.\nRefer to Debian bug #226103\nfor status information.
\nWe recommend that you update your slocate package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPhong Nguyen identified a severe bug in the way GnuPG creates and uses\nElGamal keys for signing. This is a significant security failure\nwhich can lead to a compromise of almost all ElGamal keys used for\nsigning.
\nThis update disables the use of this type of key.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.0.6-4woody1.
\nFor the unstable distribution, this problem has been fixed in version\n1.2.4-1.
\nWe recommend that you update your gnupg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered a problem in trr19, a type trainer application\nfor GNU Emacs, which is written as a pair of setgid() binaries and\nwrapper programs which execute commands for GNU Emacs. However, the\nbinaries don't drop privileges before executing a command, allowing an\nattacker to gain access to the local group games.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0beta5-15woody1. The mipsel binary will be added later.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your trr19 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Szabo discovered a number of similar bugs in suidperl, a helper\nprogram to run perl scripts with setuid privileges. By exploiting\nthese bugs, an attacker could abuse suidperl to discover information\nabout files (such as testing for their existence and some of their\npermissions) that should not be accessible to unprivileged users.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 5.6.1-8.6.
\nFor the unstable distribution (sid), this problem will be fixed soon. Refer\nto Debian bug #220486.
\nWe recommend that you update your perl package if you have the\n\"perl-suid\" package installed.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit Project discovered a problem in\ncrawl, another console based dungeon exploration game, in the vein of\nnethack and rogue. The program uses several environment variables as\ninputs but doesn't apply a size check before copying one of them into\na fixed size buffer.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.0.0beta23-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.0beta26-4.
\nWe recommend that you upgrade your crawl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRed Hat and SuSE kernel and security teams revealed an integer overflow\nin the do_brk() function of the Linux kernel allows local users to\ngain root privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.4.17-0.020226.2.woody4. Other architectures are already or\nwill be fixed separately.
\nFor the unstable distribution (sid) this problem will be fixed soon\nwith newly uploaded packages.
\nWe recommend that you upgrade your kernel image packages for the mips\nand mipsel architectures. This problem has been fixed in the upstream\nversion 2.4.23 as well and is also fixed in 2.4.24, of course.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Esser discovered several security related problems in Gaim, a\nmulti-protocol instant messaging client. Not all of them are\napplicable for the version in Debian stable, but affected the version\nin the unstable distribution at least. The problems were grouped for\nthe Common Vulnerabilities and Exposures as follows:
\nWhen the Yahoo Messenger handler decodes an octal value for email\n notification functions two different kinds of overflows can be\n triggered. When the MIME decoder decoded a quoted printable\n encoded string for email notification two other different kinds of\n overflows can be triggered. These problems only affect the\n version in the unstable distribution.
\nWhen parsing the cookies within the HTTP reply header of a Yahoo\n web connection a buffer overflow can happen. When parsing the\n Yahoo Login Webpage the YMSG protocol overflows stack buffers if\n the web page returns oversized values. When splitting a URL into\n its parts a stack overflow can be caused. These problems only\n affect the version in the unstable distribution.
\nWhen an oversized keyname is read from a Yahoo Messenger packet a\n stack overflow can be triggered. When Gaim is setup to use an HTTP\n proxy for connecting to the server a malicious HTTP proxy can\n exploit it. These problems affect all versions Debian ships.\n However, the connection to Yahoo doesn't work in the version in\n Debian stable.
\nInternally data is copied between two tokens into a fixed size\n stack buffer without a size check. This only affects the version\n of gaim in the unstable distribution.
\nWhen allocating memory for AIM/Oscar DirectIM packets an integer\n overflow can happen, resulting in a heap overflow. This only\n affects the version of gaim in the unstable distribution.
\nFor the stable distribution (woody) these problems has been fixed in\nversion 0.58-2.4.
\nFor the unstable distribution (sid) these problems has been fixed in\nversion 0.75-2.
\nWe recommend that you upgrade your gaim packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in mpg123, a command-line mp3 player,\nwhereby a response from a remote HTTP server could overflow a buffer\nallocated on the heap, potentially permitting execution of arbitrary\ncode with the privileges of the user invoking mpg123. In order for\nthis vulnerability to be exploited, mpg123 would need to request an\nmp3 stream from a malicious remote server via HTTP.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.59r-13woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.59r-15.
\nWe recommend that you update your mpg123 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been fixed in the mailman package:
\nThe cross-site scripting vulnerabilities could allow an attacker to\nperform administrative operations without authorization, by stealing a\nsession cookie.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 2.0.11-1woody7.
\nFor the unstable distribution (sid),\nCAN-2003-0965 is fixed in version 2.1.4-1, and\nCAN-2003-0038 in version 2.1.1-1.\nCAN-2003-0991 will be fixed soon.
\nWe recommend that you update your mailman package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nA vulnerability was discovered in cgiemail, a CGI program used to\nemail the contents of an HTML form, whereby it could be used to send\nemail to arbitrary addresses. This type of vulnerability is commonly\nexploited to send unsolicited commercial email (spam).
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.6-14woody1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6-20.
\nWe recommend that you update your cgiemail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a critical\nsecurity vulnerability in the memory management code of Linux inside\nthe mremap(2) system call. Due to missing function return value check\nof internal functions a local attacker can gain root privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.4.18-14.2 of kernel-source, version 2.4.18-14 of alpha\nimages, version 2.4.18-12.2 of i386 images, version 2.4.18-5woody7\nof i386bf images and version 2.4.18-1woody4 of powerpc images.
\nOther architectures will probably mentioned in a separate advisory or\nare not affected (m68k).
\nFor the unstable distribution (sid) this problem is fixed in version\n2.4.24-3 for source, i386 and alpha images and version 2.4.22-10 for\npowerpc images.
\nThis problem is also fixed in the upstream version of Linux 2.4.25 and\n2.6.3.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local root exploits have been discovered recently in the Linux\nkernel. This security advisory updates the ARM kernel for\nDebian GNU/Linux. The Common Vulnerabilities and Exposures project\nidentifies the following problems that are fixed with this update:
\nAn integer overflow in brk() system call (do_brk() function) for\n Linux allows a local attacker to gain root privileges. Fixed\n upstream in Linux 2.4.23.
\nPaul Starzetz discovered\n a flaw in bounds checking in mremap() in\n the Linux kernel (present in version 2.4.x and 2.6.x) which may\n allow a local attacker to gain root privileges. Version 2.2 is not\n affected by this bug. Fixed upstream in Linux 2.4.24.
\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a\n critical security vulnerability in the memory management code of\n Linux inside the mremap(2) system call. Due to missing function\n return value check of internal functions a local attacker can gain\n root privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.16-20040204 of lart, netwinder and riscpc image and in\nversion 20040204 of kernel-patch-2.4.16-arm.
\nOther architectures will probably be mentioned in a separate advisory or\nare not affected (m68k).
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local root exploits have been discovered recently in the Linux\nkernel. This security advisory updates the PowerPC/Apus kernel for\nDebian GNU/Linux. The Common Vulnerabilities and Exposures project\nidentifies the following problems that are fixed with this update:
\nAn integer overflow in brk() system call (do_brk() function) for\n Linux allows a local attacker to gain root privileges. Fixed\n upstream in Linux 2.4.23.
\nPaul Starzetz discovered\n a flaw in bounds checking in mremap() in\n the Linux kernel (present in version 2.4.x and 2.6.x) which may\n allow a local attacker to gain root privileges. Version 2.2 is not\n affected by this bug. Fixed upstream in Linux 2.4.24.
\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a\n critical security vulnerability in the memory management code of\n Linux inside the mremap(2) system call. Due to missing function\n return value check of internal functions a local attacker can gain\n root privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.17-4 of powerpc/apus images.
\nOther architectures will probably be mentioned in a separate advisory or\nare not affected (m68k).
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a critical\nsecurity vulnerability in the memory management code of Linux inside\nthe mremap(2) system call. Due to missing function return value check\nof internal functions a local attacker can gain root privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.4.17-0.020226.2.woody5 for mips and mipsel kernel images.
\nOther architectures will probably mentioned in a separate advisory or\nare not affected (m68k).
\nFor the unstable distribution (sid) this problem will be fixed soon\nwith the next upload of a 2.4.19 kernel image and in version\n2.4.22-0.030928.3 for 2.4.22 for the mips and mipsel architectures.
\nThis problem is also fixed in the upstream version of Linux 2.4.25 and\n2.6.3.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been fixed in the Linux kernel\n2.4.17 used for the S/390 architecture, mostly by backporting fixes\nfrom 2.4.18 and incorporating recent security fixes. The corrections\nare listed below with the identification from the Common\nVulnerabilities and Exposures (CVE) project:
\nThe iBCS routines in arch/i386/kernel/traps.c for Linux kernels\n 2.4.18 and earlier on x86 systems allow local users to kill\n arbitrary processes via a binary compatibility interface (lcall).
\nMultiple ethernet network interface card (NIC) device drivers do\n not pad frames with null bytes, which allows remote attackers to\n obtain information from previous packets or kernel memory by using\n malformed packets, as demonstrated by Etherleak.
\nThe route cache implementation in Linux 2.4, and the Netfilter IP\n conntrack module, allows remote attackers to cause a denial of\n service (CPU consumption) via packets with forged source addresses\n that cause a large number of hash table collisions related to the\n PREROUTING chain.
\nThe ioperm system call in Linux kernel 2.4.20 and earlier does not\n properly restrict privileges, which allows local users to gain read\n or write access to certain I/O ports.
\nA vulnerability in the TTY layer of the Linux kernel 2.4 allows\n attackers to cause a denial of service (\"kernel oops\").
\nThe mxcsr code in Linux kernel 2.4 allows attackers to modify CPU\n state registers via a malformed address.
\nThe TCP/IP fragment reassembly handling in the Linux kernel 2.4\n allows remote attackers to cause a denial of service (CPU\n consumption) via certain packets that cause a large number of hash\n table collisions.
\nAn integer overflow in brk() system call (do_brk() function) for\n Linux allows a local attacker to gain root privileges. Fixed\n upstream in Linux 2.4.23.
\nPaul Starzetz discovered\n a flaw in bounds checking in mremap() in\n the Linux kernel (present in version 2.4.x and 2.6.x) which may\n allow a local attacker to gain root privileges. Version 2.2 is not\n affected by this bug. Fixed upstream in Linux 2.4.24.
\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a\n critical security vulnerability in the memory management code of\n Linux inside the mremap(2) system call. Due to missing function\n return value check of internal functions a local attacker can gain\n root privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.17-2.woody.3 of s390 images and in version\n0.0.20020816-0.woody.2 of the patch packages.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA number of vulnerabilities have been discovered in XFree86. The corrections\nare listed below with the identification from the Common\nVulnerabilities and Exposures (CVE) project:
\nBuffer overflow in ReadFontAlias from dirfile.c of\n XFree86 4.1.0 through 4.3.0 allows local users and remote attackers to\n execute arbitrary code via a font alias file (font.alias) with a long\n token, a different vulnerability than CAN-2004-0084.
\nBuffer overflow in the ReadFontAlias function in XFree86\n 4.1.0 to 4.3.0, when using the CopyISOLatin1Lowered function, allows\n local or remote authenticated users to execute arbitrary code via a\n malformed entry in the font alias (font.alias) file, a different\n vulnerability than CAN-2004-0083.
\nMiscellaneous additional flaws in XFree86's handling of\n font files.
\nxdm does not verify whether the pam_setcred function call\n succeeds, which may allow attackers to gain root privileges by\n triggering error conditions within PAM modules, as demonstrated in\n certain configurations of the MIT pam_krb5 module.
\nDenial-of-service attacks against the X\n server by clients using the GLX extension and Direct Rendering\n Infrastructure are possible due to unchecked client data (out-of-bounds\n array indexes [CAN-2004-0093] and integer signedness errors\n [CAN-2004-0094]).
\nExploitation of CAN-2004-0083, CAN-2004-0084, CAN-2004-0106,\nCAN-2004-0093 and CAN-2004-0094 would require a connection to the X\nserver. By default, display managers in Debian start the X server\nwith a configuration which only accepts local connections, but if the\nconfiguration is changed to allow remote connections, or X servers are\nstarted by other means, then these bugs could be exploited remotely.\nSince the X server usually runs with root privileges, these bugs could\npotentially be exploited to gain root privileges.
\nNo attack vector for CAN-2003-0690 is known at this time.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 4.1.0-16woody3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.3.0-2.
\nWe recommend that you update your xfree86 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a critical\nsecurity vulnerability in the memory management code of Linux inside\nthe mremap(2) system call. Due to missing function return value check\nof internal functions a local attacker can gain root privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 011226.16 of ia64 kernel source and images.
\nOther architectures are or will be mentioned in a separate advisory\nrespectively or are not affected (m68k).
\nFor the unstable distribution (sid) this problem will be fixed in version\n2.4.24-3.
\nThis problem is also fixed in the upstream version of Linux 2.4.25 and\n2.6.3.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project\ndiscovered a vulnerability in\nlbreakout2, a game, where proper bounds checking was not performed on\nenvironment variables. This bug could be exploited by a local\nattacker to gain the privileges of group \"games\".
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.2.2-1woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your lbreakout2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project\ndiscovered a vulnerability in\nsynaesthesia, a program which represents sounds visually.\nsynaesthesia created its configuration file while holding root\nprivileges, allowing a local user to create files owned by root and\nwritable by the user's primary group. This type of vulnerability can\nusually be easily exploited to execute arbitrary code with root\nprivileges by various means.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.1-2.1woody1.
\nThe unstable distribution (sid) is not affected by this problem, because\nsynaesthesia is no longer setuid.
\nWe recommend that you update your synaesthesia package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project\ndiscovered a format string\nvulnerability in hsftp. This vulnerability could be exploited by an\nattacker able to create files on a remote server with carefully\ncrafted names, to which a user would connect using hsftp. When the\nuser requests a directory listing, particular bytes in memory could be\noverwritten, potentially allowing arbitrary code to be executed with\nthe privileges of the user invoking hsftp.
\nNote that while hsftp is installed setuid root, it only uses these\nprivileges to acquire locked memory, and then relinquishes them.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.11-1woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your hsftp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities were discovered in pwlib, a library used to\naid in writing portable applications, whereby a remote attacker could\ncause a denial of service or potentially execute arbitrary code. This\nlibrary is most notably used in several applications implementing the\nH.323 teleconferencing protocol, including the OpenH323 suite,\ngnomemeeting and asterisk.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.2.5-5woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.\nRefer to Debian Bug#233888 for details.
\nWe recommend that you update your pwlib package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered two format string bugs (CAN-2004-0104) and\ntwo buffer overflow bugs (CAN-2004-0105) in metamail, an\nimplementation of MIME. An attacker could create a carefully-crafted\nmail message which will execute arbitrary code as the victim when it\nis opened and parsed through metamail.
\nWe have been devoting some effort to trying to avoid shipping metamail\nin the future. It became unmaintainable and these are probably not\nthe last of the vulnerabilities.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.7-45woody.2.
\nFor the unstable distribution (sid) these problems will be fixed in\nversion 2.7-45.2.
\nWe recommend that you upgrade your metamail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local root exploits have been discovered recently in the Linux\nkernel. This security advisory updates the mips kernel 2.4.19 for\nDebian GNU/Linux. The Common Vulnerabilities and Exposures project\nidentifies the following problems that are fixed with this update:
\nAn integer overflow in brk() system call (do_brk() function) for\n Linux allows a local attacker to gain root privileges. Fixed\n upstream in Linux 2.4.23.
\nPaul Starzetz discovered\n a flaw in bounds checking in mremap() in\n the Linux kernel (present in version 2.4.x and 2.6.x) which may\n allow a local attacker to gain root privileges. Version 2.2 is not\n affected by this bug. Fixed upstream in Linux 2.4.24.
\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a\n critical security vulnerability in the memory management code of\n Linux inside the mremap(2) system call. Due to missing function\n return value check of internal functions a local attacker can gain\n root privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.19-0.020911.1.woody3 of mips images and version\n2.4.19-4.woody1 of kernel source.
\nFor the unstable distribution (sid) this problem will be fixed soon\nwith the next upload of a 2.4.19 kernel image and in version\n2.4.22-0.030928.3 for 2.4.22.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered a number of buffer overflow vulnerabilities in\nxboing, a game, which could be exploited by a local attacker to gain\ngid \"games\".
\nFor the current stable distribution (woody) these problems have been\nfixed in version 2.4-26woody1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.4-26.1.
\nWe recommend that you update your xboing package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe Apache Software Foundation announced that some versions of\nmod_python contain a bug which, when processing a request with a\nmalformed query string, could cause the corresponding Apache child to\ncrash. This bug could be exploited by a remote attacker to cause a\ndenial of service.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2:2.7.8-0.0woody2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2:2.7.10-1.
\nWe recommend that you update your libapache-mod-python package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a critical\nsecurity vulnerability in the memory management code of Linux inside\nthe mremap(2) system call. Due to flushing the TLB (Translation\nLookaside Buffer, an address cache) too early it is possible for an\nattacker to trigger a local root exploit.
\nThe attack vectors for 2.4.x and 2.2.x kernels are exclusive for the\nrespective kernel series, though. We formerly believed that the\nexploitable vulnerability in 2.4.x does not exist in 2.2.x which is\nstill true. However, it turned out that a second (sort of)\nvulnerability is indeed exploitable in 2.2.x, but not in 2.4.x, with a\ndifferent exploit, of course.
\nFor the stable distribution (woody) this problem has been fixed in\nthe following versions and architectures:
\n| package | \narch | \nversion | \n
|---|---|---|
| kernel-source-2.2.20 | \nsource | \n2.2.20-5woody3 | \n
| kernel-image-2.2.20-i386 | \ni386 | \n2.2.20-5woody5 | \n
| kernel-image-2.2.20-reiserfs-i386 | \ni386 | \n2.2.20-4woody1 | \n
| kernel-image-2.2.20-amiga | \nm68k | \n2.20-4 | \n
| kernel-image-2.2.20-atari | \nm68k | \n2.2.20-3 | \n
| kernel-image-2.2.20-bvme6000 | \nm68k | \n2.2.20-3 | \n
| kernel-image-2.2.20-mac | \nm68k | \n2.2.20-3 | \n
| kernel-image-2.2.20-mvme147 | \nm68k | \n2.2.20-3 | \n
| kernel-image-2.2.20-mvme16x | \nm68k | \n2.2.20-3 | \n
| kernel-patch-2.2.20-powerpc | \npowerpc | \n2.2.20-3woody1 | \n
For the unstable distribution (sid) this problem will be fixed soon\nfor the architectures that still ship a 2.2.x kernel package.
\nWe recommend that you upgrade your Linux kernel package.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a critical\nsecurity vulnerability in the memory management code of Linux inside\nthe mremap(2) system call. Due to flushing the TLB (Translation\nLookaside Buffer, an address cache) too early it is possible for an\nattacker to trigger a local root exploit.
\nThe attack vectors for 2.4.x and 2.2.x kernels are exclusive for the\nrespective kernel series, though. We formerly believed that the\nexploitable vulnerability in 2.4.x does not exist in 2.2.x which is\nstill true. However, it turned out that a second (sort of)\nvulnerability is indeed exploitable in 2.2.x, but not in 2.4.x, with a\ndifferent exploit, of course.
\nFor the stable distribution (woody) this problem has been fixed in\nthe following versions and architectures:
\n| package | \narch | \nversion | \n
|---|---|---|
| kernel-source-2.2.22 | \nsource | \n2.2.22-1woody1 | \n
| kernel-image-2.2.22-alpha | \nalpha | \n2.2.22-2 | \n
For the unstable distribution (sid) this problem will be fixed soon\nfor the architectures that still ship a 2.2.x kernel package.
\nWe recommend that you upgrade your Linux kernel package.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nlibxml2 is a library for manipulating XML files.
\nYuuichi Teranishi (\u5bfa\u897f \u88d5\u4e00)\ndiscovered a flaw in libxml, the GNOME XML library.\nWhen fetching a remote resource via FTP or HTTP, the library uses\nspecial parsing routines which can overflow a buffer if passed a very\nlong URL. If an attacker is able to find an application using libxml1\nor libxml2 that parses remote resources and allows the attacker to\ncraft the URL, then this flaw could be used to execute arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.8.17-2woody1 of libxml and version 2.4.19-4woody1 of libxml2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.8.17-5 of libxml and version 2.6.6-1 of libxml2.
\nWe recommend that you upgrade your libxml1 and libxml2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a critical\nsecurity vulnerability in the memory management code of Linux inside\nthe mremap(2) system call. Due to flushing the TLB (Translation\nLookaside Buffer, an address cache) too early it is possible for an\nattacker to trigger a local root exploit.
\nThe attack vectors for 2.4.x and 2.2.x kernels are exclusive for the\nrespective kernel series, though. We formerly believed that the\nexploitable vulnerability in 2.4.x does not exist in 2.2.x which is\nstill true. However, it turned out that a second (sort of)\nvulnerability is indeed exploitable in 2.2.x, but not in 2.4.x, with a\ndifferent exploit, of course.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 20040303 of 2.2 kernel images for the arm architecture.
\nFor the unstable distribution (sid) this problem will be fixed soon\nfor the architectures that still ship a 2.2.x kernel package.
\nWe recommend that you upgrade your Linux kernel package.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities were discovered in wu-ftpd:
\nGlenn Stewart discovered that users could bypass the\n directory access restrictions imposed by the restricted-gid option by\n changing the permissions on their home directory. On a subsequent\n login, when access to the user's home directory was denied, wu-ftpd\n would fall back to the root directory.
\nA buffer overflow existed in wu-ftpd's code which\n deals with S/key authentication.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.6.2-3woody4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.6.2-17.1.
\nWe recommend that you update your wu-ftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis security advisory corrects DSA 458-2 which caused a problem in\nthe gethostbyaddr routine.
\nThe original advisory said:
\n\n\nSebastian Schmidt discovered a buffer overflow bug in Python's\ngetaddrinfo function, which could allow an IPv6 address, supplied by a\nremote attacker via DNS, to overwrite memory on the stack.
\nThis bug only exists in python 2.2 and 2.2.1, and only when IPv6\nsupport is disabled. The python2.2 package in Debian woody meets\nthese conditions (the 'python' package does not).
\n
For the stable distribution (woody), this bug has been fixed in\nversion 2.2.1-4.6.
\nThe testing and unstable distribution (sarge and sid) are not\naffected by this problem.
\nWe recommend that you update your python2.2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nA vulnerability was discovered in KDE where the path restrictions on\ncookies could be bypassed using encoded relative path components\n(e.g., \"/../\"). This means that a cookie which should only be sent by\nthe browser to an application running at /app1, the browser could\ninadvertently include it with a request sent to /app2 on the same\nserver.
\nFor the current stable distribution (woody) this problem has been\nfixed in kdelibs version 4:2.2.2-6woody3 and kdelibs-crypto version\n4:2.2.2-13.woody.9.
\nFor the unstable distribution (sid) this problem was fixed in kdelibs\nversion 4:3.1.3-1.
\nWe recommend that you update your kdelibs and kdelibs-crypto packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlan Cox discovered that the isag utility (which graphically displays\ndata collected by the sysstat tools), creates a temporary file without\ntaking proper precautions. This vulnerability could allow a local\nattacker to overwrite files with the privileges of the user invoking\nisag.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 5.0.1-1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you update your sysstat package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nLeon Juranic discovered a buffer overflow related to the\ngetpass(3) library function in\ncalife, a program which provides super user privileges to specific\nusers. A local attacker could potentially\nexploit this vulnerability, given knowledge of a local user's password\nand the presence of at least one entry in /etc/calife.auth, to execute\narbitrary code with root privileges.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.8.4c-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.8.6-1.
\nWe recommend that you update your calife package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit Project discovered a problem in\nxitalk, a talk intercept utility for the X Window System. A local\nuser can exploit this problem and execute arbitrary commands under the\nGID utmp. This could be used by an attacker to remove traces from the\nutmp file.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.11-9.1woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your xitalk package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSamba, a LanManager-like file and printer server for Unix, was found\nto contain a vulnerability whereby a local user could use the \"smbmnt\"\nutility, which is setuid root, to mount a file share from a remote\nserver which contained setuid programs under the control of the user.\nThese programs could then be executed to gain privileges on the local\nsystem.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.2.3a-13.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.0.2-2.
\nWe recommend that you update your samba package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThomas Kristensen discovered a vulnerability in gdk-pixbuf (binary\npackage libgdk-pixbuf2), the GdkPixBuf image library for Gtk, that can\ncause the surrounding application to crash. To exploit this problem,\na remote attacker could send a carefully-crafted BMP file via mail,\nwhich would cause e.g. Evolution to crash but is probably not limited\nto Evolution.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.17.0-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.22.0-3.
\nWe recommend that you upgrade your libgdk-pixbuf2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities were discovered in openssl, an implementation of\nthe SSL protocol, using the Codenomicon TLS Test Tool. More\ninformation can be found in the following NISCC\nVulnerability Advisory and this OpenSSL\nadvisory. The Common Vulnerabilities and Exposures project\nidentified the following vulnerabilities:
\nNull-pointer assignment in the\n do_change_cipher_spec() function. A remote attacker could perform\n a carefully crafted SSL/TLS handshake against a server that used\n the OpenSSL library in such a way as to cause OpenSSL to crash.\n Depending on the application this could lead to a denial of\n service.
\nA bug in older versions of OpenSSL 0.9.6 that\n can lead to a Denial of Service attack (infinite loop).
\nFor the stable distribution (woody) these problems have been fixed in\nopenssl version 0.9.6c-2.woody.6, openssl094 version 0.9.4-6.woody.4\nand openssl095 version 0.9.5a-6.woody.5.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you update your openssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz and Wojciech Purczynski of isec.pl\ndiscovered a critical\nsecurity vulnerability in the memory management code of Linux inside\nthe mremap(2) system call. Due to flushing the TLB (Translation\nLookaside Buffer, an address cache) too early it is possible for an\nattacker to trigger a local root exploit.
\nThe attack vectors for 2.4.x and 2.2.x kernels are exclusive for the\nrespective kernel series, though. We formerly believed that the\nexploitable vulnerability in 2.4.x does not exist in 2.2.x which is\nstill true. However, it turned out that a second (sort of)\nvulnerability is indeed exploitable in 2.2.x, but not in 2.4.x, with a\ndifferent exploit, of course.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.10-13woody1 of 2.2 kernel images for the powerpc/apus\narchitecture and in version 2.2.10-2 of Linux 2.2.10 source.
\nFor the unstable distribution (sid) this problem will be fixed soon\nwith the 2.4.20 kernel-image package for powerpc/apus. The old 2.2.10\nkernel image will be removed from Debian unstable.
\nYou are strongly advised to switch to the fixed 2.4.17 kernel-image\npackage for powerpc/apus from woody until the 2.4.20 kernel-image\npackage is fixed in the unstable distribution.
\nWe recommend that you upgrade your Linux kernel package.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTimo Sirainen discovered two vulnerabilities in ecartis, a mailing\nlist manager.
\nFailure to validate user input could lead to\n disclosure of mailing list passwords
\nMultiple buffer overflows
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.129a+1.0.0-snap20020514-1.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.0+cvs.20030911.
\nWe recommend that you update your ecartis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered a number of vulnerabilities in emil, a\nfilter for converting Internet mail messages. The vulnerabilities\nfall into two categories:
\nBuffer overflows in (1) the encode_mime function,\n (2) the encode_uuencode function, (3) the decode_uuencode\n function. These bugs could allow a carefully crafted email message\n to cause the execution of arbitrary code supplied with the message\n when it is acted upon by emil.
\nFormat string bugs in statements which print\n various error messages. The exploit potential of these bugs has\n not been established, and is probably configuration-dependent.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.1.0-beta9-11woody1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you update your emil package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPrimoz Bratanic discovered a bug in libpam-pgsql, a PAM module to\nauthenticate using a PostgreSQL database. The library does not escape\nall user-supplied data that are sent to the database. An attacker\ncould exploit this bug to insert SQL statements.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.5.2-3woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.5.2-7.1.
\nWe recommend that you upgrade your libpam-pgsql package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local root exploits have been discovered recently in the Linux\nkernel. This security advisory updates the hppa kernel 2.4.17 for\nDebian GNU/Linux. The Common Vulnerabilities and Exposures project\nidentifies the following problems that are fixed with this update:
\nAn integer overflow in brk() system call (do_brk() function) for\n Linux allows a local attacker to gain root privileges. Fixed\n upstream in Linux 2.4.23.
\nPaul Starzetz discovered a flaw in bounds checking in mremap() in\n the Linux kernel (present in version 2.4.x and 2.6.x) which may\n allow a local attacker to gain root privileges. Version 2.2 is not\n affected by this bug. Fixed upstream in Linux 2.4.24.
\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a\n critical security vulnerability in the memory management code of\n Linux inside the mremap(2) system call. Due to missing function\n return value check of internal functions a local attacker can gain\n root privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 32.3 of kernel-image-2.4.17-hppa.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.4.25-1 of kernel-image-2.4.25-hppa.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nVulnerability matrix for CAN-2004-0077
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered recently in Interchange, an e-commerce\nand general HTTP database display system. This vulnerability can be\nexploited by an attacker to expose the content of arbitrary variables.\nAn attacker may learn SQL access information for your Interchange\napplication and use this information to read and manipulate sensitive\ndata.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.8.3.20020306-1.woody.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.0.1-1.
\nWe recommend that you upgrade your interchange package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp and Jaguar discovered a number of buffer overflow\nvulnerabilities in vfte, a version of the fte editor which runs on the\nLinux console, found in the package fte-console. This program is\nsetuid root in order to perform certain types of low-level operations\non the console.
\nDue to these bugs, setuid privilege has been removed from vfte, making\nit only usable by root. We recommend using the terminal version (in\nthe fte-terminal package) instead, which runs on any capable terminal\nincluding the Linux console.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.49.13-15woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.50.0-1.1.
\nWe recommend that you update your fte package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in oftpd, an anonymous FTP server,\nwhereby a remote attacker could cause the oftpd process to crash by\nspecifying a large value in a PORT command.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.3.6-6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 20040304-1.
\nWe recommend that you update your oftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in squid, an Internet object cache,\nwhereby access control lists based on URLs could be bypassed\n(CAN-2004-0189). Two other bugs were also fixed with patches\nsquid-2.4.STABLE7-url_escape.patch (a buffer overrun which does not\nappear to be exploitable) and squid-2.4.STABLE7-url_port.patch (a\npotential denial of service).
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.6-2woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.5.5-1.
\nWe recommend that you update your squid package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local root exploits have been discovered recently in the Linux\nkernel. This security advisory updates the PA-RISC kernel 2.4.18 for\nDebian GNU/Linux. The Common Vulnerabilities and Exposures project\nidentifies the following problems that are fixed with this update:
\nAn integer overflow in brk() system call (do_brk() function) for\n Linux allows a local attacker to gain root privileges. Fixed\n upstream in Linux 2.4.23.
\nPaul Starzetz discovered a flaw in bounds checking in mremap() in\n the Linux kernel (present in version 2.4.x and 2.6.x) which may\n allow a local attacker to gain root privileges. Version 2.2 is not\n affected by this bug. Fixed upstream in Linux 2.4.24.
\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a\n critical security vulnerability in the memory management code of\n Linux inside the mremap(2) system call. Due to missing function\n return value check of internal functions a local attacker can gain\n root privileges. Fixed upstream in Linux 2.4.25 and 2.6.3.
\nPlease note that the source package has to include a lot of updates in\norder to compile the package, which wasn't possible with the old\nsource package.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 62.1 of kernel-image-2.4.18-hppa.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.4.25-1 of kernel-image-2.4.25-hppa.
\nWe recommend that you upgrade your Linux kernel packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAccording to a security advisory from the heimdal project,\nheimdal, a suite of software implementing the Kerberos protocol, has\n\"a cross-realm vulnerability allowing someone with control over a\nrealm to impersonate anyone in the cross-realm trust path.\"
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.4e-7.woody.8.1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.6.1-1.
\nWe recommend that you update your heimdal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nShaun Colley discovered a problem in xine-ui, the xine video player\nuser interface. A script contained in the package to possibly remedy\na problem or report a bug does not create temporary files in a secure\nfashion. This could allow a local attacker to overwrite files with\nthe privileges of the user invoking xine.
\nThis update also removes the bug reporting facility since bug reports\ncan't be processed upstream anymore.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.8-5.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your xine-ui package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\ntcpdump, a tool for network monitoring and data acquisition, was found\nto contain two vulnerabilities whereby tcpdump could be caused to\ncrash through attempts to read from invalid memory locations. This\nbug is triggered by certain invalid ISAKMP packets.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 3.6.2-2.8.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.7.2-4.
\nWe recommend that you update your tcpdump package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral serious problems have been discovered in the Linux kernel.\nThis update takes care of Linux 2.4.18 for the alpha, i386 and powerpc\narchitectures. The Common Vulnerabilities and Exposures project\nidentifies the following problems that will be fixed with this update:
\nA vulnerability has been discovered in the R128 DRI driver in the Linux\n kernel which could potentially lead an attacker to gain\n unauthorised privileges. Alan Cox and Thomas Biege developed a\n correction for this.
\nArjan van de Ven discovered a stack-based buffer overflow in the\n ncp_lookup function for ncpfs in the Linux kernel, which could\n lead an attacker to gain unauthorised privileges. Petr Vandrovec\n developed a correction for this.
\nzen-parse discovered a buffer overflow vulnerability in the\n ISO9660 filesystem component of Linux kernel which could be abused\n by an attacker to gain unauthorised root access. Sebastian\n Krahmer and Ernie Petrides developed a correction for this.
\nSolar Designer discovered an information leak in the ext3 code of\n Linux. In a worst case an attacker could read sensitive data such\n as cryptographic keys which would otherwise never hit disk media.\n Theodore Ts'o developed a correction for this.
\nAndreas Kies discovered a denial of service condition in the Sound\n Blaster driver in Linux. He also developed a correction for this.
\nThese problems are also fixed by upstream in Linux 2.4.26 and will be\nfixed in Linux 2.6.6.
\nThe following security matrix explains which kernel versions for which\narchitectures are already fixed. Kernel images in the unstable Debian\ndistribution (sid) will be fixed soon.
\n| Architecture | \nstable (woody) | \nunstable (sid) | \nremoved in sid | \n
|---|---|---|---|
| source | \n2.4.18-14.3 | \n2.4.25-3 | \n\u2014 | \n
| alpha | \n2.4.18-15 | \nsoon | \n\u2014 | \n
| i386 | \n2.4.18-13 | \nsoon | \n\u2014 | \n
| i386bf | \n2.4.18-5woody8 | \nsoon | \n\u2014 | \n
| powerpc | \n2.4.18-1woody5 | \n2.4.25-8 | \n2.4.22 | \n
We recommend that you upgrade your kernel packages immediately, either\nwith a Debian provided kernel or with a self compiled one.
\nVulnerability matrix for CAN-2004-0109
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral serious problems have been discovered in the Linux kernel.\nThis update takes care of Linux 2.4.17 and 2.4.18 for the hppa\n(PA-RISC) architecture. The Common Vulnerabilities and Exposures\nproject identifies the following problems that will be fixed with this\nupdate:
\nA vulnerability has been discovered in the R128 DRI driver in the Linux\n kernel which could potentially lead an attacker to gain\n unauthorised privileges. Alan Cox and Thomas Biege developed a\n correction for this.
\nArjan van de Ven discovered a stack-based buffer overflow in the\n ncp_lookup function for ncpfs in the Linux kernel, which could\n lead an attacker to gain unauthorised privileges. Petr Vandrovec\n developed a correction for this.
\nzen-parse discovered a buffer overflow vulnerability in the\n ISO9660 filesystem component of Linux kernel which could be abused\n by an attacker to gain unauthorised root access. Sebastian\n Krahmer and Ernie Petrides developed a correction for this.
\nSolar Designer discovered an information leak in the ext3 code of\n Linux. In a worst case an attacker could read sensitive data such\n as cryptographic keys which would otherwise never hit disk media.\n Theodore Ts'o developed a correction for this.
\nAndreas Kies discovered a denial of service condition in the Sound\n Blaster driver in Linux. He also developed a correction for this.
\nThese problems are also fixed by upstream in Linux 2.4.26 and will be\nfixed in Linux 2.6.6.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 32.4 for Linux 2.4.17 and in version 62.3 for Linux 2.4.18.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your kernel packages immediately, either\nwith a Debian provided kernel or with a self compiled one.
\nVulnerability matrix for CAN-2004-0109
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral serious problems have been discovered in the Linux kernel.\nThis update takes care of Linux 2.4.17 for the IA-64 architecture.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems that will be fixed with this update:
\nA vulnerability has been discovered in the R128 DRI driver in the Linux\n kernel which could potentially lead an attacker to gain\n unauthorised privileges. Alan Cox and Thomas Biege developed a\n correction for this.
\nArjan van de Ven discovered a stack-based buffer overflow in the\n ncp_lookup function for ncpfs in the Linux kernel, which could\n lead an attacker to gain unauthorised privileges. Petr Vandrovec\n developed a correction for this.
\nzen-parse discovered a buffer overflow vulnerability in the\n ISO9660 filesystem component of Linux kernel which could be abused\n by an attacker to gain unauthorised root access. Sebastian\n Krahmer and Ernie Petrides developed a correction for this.
\nSolar Designer discovered an information leak in the ext3 code of\n Linux. In a worst case an attacker could read sensitive data such\n as cryptographic keys which would otherwise never hit disk media.\n Theodore Ts'o developed a correction for this.
\nAndreas Kies discovered a denial of service condition in the Sound\n Blaster driver in Linux. He also developed a correction for this.
\nThese problems are also fixed by upstream in Linux 2.4.26 and will be\nfixed in Linux 2.6.6.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 011226.17 for Linux 2.4.17.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.4.25-5 for Linux 2.4.25 and in version 2.6.5-1 for Linux\n2.6.5.
\nWe recommend that you upgrade your kernel packages immediately, either\nwith a Debian provided kernel or with a self compiled one.
\nVulnerability matrix for CAN-2004-0109
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral serious problems have been discovered in the Linux kernel.\nThis update takes care of Linux 2.4.17 for the PowerPC/apus and S/390\narchitectures. The Common Vulnerabilities and Exposures project\nidentifies the following problems that will be fixed with this update:
\nA vulnerability has been discovered in the R128 DRI driver in the Linux\n kernel which could potentially lead an attacker to gain\n unauthorised privileges. Alan Cox and Thomas Biege developed a\n correction for this.
\nArjan van de Ven discovered a stack-based buffer overflow in the\n ncp_lookup function for ncpfs in the Linux kernel, which could\n lead an attacker to gain unauthorised privileges. Petr Vandrovec\n developed a correction for this.
\nzen-parse discovered a buffer overflow vulnerability in the\n ISO9660 filesystem component of Linux kernel which could be abused\n by an attacker to gain unauthorised root access. Sebastian\n Krahmer and Ernie Petrides developed a correction for this.
\nSolar Designer discovered an information leak in the ext3 code of\n Linux. In a worst case an attacker could read sensitive data such\n as cryptographic keys which would otherwise never hit disk media.\n Theodore Ts'o developed a correction for this.
\nAndreas Kies discovered a denial of service condition in the Sound\n Blaster driver in Linux. He also developed a correction for this.
\nThese problems are also fixed by upstream in Linux 2.4.26 and will be\nfixed in Linux 2.6.6.
\nThe following security matrix explains which kernel versions for which\narchitectures are already fixed.
\n| Architecture | \nstable (woody) | \nunstable (sid) | \n
|---|---|---|
| source | \n2.4.17-1woody3 | \n2.4.25-3 | \n
| powerpc/apus | \n2.4.17-5 | \n2.4.25-2 | \n
| s390 | \n2.4.17-2.woody.4 | \n2.4.25-2 (and probably 2.4.21-3) | \n
We recommend that you upgrade your kernel packages immediately, either\nwith a Debian provided kernel or with a self compiled one.
\nVulnerability matrix for CAN-2004-0109
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in mysql, a common database\nsystem. Two scripts contained in the package don't create temporary\nfiles in a secure fashion. This could allow a local attacker to\noverwrite files with the privileges of the user invoking the MySQL\nserver, which is often the root user. The Common Vulnerabilities and\nExposures identifies the following problems:
\nThe script mysqlbug in MySQL allows local users to overwrite\n arbitrary files via a symlink attack.
\nThe script mysqld_multi in MySQL allows local users to overwrite\n arbitrary files via a symlink attack.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.23.49-8.6.
\nFor the unstable distribution (sid) these problems will be fixed in\nversion 4.0.18-6 of mysql-dfsg.
\nWe recommend that you upgrade your mysql, mysql-dfsg and related\npackages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered a vulnerability in xonix, a game, where an\nexternal program was invoked while retaining setgid privileges. A\nlocal attacker could exploit this vulnerability to gain gid \"games\".
\nFor the current stable distribution (woody) this problem will be fixed\nin version 1.4-19woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your xonix package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered two format string vulnerabilities in ssmtp, a\nsimple mail transport agent. Untrusted values in the functions die()\nand log_event() were passed to printf-like functions as format\nstrings. These vulnerabilities could potentially be exploited by a\nremote mail relay to gain the privileges of the ssmtp process\n(including potentially root).
\nFor the current stable distribution (woody) this problem will be fixed\nin version 2.50.6.1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your ssmtp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered and fixed in CVS:
\nSebastian Krahmer discovered a vulnerability whereby\n a malicious CVS pserver could create arbitrary files on the client\n system during an update or checkout operation, by supplying absolute\n pathnames in RCS diffs.
\nDerek Robert Price discovered a vulnerability whereby\n a CVS pserver could be abused by a malicious client to view the\n contents of certain files outside of the CVS root directory using\n relative pathnames containing \"../\".
\nFor the current stable distribution (woody) these problems have been\nfixed in version 1.11.1p1debian-9woody2.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you update your cvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple format string vulnerabilities were discovered in neon, an\nHTTP and WebDAV client library. These vulnerabilities could\npotentially be exploited by a malicious WebDAV server to execute\narbitrary code with the privileges of the process using libneon.
\nFor the current stable distribution (woody) these problems have been\nfixed in version 0.19.3-2woody3.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.24.5-1.
\nWe recommend that you update your neon package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChristian Jaeger reported a bug in logcheck which could potentially be\nexploited by a local user to overwrite files with root privileges.\nlogcheck utilized a temporary directory under /var/tmp without taking\nsecurity precautions. While this directory is created when logcheck\nis installed, and while it exists there is no vulnerability, if at\nany time this directory is removed, the potential for exploitation exists.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.1.1-13.1woody1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.1-13.2.
\nWe recommend that you update your logcheck package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral serious problems have been discovered in the Linux kernel.\nThis update takes care of Linux 2.4.17 for the MIPS and MIPSel\narchitectures. The Common Vulnerabilities and Exposures project\nidentifies the following problems that will be fixed with this update:
\nA vulnerability has been discovered in the R128 DRI driver in the Linux\n kernel which could potentially lead an attacker to gain\n unauthorised privileges. Alan Cox and Thomas Biege developed a\n correction for this.
\nArjan van de Ven discovered a stack-based buffer overflow in the\n ncp_lookup function for ncpfs in the Linux kernel, which could\n lead an attacker to gain unauthorised privileges. Petr Vandrovec\n developed a correction for this.
\nzen-parse discovered a buffer overflow vulnerability in the\n ISO9660 filesystem component of Linux kernel which could be abused\n by an attacker to gain unauthorised root access. Sebastian\n Krahmer and Ernie Petrides developed a correction for this.
\nSolar Designer discovered an information leak in the ext3 code of\n Linux. In a worst case an attacker could read sensitive data such\n as cryptographic keys which would otherwise never hit disk media.\n Theodore Ts'o developed a correction for this.
\nAndreas Kies discovered a denial of service condition in the Sound\n Blaster driver in Linux. He also developed a correction for this.
\nThese problems are also fixed by upstream in Linux 2.4.26 and will be\nfixed in Linux 2.6.6.
\nThe following security matrix explains which kernel versions for which\narchitectures are already fixed and which will be removed instead.
\n| Architecture | \nstable (woody) | \nunstable (sid) | \nremoved in sid | \n
|---|---|---|---|
| source | \n2.4.17-1woody3 | \n2.4.25-3 | \n2.4.19-11 | \n
| mips | \n2.4.17-0.020226.2.woody6 | \n2.4.25-0.040415.1 | \n2.4.19-0.020911.8 | \n
| mipsel | \n2.4.17-0.020226.2.woody6 | \n2.4.25-0.040415.1 | \n2.4.19-0.020911.9 | \n
We recommend that you upgrade your kernel packages immediately, either\nwith a Debian provided kernel or with a self compiled one.
\nVulnerability matrix for CAN-2004-0109
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in the index support of the\nZCatalog plug-in in Zope, an open source web application server. A\nflaw in the security settings of ZCatalog allows anonymous users to\ncall arbitrary methods of catalog indexes. The vulnerability also\nallows untrusted code to do the same.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.5.1-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.6.0-0.1 and higher.
\nWe recommend that you upgrade your zope package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral serious problems have been discovered in the Linux kernel.\nThis update takes care of Linux 2.4.19 for the MIPS architecture. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems that will be fixed with this update:
\nA vulnerability has been discovered in the R128 DRI driver in the Linux\n kernel which could potentially lead an attacker to gain\n unauthorised privileges. Alan Cox and Thomas Biege developed a\n correction for this.
\nArjan van de Ven discovered a stack-based buffer overflow in the\n ncp_lookup function for ncpfs in the Linux kernel, which could\n lead an attacker to gain unauthorised privileges. Petr Vandrovec\n developed a correction for this.
\nzen-parse discovered a buffer overflow vulnerability in the\n ISO9660 filesystem component of Linux kernel which could be abused\n by an attacker to gain unauthorised root access. Sebastian\n Krahmer and Ernie Petrides developed a correction for this.
\nSolar Designer discovered an information leak in the ext3 code of\n Linux. In a worst case an attacker could read sensitive data such\n as cryptographic keys which would otherwise never hit disk media.\n Theodore Ts'o developed a correction for this.
\nAndreas Kies discovered a denial of service condition in the Sound\n Blaster driver in Linux. He also developed a correction for this.
\nThese problems are also fixed by upstream in Linux 2.4.26 and will be\nfixed in Linux 2.6.6.
\nThe following security matrix explains which kernel versions for which\narchitectures are already fixed and which will be removed instead.
\n| Architecture | \nstable (woody) | \nunstable (sid) | \nremoved in sid | \n
|---|---|---|---|
| source | \n2.4.19-4.woody2 | \n2.4.25-3 | \n2.4.19-11 | \n
| mips | \n2.4.19-0.020911.1.woody4 | \n2.4.25-0.040415.1 | \n2.4.19-0.020911.8 | \n
We recommend that you upgrade your kernel packages immediately, either\nwith a Debian provided kernel or with a self compiled one.
\nVulnerability matrix for CAN-2004-0109
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHerbert Xu reported that local users could cause a denial of service\nagainst iproute, a set of tools for controlling networking in Linux\nkernels. iproute uses the netlink interface to communicate with the\nkernel, but failed to verify that the messages it received came from\nthe kernel (rather than from other user processes).
\nFor the current stable distribution (woody) this problem has been\nfixed in version 20010824-8woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your iproute package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the Socks-5 proxy code of\nXChat, an IRC client for X similar to AmIRC. This allows an attacker\nto execute arbitrary code on the users' machine.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.8.9-0woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.8-1.
\nWe recommend that you upgrade your xchat and related packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJack <jack@rapturesecurity.org> discovered a buffer overflow in\nident2, an implementation of the ident protocol (RFC1413), where a\nbuffer in the child_service function was slightly too small to hold\nall of the data which could be written into it. This vulnerability\ncould be exploited by a remote attacker to execute arbitrary code with\nthe privileges of the ident2 daemon (by default, the \"identd\" user).
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.03-3woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your ident2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral serious problems have been discovered in the Linux kernel.\nThis update takes care of Linux 2.4.16 for the ARM architecture. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems that will be fixed with this update:
\nThe kernel module loader allows local users to gain root\n privileges by using ptrace to attach to a child process that is\n spawned by the kernel.
\nA vulnerability has been discovered in the R128 DRI driver in the Linux\n kernel which could potentially lead an attacker to gain\n unauthorised privileges. Alan Cox and Thomas Biege developed a\n correction for this.
\nArjan van de Ven discovered a stack-based buffer overflow in the\n ncp_lookup function for ncpfs in the Linux kernel, which could\n lead an attacker to gain unauthorised privileges. Petr Vandrovec\n developed a correction for this.
\nzen-parse discovered a buffer overflow vulnerability in the\n ISO9660 filesystem component of Linux kernel which could be abused\n by an attacker to gain unauthorised root access. Sebastian\n Krahmer and Ernie Petrides developed a correction for this.
\nSolar Designer discovered an information leak in the ext3 code of\n Linux. In a worst case a local attacker could obtain sensitive\n information (such as cryptographic keys in another worst case)\n which would otherwise never hit disk media. Theodore Ts'o\n developed a correction for this.
\nAndreas Kies discovered a denial of service condition in the Sound\n Blaster driver in Linux. He also developed a correction for this.
\nThese problems are also fixed by upstream in Linux 2.4.26 and will be\nfixed in Linux 2.6.6.
\nThe following security matrix explains which kernel versions for which\narchitectures are already fixed and which will be removed instead.
\n| Architecture | \nstable (woody) | \nunstable (sid) | \n
|---|---|---|
| source | \n2.4.16-1woody2 | \n2.4.25-3 | \n
| arm/patch | \n20040419 | \n20040316 | \n
| arm/lart | \n20040419 | \n2.4.25-4 | \n
| arm/netwinder | \n20040419 | \n2.4.25-4 | \n
| arm/riscpc | \n20040419 | \n2.4.25-4 | \n
We recommend that you upgrade your kernel packages immediately, either\nwith a Debian provided kernel or with a self compiled one.
\nVulnerability matrix for CAN-2004-0109
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nH.D. Moore discovered several terminal emulator security issues. One\nof them covers escape codes that are interpreted by the terminal\nemulator. This could be exploited by an attacker to insert malicious\ncommands hidden for the user, who has to hit enter to continue, which\nwould also execute the hidden commands.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.2-0pre2002042903.3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.2-6.
\nWe recommend that you upgrade your eterm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJacub Jelinek discovered several vulnerabilities in the Midnight\nCommander, a powerful file manager for GNU/Linux systems. The\nproblems were classified as follows:
\nCAN-2004-0226 Buffer overflows\n
CAN-2004-0231 Insecure temporary file and directory creations\n
CAN-2004-0232 Format string problems
For the stable distribution (woody) this problem has been fixed in\nversion 4.5.55-1.2woody3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your mc packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Grubb discovered a problem in the Portable Network Graphics\nlibrary libpng which is utilised in several applications. When\nprocessing a broken PNG image, the error handling routine will access\nmemory that is out of bounds when creating an error message.\nDepending on machine architecture, bounds checking and other\nprotective measures, this problem could cause the program to crash if\na defective or intentionally prepared PNG image file is handled by\nlibpng.
\nThis could be used as a denial of service attack against various\nprograms that link against this library. The following commands will\nshow you which packages utilise this library and whose programs should\nprobably restarted after an upgrade:
\n\n apt-cache showpkg libpng2\n apt-cache showpkg libpng3\n\n
The following security matrix explains which package versions will\ncontain a correction.
\n| Package | \nstable (woody) | \nunstable (sid) | \n
|---|---|---|
| libpng | \n1.0.12-3.woody.5 | \n1.0.15-5 | \n
| libpng3 | \n1.2.1-1.1.woody.5 | \n1.2.5.0-6 | \n
We recommend that you upgrade your libpng and related packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in rsync, a file transfer program,\nwhereby a remote user could cause an rsync daemon to write files\noutside of the intended directory tree. This vulnerability is not\nexploitable when the daemon is configured with the 'chroot' option.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.5.5-0.5.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.6.1-1.
\nWe recommend that you update your rsync package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nTatsuya Kinoshita discovered a vulnerability in flim, an emacs library\nfor working with internet messages, where temporary files were created\nwithout taking appropriate precautions. This vulnerability could\npotentially be exploited by a local user to overwrite files with the\nprivileges of the user running emacs.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 1.14.3-9woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your flim package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGeorgi Guninski discovered two stack-based buffer overflows. They can\nnot be exploited with the default configuration from the Debian\nsystem, though. The Common Vulnerabilities and Exposures project\nidentifies the following problems that are fixed with this update:
\nWhen \"sender_verify = true\" is configured in exim.conf a buffer\n overflow can happen during verification of the sender. This\n problem is fixed in exim 4.
\nWhen headers_check_syntax is configured in exim.conf a buffer\n overflow can happen during the header check. This problem does\n also exist in exim 4.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.35-1woody3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.36-11 for exim 3 and in version 4.33-1 for exim 4.
\nWe recommend that you upgrade your exim package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGeorgi Guninski discovered two stack-based buffer overflows in exim\nand exim-tls. They cannot be exploited with the default\nconfiguration from the Debian system, though. The Common\nVulnerabilities and Exposures project identifies the following\nproblems that are fixed with this update:
\nWhen \"sender_verify = true\" is configured in exim.conf a buffer\n overflow can happen during verification of the sender. This\n problem is fixed in exim 4.\n
When headers_check_syntax is configured in exim.conf a buffer\n overflow can happen during the header check. This problem does\n also exist in exim 4.\n
For the stable distribution (woody) these problems have been fixed in\nversion 3.35-3woody2.
\nThe unstable distribution (sid) does not contain exim-tls anymore.\nThe functionality has been incorporated in the main exim versions\nwhich have these problems fixed in version 3.36-11 for exim 3 and in\nversion 4.33-1 for exim 4.
\nWe recommend that you upgrade your exim-tls package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in mah-jong, a variant of the original\nMah-Jong game, that can be utilised to crash the game server after\ndereferencing a NULL pointer. This bug be exploited by any client\nthat connects to the mah-jong server.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.4-3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.6.2-1.
\nWe recommend that you upgrade your mah-jong package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEvgeny Demidov discovered a potential buffer overflow in a Kerberos 4\ncomponent of heimdal, a free implementation of Kerberos 5. The\nproblem is present in kadmind, a server for administrative access to\nthe Kerberos database. This problem could perhaps be exploited to\ncause the daemon to read a negative amount of data which could lead to\nunexpected behaviour.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.4e-7.woody.9.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.6.2-1.
\nWe recommend that you upgrade your heimdal and related packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Esser discovered a heap overflow in the CVS server, which\nserves the popular Concurrent Versions System. Malformed \"Entry\"\nLines in combination with Is-modified and Unchanged can be used to\noverflow malloc()ed memory. This was proven to be exploitable.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.11.1p1debian-9woody4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.12.5-6.
\nWe recommend that you upgrade your cvs package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Esser discovered a problem in neon, an HTTP and WebDAV client\nlibrary. User input is copied into variables not large enough for all\ncases. This can lead to an overflow of a static heap variable.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.19.3-2woody5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.23.9.dfsg-2 and neon_0.24.6.dfsg-1.
\nWe recommend that you upgrade your libneon* packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Esser discovered a problem in neon, an HTTP and WebDAV client\nlibrary, which is also present in cadaver, a command-line client for\nWebDAV server. User input is copied into variables not large enough\nfor all cases. This can lead to an overflow of a static heap\nvariable.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.18.0-1woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.22.1-3.
\nWe recommend that you upgrade your cadaver package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJaguar discovered a vulnerability in one component of xpcd, a PhotoCD\nviewer. xpcd-svga, part of xpcd which uses svgalib to display\ngraphics on the console, would copy user-supplied data of arbitrary\nlength into a fixed-size buffer in the pcd_open function.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 2.08-8woody2.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your xpcd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered a vulnerability in xatitv, one of the programs\nin the gatos package, which is used to display video with certain\nATI video cards.
\nxatitv is installed setuid root in order to gain direct access to the\nvideo hardware. It normally drops root privileges after successfully\ninitializing itself. However, if initialization fails due to a\nmissing configuration file, root privileges are not dropped, and\nxatitv executes the system(3) function to launch its configuration\nprogram without sanitizing user-supplied environment variables.
\nBy exploiting this vulnerability, a local user could gain root\nprivileges if the configuration file does not exist. However, a\ndefault configuration file is supplied with the package, and so this\nvulnerability is not exploitable unless this file is removed by the\nadministrator.
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.0.5-6woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your gatos package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\njaguar@felinemenace.org discovered a vulnerability in jftpgw, an FTP\nproxy program, whereby a remote user could potentially cause arbitrary\ncode to be executed with the privileges of the jftpgw server process.\nBy default, the server runs as user \"nobody\".
\nCAN-2004-0448: format string vulnerability via syslog(3) in log()\nfunction
\nFor the current stable distribution (woody) this problem has been\nfixed in version 0.13.1-1woody1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.13.4-1.
\nWe recommend that you update your jftpgw package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral buffer overflow vulnerabilities were discovered in ethereal, a\nnetwork traffic analyzer. These vulnerabilities are described in the\nethereal advisory \"enpa-sa-00013\". Of these, only some parts of\nCAN-2004-0176 affect the version of ethereal in Debian woody.\nCAN-2004-0367 and CAN-2004-0365 are not applicable to this version.
\nFor the current stable distribution (woody), these problems have been\nfixed in version 0.9.4-1woody7.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.10.3-1.
\nWe recommend that you update your ethereal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in gallery, a web-based photo album\nwritten in php, whereby a remote attacker could gain access to the\ngallery \"admin\" user without proper authentication. No CVE candidate\nwas available for this vulnerability at the time of release.
\nFor the current stable distribution (woody), these problems have been\nfixed in version 1.2.5-8woody2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.4.3-pl2-1.
\nWe recommend that you update your gallery package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\njaguar@felinemenace.org discovered a format string vulnerability in\nlog2mail, whereby a user able to log a specially crafted message to a\nlogfile monitored by log2mail (for example, via syslog) could cause\narbitrary code to be executed with the privileges of the log2mail\nprocess. By default, this process runs as user 'log2mail', which is a\nmember of group 'adm' (which has access to read system logfiles).
\nCAN-2004-0450: log2mail format string vulnerability via syslog(3) in\nprintlog()
\nFor the current stable distribution (woody), this problem has been\nfixed in version 0.2.5.2.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your log2mail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Starzetz and Wojciech Purczynski of isec.pl discovered a critical\nsecurity vulnerability in the memory management code of Linux inside\nthe mremap(2) system call. Due to flushing the TLB (Translation\nLookaside Buffer, an address cache) too early it is possible for an\nattacker to trigger a local root exploit.
\nThe attack vectors for 2.4.x and 2.2.x kernels are exclusive for the\nrespective kernel series, though. We formerly believed that the\nexploitable vulnerability in 2.4.x does not exist in 2.2.x which is\nstill true. However, it turned out that a second (sort of)\nvulnerability is indeed exploitable in 2.2.x, but not in 2.4.x, with a\ndifferent exploit, of course.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 9woody1 of Linux 2.2 kernel images for the sparc architecture\nand in version 2.2.20-5woody3 of Linux 2.2.20 source.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 9.1 of Linux 2.2 kernel images for the sparc architecture.
\nThis problem has been fixed for other architectures already.
\nWe recommend that you upgrade your Linux kernel package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities were discovered in lha:
\nFor the current stable distribution (woody), these problems have been\nfixed in version 1.14i-2woody1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.14i-8.
\nWe recommend that you update your lha package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the ODBC driver of PostgreSQL,\nan object-relational SQL database, descended from POSTGRES. It is possible\nto exploit this problem and crash the surrounding application. Hence, a\nPHP script using php4-odbc can be utilised to crash the surrounding\nApache webserver. Other parts of postgresql are not affected.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 7.2.1-2woody5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 07.03.0200-3.
\nWe recommend that you upgrade your postgresql and related package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDerek Robert Price discovered a potential buffer overflow\nvulnerability in the CVS server, based on a malformed Entry, which\nserves the popular Concurrent Versions System.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.11.1p1debian-9woody6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.12.9-1.
\nWe recommend that you upgrade your cvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\niDEFENSE identified a vulnerability in the Opera web browser that\ncould be used by remote attackers to create or truncate arbitrary\nfiles on the victims machine. The KDE team discovered that a similar\nvulnerability exists in KDE.
\nA remote attacker could entice a user to open a carefully crafted\ntelnet URI which may either create or truncate a file in the victims\nhome directory. In KDE 3.2 and later versions the user is first\nexplicitly asked to confirm the opening of the telnet URI.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-13.woody.10.
\nWe recommend that you upgrade your KDE libraries.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSebastian Krahmer and Stefan Esser discovered several vulnerabilities\nin the CVS server, which serves the popular Concurrent Versions\nSystem. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.11.1p1debian-9woody7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.12.9-1.
\nWe recommend that you upgrade your cvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIn their advisory MITKRB5-SA-2004-001, the MIT Kerberos announced the\nexistence of buffer overflow vulnerabilities in the\nkrb5_aname_to_localname function. This function is only used if\naname_to_localname is enabled in the configuration (this is not\nenabled by default).
\nFor the current stable distribution (woody), this problem has been\nfixed in version 1.2.4-5woody5.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.3-2.
\nWe recommend that you update your krb5 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\njaguar@felinemenace.org discovered a format string vulnerability in\nsup, a set of programs to synchronize collections of files across a\nnumber of machines, whereby a remote attacker could potentially cause\narbitrary code to be executed with the privileges of the supfilesrv\nprocess (this process does not run automatically by default).
\nCAN-2004-0451: format string vulnerabilities in sup via syslog(3) in\nlogquit, logerr, loginfo functions
\nFor the current stable distribution (woody), this problem has been\nfixed in version 1.8-8woody2.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your sup package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered a format string vulnerability in super, a\nprogram to allow specified users to execute commands with root\nprivileges. This vulnerability could potentially be exploited by a\nlocal user to execute arbitrary code with root privileges.
\nFor the current stable distribution (woody), this problem has been\nfixed in version 3.16.1-1.2.
\nFor the unstable distribution (sid), this problem has been fixed\nin version 3.23.0-1.
\nWe recommend that you update your super package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered a buffer overflow vulnerability in www-sql,\na CGI program which enables the creation of dynamic web pages by\nembedding SQL statements in HTML. By exploiting this\nvulnerability, a local user could cause the execution of arbitrary\ncode by creating a web page and processing it with www-sql.
\nFor the current stable distribution (woody), this problem has been\nfixed in version 0.5.7-17woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your www-sql package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\njaguar@felinemenace.org discovered a format string vulnerability in\nrlpr, a utility for lpd printing without using /etc/printcap. While\ninvestigating this vulnerability, a buffer overflow was also\ndiscovered in related code. By exploiting one of these\nvulnerabilities, a local or remote user could potentially cause\narbitrary code to be executed with the privileges of 1) the rlprd\nprocess (remote), or 2) root (local).
\nCAN-2004-0393: format string vulnerability via syslog(3) in msg()\nfunction in rlpr
\nCAN-2004-0454: buffer overflow in msg() function in rlpr
\nFor the current stable distribution (woody), this problem has been\nfixed in version 2.02-7woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your rlpr package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGeorgi Guninski discovered a buffer overflow bug in Apache's mod_proxy\nmodule, whereby a remote user could potentially cause arbitrary code\nto be executed with the privileges of an Apache httpd child process\n(by default, user www-data). Note that this bug is only exploitable\nif the mod_proxy module is in use.
\nNote that this bug exists in a module in the apache-common package,\nshared by apache, apache-ssl and apache-perl, so this update is\nsufficient to correct the bug for all three builds of Apache httpd.\nHowever, on systems using apache-ssl or apache-perl, httpd will not\nautomatically be restarted.
\nFor the current stable distribution (woody), this problem has been\nfixed in version 1.3.26-0woody5.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.31-2.
\nWe recommend that you update your apache package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities were discovered in webmin:
\nCAN-2004-0582: Unknown vulnerability in Webmin 1.140 allows remote\n attackers to bypass access control rules and gain read access to\n configuration information for a module.
\nCAN-2004-0583: The account lockout functionality in (1) Webmin 1.140\n and (2) Usermin 1.070 does not parse certain character strings, which\n allows remote attackers to conduct a brute force attack to guess user\n IDs and passwords.
\nFor the current stable distribution (woody), these problems have been\nfixed in version 0.94-7woody2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.150-1.
\nWe recommend that you update your webmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered a vulnerability in pavuk, a file retrieval\nprogram, whereby an oversized HTTP 305 response sent by a malicious\nserver could cause arbitrary code to be executed with the privileges\nof the pavuk process.
\nFor the current stable distribution (woody), this problem has been\nfixed in version 0.9pl28-1woody1.
\npavuk is no longer included in the unstable distribution of Debian.
\nWe recommend that you update your pavuk package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral denial of service vulnerabilities were discovered in ethereal,\na network traffic analyzer. These vulnerabilities are described in the\nethereal advisory \"enpa-sa-00015\". Of these, only one (CAN-2004-0635)\naffects the version of ethereal in Debian woody. This vulnerability\ncould be exploited by a remote attacker to crash ethereal with an\ninvalid SNMP packet.
\nFor the current stable distribution (woody), these problems have been\nfixed in version 0.9.4-1woody8.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.10.5-1.
\nWe recommend that you update your ethereal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"b0f\" discovered a format string vulnerability in netkit-telnet-ssl\nwhich could potentially allow a remote attacker to cause the execution\nof arbitrary code with the privileges of the telnet daemon (the\n'telnetd' user by default).
\nFor the current stable distribution (woody), this problem has been\nfixed in version 0.17.17+0.1-2woody1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.17.24+0.1-2.
\nWe recommend that you update your netkit-telnet-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThomas Walpuski reported a buffer overflow in l2tpd, an implementation\nof the layer 2 tunneling protocol, whereby a remote attacker could\npotentially cause arbitrary code to be executed by transmitting a\nspecially crafted packet. The exploitability of this vulnerability\nhas not been verified.
\nFor the current stable distribution (woody), this problem has been\nfixed in version 0.67-1.2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.70-pre20031121-2.
\nWe recommend that you update your l2tpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities were discovered in php4:
\nThe memory_limit functionality in PHP 4.x up to\n 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as\n when register_globals is enabled, allows remote attackers to\n execute arbitrary code by triggering a memory_limit abort during\n execution of the zend_hash_init function and overwriting a\n HashTable destructor pointer before the initialization of key data\n structures is complete.
\nThe strip_tags function in PHP 4.x up to 4.3.7, and\n 5.x up to 5.0.0RC3, does not filter null (\\0) characters within tag\n names when restricting input to allowed tags, which allows\n dangerous tags to be processed by web browsers such as Internet\n Explorer and Safari, which ignore null characters and facilitate\n the exploitation of cross-site scripting (XSS) vulnerabilities.
\nFor the current stable distribution (woody), these problems have been\nfixed in version 4.1.2-7.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4:4.3.8-1.
\nWe recommend that you update your php4 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities were discovered in libapache-mod-ssl:
\nStack-based buffer overflow in the\n ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl,\n when mod_ssl is configured to trust the issuing CA, may allow remote\n attackers to execute arbitrary code via a client certificate with a\n long subject DN.
\nFormat string vulnerability in the ssl_log function\n in ssl_engine_log.c in mod_ssl 2.8.19 for Apache 1.3.31 may allow\n remote attackers to execute arbitrary messages via format string\n specifiers in certain log messages for HTTPS.
\nFor the current stable distribution (woody), these problems have been\nfixed in version 2.8.9-2.4.
\nFor the unstable distribution (sid), CAN-2004-0488 was fixed in\nversion 2.8.18, and CAN-2004-0700 will be fixed soon.
\nWe recommend that you update your libapache-mod-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nA cross-site scripting vulnerability was discovered in sqwebmail, a\nweb mail application provided by the courier mail suite, whereby an\nattacker could cause web script to be executed within the security\ncontext of the sqwebmail application by injecting it via an email\nmessage.
\nFor the current stable distribution (woody), this problem has been\nfixed in version 0.37.3-2.5.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.45.4-4.
\nWe recommend that you update your courier package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA directory traversal vulnerability was discovered in mailreader\nwhereby remote attackers could view arbitrary files with the\nprivileges of the nph-mr.cgi process (by default, www-data) via\nrelative paths and a null byte in the configLanguage parameter.
\nFor the current stable distribution (woody), this problem has been\nfixed in version 2.3.29-5woody1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you update your mailreader package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFour vulnerabilities were discovered in squirrelmail:
\nMultiple cross-site scripting (XSS) vulnerabilities\n in SquirrelMail 1.4.2 allow remote attackers to execute arbitrary\n script as other users and possibly steal authentication information\n via multiple attack vectors, including the mailbox parameter in\n compose.php.
\nCross-site scripting (XSS) vulnerability in mime.php\n for SquirrelMail before 1.4.3 allows remote attackers to insert\n arbitrary HTML and script via the content-type mail header, as\n demonstrated using read_body.php.
\nSQL injection vulnerability in SquirrelMail before\n 1.4.3 RC1 allows remote attackers to execute unauthorized SQL\n statements, with unknown impact, probably via abook_database.php.
\nMultiple cross-site scripting (XSS) vulnerabilities\n in Squirrelmail 1.2.10 and earlier allow remote attackers to inject\n arbitrary HTML or script via (1) the $mailer variable in\n read_body.php, (2) the $senderNames_part variable in\n mailbox_display.php, and possibly other vectors including (3) the\n $event_title variable or (4) the $event_text variable.
\nFor the current stable distribution (woody), these problems have been\nfixed in version 1:1.2.6-1.4.
\nFor the unstable distribution (sid), these problems have been fixed in\n2:1.4.3a-0.1 and earlier versions.
\nWe recommend that you update your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several vulnerabilities in libpng:
\nMultiple buffer overflows exist, including when\n handling transparency chunk data, which could be exploited to cause\n arbitrary code to be executed when a specially crafted PNG image is\n processed
\nMultiple NULL pointer dereferences in\n png_handle_iCPP() and elsewhere could be exploited to cause an\n application to crash when a specially crafted PNG image is processed
\nMultiple integer overflows in the png_handle_sPLT(),\n png_read_png() functions and elsewhere could be exploited to cause an\n application to crash, or potentially arbitrary code to be executed,\n when a specially crafted PNG image is processed
\nIn addition, a bug related to CAN-2002-1363 was fixed:
\nA buffer overflow could be caused by incorrect\n calculation of buffer offsets, possibly leading to the execution of\n arbitrary code
\nFor the current stable distribution (woody), these problems have been\nfixed in libpng3 version 1.2.1-1.1.woody.7 and libpng version\n1.0.12-3.woody.7.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you update your libpng and libpng3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndres Salomon noticed a problem in the CGI session management of\nRuby, an object-oriented scripting language. CGI::Session's FileStore\n(and presumably PStore, but not in Debian woody) implementations store\nsession information insecurely. They simply create files, ignoring\npermission issues. This can lead an attacker who has also shell\naccess to the webserver to take over a session.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.6.7-3woody3.
\nFor the unstable and testing distributions (sid and sarge) this\nproblem has been fixed in version 1.8.1+1.8.2pre1-4.
\nWe recommend that you upgrade your libruby package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe rsync developers have discovered a security related problem in\nrsync, a fast remote file copy program, which offers an attacker to\naccess files outside of the defined directory. To exploit this\npath-sanitizing bug, rsync has to run in daemon mode with the chroot\noption being disabled. It does not affect the normal send/receive\nfilenames that specify what files should be transferred. It does\naffect certain option paths that cause auxiliary files to be read or\nwritten.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.5.5-0.6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.6.2-3.
\nWe recommend that you upgrade your rsync package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe SUSE security team was alerted that in some cases the integrity of\nsymlinks used by KDE are not ensured and that these symlinks can be\npointing to stale locations. This can be abused by a local attacker\nto create or truncate arbitrary files or to prevent KDE applications\nfrom functioning correctly.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-13.woody.12.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.3.0-1.
\nWe recommend that you upgrade your kde packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJeroen van Wolffelaar discovered an insecure\ntemporary file vulnerability in the mysqlhotcopy script when using the\nscp method which is part of the mysql-server package.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.23.49-8.7 of mysql.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.20-11 of mysql-dfsg.
\nWe recommend that you upgrade your mysql-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarkus W\u00f6rle discovered a cross site scripting problem in\nstatus-display (list.cgi) of the icecast internal webserver, an MPEG\nlayer III streaming server. The UserAgent variable is not properly\nhtml_escaped so that an attacker could cause the client to execute\narbitrary Java script commands.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.3.11-4.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.12-8.
\nWe recommend that you upgrade your icecast-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities were discovered in recent versions of Qt, a\ncommonly used graphic widget set, used in KDE for example. The first\nproblem allows an attacker to execute arbitrary code, while the other\ntwo only seem to pose a denial of service danger. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nChris Evans has discovered a heap-based overflow when handling\n 8-bit RLE encoded BMP files.
\nMarcus Meissner has discovered a crash condition in the XPM\n handling code, which is not yet fixed in Qt 3.3.
\nMarcus Meissner has discovered a crash condition in the GIF\n handling code, which is not yet fixed in Qt 3.3.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.0.3-20020329-1woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.3.3-4 of qt-x11-free.
\nWe recommend that you upgrade your qt packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe MIT Kerberos Development Team has discovered a number of\nvulnerabilities in the MIT Kerberos Version 5 software. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nA double-free error may allow unauthenticated remote attackers to\n execute arbitrary code on KDC or clients.
\nSeveral double-free errors may allow authenticated attackers to\n execute arbitrary code on Kerberos application servers.
\nA remotely exploitable denial of service vulnerability has been\n found in the KDC and libraries.
\nSeveral double-free errors may allow remote attackers to execute\n arbitrary code on the server. This does not affect the version in\n woody.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.2.4-5woody6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.4-3.
\nWe recommend that you upgrade your krb5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLudwig Nussel discovered a problem in webmin, a web-based\nadministration toolkit. A temporary directory was used but without\nchecking for the previous owner. This could allow an attacker to\ncreate the directory and place dangerous symbolic links inside.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.94-7woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.160-1 of webmin and 1.090-1 of usermin.
\nWe recommend that you upgrade your webmin packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlvaro Martinez Echevarria discovered a problem in CUPS, the Common\nUNIX Printing System. An attacker can easily disable browsing in CUPS\nby sending a specially crafted UDP datagram to port 631 where cupsd is\nrunning.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.14-5woody6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.20final+rc1-6.
\nWe recommend that you upgrade your cups packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several problems in gdk-pixbuf, the GdkPixBuf\nlibrary used in Gtk. It is possible for an attacker to execute\narbitrary code on the victims machine. Gdk-pixbuf for Gtk+1.2 is an\nexternal package. For Gtk+2.0 it's part of the main gtk package.
\nThe Common Vulnerabilities and Exposures Project identifies the\nfollowing vulnerabilities:
\nDenial of service in bmp loader.
\nHeap-based overflow in pixbuf_create_from_xpm.
\nInteger overflow in the ico loader.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.17.0-2woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.22.0-7.
\nWe recommend that you upgrade your gdk-pixbuf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner from SUSE has discovered several buffer overflows in\nthe ImageMagick graphics library. An attacker could create a\nmalicious image or video file in AVI, BMP, or DIB format that could\ncrash the reading process. It might be possible that carefully\ncrafted images could also allow to execute arbitrary code with the\ncapabilities of the invoking process.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 5.4.4.5-1woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.0.6.2-1.
\nWe recommend that you upgrade your imagemagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner discovered a heap overflow error in imlib, an imaging\nlibrary for X and X11, that could be abused by an attacker to execute\narbitrary code on the victim's machine. The updated packages we have\nprovided in DSA 548-1 did not seem to be sufficient, which should be\nfixed by this update.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.9.14-2woody3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.9.14-16.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.9.14-17 of imlib and in version 1.9.14-16.2 of imlib+png2.
\nWe recommend that you upgrade your imlib1 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nChris Evans discovered several problems in gdk-pixbuf, the GdkPixBuf\nlibrary used in Gtk. It is possible for an attacker to execute\narbitrary code on the victims machine. Gdk-pixbuf for Gtk+1.2 is an\nexternal package. For Gtk+2.0 it's part of the main gtk package.
\nThe Common Vulnerabilities and Exposures Project identifies the\nfollowing vulnerabilities:
\nHeap-based overflow in pixbuf_create_from_xpm.
\nStack-based overflow in xpm_extract_color.
\nInteger overflow in the ico loader.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.0.2-5woody2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your Gtk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\niDEFENSE discovered a buffer overflow in the wv library, used to\nconvert and preview Microsoft Word documents. An attacker could\ncreate a specially crafted document that could lead wvHtml to execute\narbitrary code on the victims machine.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.7.1+rvt-2woody3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your wv package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPrzemyslaw Frasunek discovered a vulnerability in tnftpd or lukemftpd\nrespectively, the enhanced ftp daemon from NetBSD. An attacker could\nutilise this to execute arbitrary code on the server.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1-2.2.
\nWe recommend that you upgrade your lukemftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner discovered a heap overflow error in imlib2, an imaging\nlibrary for X and X11 and the successor of imlib, that may be utilised\nby an attacker to execute arbitrary code on the victims machine.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.5-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.0-12.4.
\nWe recommend that you upgrade your imlib2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA security problem has been discovered in getmail, a POP3 and APOP\nmail gatherer and forwarder. An attacker with a shell account on the\nvictims host could utilise getmail to overwrite arbitrary files when\nit is running as root.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.3.7-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.2.5-1.
\nWe recommend that you upgrade your getmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHugo Espuny discovered a problem in sendmail, a commonly used program\nto deliver electronic mail. When installing \"sasl-bin\" to use sasl in\nconnection with sendmail, the sendmail configuration script use fixed\nuser/pass information to initialise the sasl database. Any spammer\nwith Debian systems knowledge could utilise such a sendmail\ninstallation to relay spam.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 8.12.3-7.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 8.13.1-13.
\nWe recommend that you upgrade your sendmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSimon Josefsson noticed that the tspc.conf configuration file in\nfreenet6, a client to configure an IPv6 tunnel to freenet6.net, is set\nworld readable. This file can contain the username and the password\nused to contact the IPv6 tunnelbroker freenet6.net.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.6-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0-2.2.
\nWe recommend that you upgrade your freenet6 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichal Zalewski discovered a bug in the netkit-telnet server (telnetd)\nwhereby a remote attacker could cause the telnetd process to free an\ninvalid pointer. This causes the telnet server process to crash,\nleading to a straightforward denial of service (inetd will disable the\nservice if telnetd is crashed repeatedly), or possibly the execution\nof arbitrary code with the privileges of the telnetd process (by\ndefault, the 'telnetd' user).
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.17-18woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.17-26.
\nWe recommend that you upgrade your netkit-telnet package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nMax Vozeler discovered a vulnerability in pppoe, the PPP over Ethernet\ndriver from Roaring Penguin. When the program is running setuid root\n(which is not the case in a default Debian installation), an attacker\ncould overwrite any file on the file system.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.3-1.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.5-4.
\nWe recommend that you upgrade your pppoe package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJulian Reschke reported a problem in mod_dav of Apache 2 in connection\nwith a NULL pointer dereference. When running in a threaded model,\nespecially with Apache 2, a segmentation fault can take out a whole\nprocess and hence create a denial of service for the whole server.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.3-3.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.3-10 of libapache-mod-dav and in version 2.0.51-1 of\nApache 2.
\nWe recommend that you upgrade your mod_dav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Nordhausen has identified a local security hole in net-acct, a\nuser-mode IP accounting daemon. Old and redundant code from some time\nway back in the past created a temporary file in an insecure fashion.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.71-5woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.71-7.
\nWe recommend that you upgrade your net-acct package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several stack and integer overflows in the\nlibXpm library which is included in LessTif.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.93.18-5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.93.94-10.
\nWe recommend that you upgrade your lesstif packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several stack and integer overflows in the\nlibXpm library which is provided by X.Org, XFree86 and LessTif.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.1.0-16woody4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.3.0.dfsg.1-8.
\nWe recommend that you upgrade your libxpm packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in MySQL, a commonly used SQL\ndatabase on Unix servers. The following problems have been identified\nby the Common Vulnerabilities and Exposures Project:
\nOleksandr Byelkin noticed that ALTER TABLE ... RENAME checks\n CREATE/INSERT rights of the old table instead of the new one.
\nLukasz Wojtow noticed a buffer overrun in the mysql_real_connect\n function.
\nDean Ellis noticed that multiple threads ALTERing the same (or\n different) MERGE tables to change the UNION can cause the server\n to crash or stall.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.23.49-8.8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.0.21-1.
\nWe recommend that you upgrade your mysql and related packages and\nrestart services linking against them (e.g. Apache/PHP).
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis advisory is an addition to DSA 563-1 and 563-2 which weren't able\nto supersede the library on sparc and arm due to a different version\nnumber for them in the stable archive. Other architectures were\nupdated properly. Another problem was reported in connection with\nsendmail, though, which should be fixed with this update as well.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.5.27-3.1woody5.
\nFor reference the advisory text follows:
\n\n\nA vulnerability has been discovered in the Cyrus implementation of the\nSASL library, the Simple Authentication and Security Layer, a method\nfor adding authentication support to connection-based protocols. The\nlibrary honors the environment variable SASL_PATH blindly, which\nallows a local user to link against a malicious library to run\narbitrary code with the privileges of a setuid or setgid application.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.5.28-6.2 of cyrus-sasl and in version 2.1.19-1.3 of\ncyrus-sasl2.
\n
We recommend that you upgrade your libsasl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nDavide Del Vecchio discovered a vulnerability in mpg123, a popular (but\nnon-free) MPEG layer 1/2/3 audio player. A malicious MPEG layer 2/3\nfile could cause the header checks in mpg123 to fail, which could in\nturn allow arbitrary code to be executed with the privileges of the\nuser running mpg123.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.59r-13woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.59r-16.
\nWe recommend that you upgrade your mpg123 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar has reported two vulnerabilities in SoX, a universal\nsound sample translator, which may be exploited by malicious people to\ncompromise a user's system with a specially crafted .wav file.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 12.17.3-4woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 12.17.4-9.
\nWe recommend that you upgrade your sox package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn information leak has been detected in CUPS, the Common UNIX\nPrinting System, which may lead to the disclosure of sensitive\ninformation, such as user names and passwords which are written into\nlog files.
\nThe used patch only eliminates the authentication information in the\ndevice URI which is logged in the error_log file. It does not\neliminate the URI from the environment and process table, which is why\nthe CUPS developers recommend that system administrators do not code\nauthentication information in device URIs in the first place.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.14-5woody7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.20final+rc1-9.
\nWe recommend that you upgrade your CUPS package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in libtiff, the Tag Image File\nFormat library for processing TIFF graphics files. An attacker could\nprepare a specially crafted TIFF graphic that would cause the client\nto execute arbitrary code or crash. The Common Vulnerabilities and\nExposures Project has identified the following problems:
\nChris Evans discovered several problems in the RLE (run length\n encoding) decoders that could lead to arbitrary code execution.
\nMatthias Clasen discovered a division by zero through an integer\n overflow.
\nDmitry V. Levin discovered several integer overflows that caused\n malloc issues which can result to either plain crash or memory\n corruption.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.5.5-6woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.6.1-2.
\nWe recommend that you upgrade your libtiff package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in the Cyrus implementation of the\nSASL library, the Simple Authentication and Security Layer, a method\nfor adding authentication support to connection-based protocols. The\nlibrary honors the environment variable SASL_PATH blindly, which\nallows a local user to link against a malicious library to run\narbitrary code with the privileges of a setuid or setgid application.
\nThe MIT version of the Cyrus implementation of the SASL library\nprovides bindings against MIT GSSAPI and MIT Kerberos4.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.5.24-15woody3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your libsasl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichal Zalewski discovered a bug in the netkit-telnet server (telnetd)\nwhereby a remote attacker could cause the telnetd process to free an\ninvalid pointer. This causes the telnet server process to crash,\nleading to a straightforward denial of service (inetd will disable the\nservice if telnetd is crashed repeatedly), or possibly the execution\nof arbitrary code with the privileges of the telnetd process (by\ndefault, the 'telnetd' user).
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.17.17+0.1-2woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.17.24+0.1-4.
\nWe recommend that you upgrade your netkit-telnet-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral integer overflows have been discovered by its upstream\ndevelopers in libpng, a commonly used library to display PNG graphics.\nThey could be exploited to cause arbitrary code to be executed when a\nspecially crafted PNG image is processed.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.12-3.woody.9.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.15-8.
\nWe recommend that you upgrade your libpng packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral integer overflows have been discovered by its upstream\ndevelopers in libpng, a commonly used library to display PNG graphics.\nThey could be exploited to cause arbitrary code to be executed when a\nspecially crafted PNG image is processed.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.2.1-1.1.woody.9.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.2.5.0-9.
\nWe recommend that you upgrade your libpng3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in ecartis, a mailing-list manager,\nwhich allows an attacker in the same domain as the list admin to gain\nadministrator privileges and alter list settings.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.129a+1.0.0-snap20020514-1.3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.0+cvs.20030911-8.
\nWe recommend that you upgrade your ecartis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several integer overflows in xpdf, that are\nalso present in CUPS, the Common UNIX Printing System, which can be\nexploited remotely by a specially crafted PDF document.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.1.14-5woody10.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.1.20final+rc1-10.
\nWe recommend that you upgrade your CUPS packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe upstream developers discovered a problem in cabextract, a tool to\nextract cabinet files. The program was able to overwrite files in\nupper directories. This could lead an attacker to overwrite arbitrary\nfiles.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.2-2b.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1-1.
\nWe recommend that you upgrade your cabextract package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA temporary file problem has been discovered in xlsview from the\ncatdoc suite, convertors from Word to TeX and plain text, which could\nlead to local users being able to overwrite arbitrary files via a\nsymlink attack on predictable temporary file names.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.91.5-1.woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.91.5-2.
\nWe recommend that you upgrade your catdoc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security vulnerabilities have been discovered in Squid, the\ninternet object cache, the popular WWW proxy cache. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nIt is possible to bypass access lists and scan arbitrary hosts and\n ports in the network through cachemgr.cgi, which is installed by\n default. This update disables this feature and introduces a\n configuration file (/etc/squid/cachemgr.conf) to control\n this behavior.
\nThe asn_parse_header function (asn1.c) in the SNMP module for\n Squid allows remote attackers to cause a denial of service via\n certain SNMP packets with negative length fields that causes a\n memory allocation error.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.6-2woody4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.5.7-1.
\nWe recommend that you upgrade your squid package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTrustix Security Engineers identified insecure temporary file creation\nin a script included in the postgresql suite, an object-relational SQL\ndatabase. This could lead an attacker to trick a user to overwrite\narbitrary files he has write access to.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 7.2.1-2woody6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 7.4.6-1.
\nWe recommend that you upgrade your postgresql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nCarlos Barros has discovered a buffer overflow in the HTTP\nauthentication routine of mpg123, a popular (but non-free) MPEG layer\n1/2/3 audio player. If a user opened a malicious playlist or URL, an\nattacker might execute arbitrary code with the rights of the calling\nuser.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.59r-13woody4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.59r-17.
\nWe recommend that you upgrade your mpg123 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow vulnerability has been discovered in the wv library,\nused for converting and previewing word documents. On exploitation an\nattacker could execute arbitrary code with the privileges of the user\nrunning the vulnerable application.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.2+cvs.2002.06.05-1woody2.
\nThe package in the unstable distribution (sid) is not affected.
\nWe recommend that you upgrade your abiword package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFaheem Mitha noticed that the iptables command, an administration tool\nfor IPv4 packet filtering and NAT, did not always load the required\nmodules on its own as it was supposed to. This could lead to firewall\nrules not being loaded on system startup. This caused a failure in\nconnection with rules provided by lokkit at least.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2.6a-5.0woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.11-4.
\nWe recommend that you upgrade your iptables package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several integer overflows in xpdf, a viewer for\nPDF files, which can be exploited remotely by a specially crafted PDF\ndocument and lead to the execution of arbitrary code.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.00-3.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.00-9.
\nWe recommend that you upgrade your xpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered several buffer overflows in libxml and\nlibxml2, the XML C parser and toolkits for GNOME. Missing boundary\nchecks could cause several buffers to be overflown, which may cause\nthe client to execute arbitrary code.
\nThe following vulnerability matrix lists corrected versions of these\nlibraries:
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.8.17-2woody2 of libxml and in version 2.4.19-4woody2 of\nlibxml2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.8.17-9 of libxml and in version 2.6.11-5 of libxml2.
\nThese problems have also been fixed in version 2.6.15-1 of libxml2 in\nthe experimental distribution.
\nWe recommend that you upgrade your libxml packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTrustix developers discovered insecure temporary file creation in a\nsupplemental script in the lvm10 package that didn't check for\nexisting temporary directories, allowing local users to overwrite\nfiles via a symlink attack.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.4-5woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.8-8.
\nWe recommend that you upgrade your lvm10 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" noticed that the log functions in dhcp 2.x, which is\nstill distributed in the stable Debian release, contained pass\nparameters to function that use format strings. One use seems to be\nexploitable in connection with a malicious DNS server.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.0pl5-11woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0pl5-19.1.
\nWe recommend that you upgrade your dhcp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in the shadow suite which provides\nprograms like chfn and chsh. It is possible for a user, who is logged\nin but has an expired password to alter his account information with\nchfn or chsh without having to change the password. The problem was\noriginally thought to be more severe.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 20000902-12woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.3-30.3.
\nWe recommend that you upgrade your passwd package (from the shadow\nsuite).
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe upstream developers of Ruby have corrected a problem in the CGI\nmodule for this language. Specially crafted requests could cause an\ninfinite loop and thus cause the program to eat up cpu cycles.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.6.7-3woody4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.6.8-12 of ruby1.6 and in version 1.8.1+1.8.2pre2-4 of\nruby1.8.
\nWe recommend that you upgrade your ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered a buffer overflow condition in the playlist\nmodule of freeamp which could lead to arbitrary code execution.\nRecent versions of freeamp were renamed into zinf.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.1.1.0-4woody2.
\nFor the unstable distribution (sid) this problem does not exist in the\nzinf package as the code in question was rewritten.
\nWe recommend that you upgrade your freeamp packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTrustix developers discovered insecure temporary file creation in\nsupplemental scripts in the gzip package which may allow local users\nto overwrite files via a symlink attack.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.3.2-3woody3.
\nThe unstable distribution (sid) is not affected by these problems.
\nWe recommend that you upgrade your gzip package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered several integer overflows in the PNG image\ndecoding routines of the GD graphics library. This could lead to the\nexecution of arbitrary code on the victim's machine.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.8.4-17.woody3 of libgd1 and in version 2.0.1-10woody1 of\nlibgd2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your libgd1 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKhan Shirani discovered a format string vulnerability in gnats, the\nGNU problem report management system. This problem may be exploited\nto execute arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.999.beta1+cvs20020303-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0-7.
\nWe recommend that you upgrade your gnats package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered several integer overflows in the PNG image\ndecoding routines of the GD graphics library. This could lead to the\nexecution of arbitrary code on the victim's machine.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.8.4-17.woody3 of libgd1 and in version 2.0.1-10woody1 of\nlibgd2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your libgd2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered a\nformat string vulnerability in ez-ipupdate, a client for many dynamic\nDNS services. This problem can only be exploited if ez-ipupdate is\nrunning in daemon mode (most likely) with many but not all service\ntypes.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.0.11b5-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.0.11b8-8.
\nWe recommend that you upgrade your ez-ipupdate package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been reported for ImageMagick, a commonly used\nimage manipulation library. Due to a boundary error within the EXIF\nparsing routine, a specially crafted graphic image could lead to the\nexecution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 5.4.4.5-1woody4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.0.6.2-1.5.
\nWe recommend that you upgrade your imagemagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been identified in the Apache 1.3 webserver:
\n\"Crazy Einstein\" has discovered a vulnerability in the\n \"mod_include\" module, which can cause a buffer to be overflown and\n could lead to the execution of arbitrary code.
\nLarry Cashdollar has discovered a potential buffer overflow in the\n htpasswd utility, which could be exploited when user-supplied is\n passed to the program via a CGI (or PHP, or ePerl, ...) program.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.3.26-0woody6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.33-2.
\nWe recommend that you upgrade your apache packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLeon Juranic discovered that BNC, an IRC session bouncing proxy, does\nnot always protect buffers from being overwritten. This could\nexploited by a malicious IRC server to overflow a buffer of limited\nsize and execute arbitrary code on the client host.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.6.4-3.3.
\nThis package does not exist in the testing or unstable distributions.
\nWe recommend that you upgrade your bnc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLiam Helmer noticed that sudo, a program that provides limited super\nuser privileges to specific users, does not clean the environment\nsufficiently. Bash functions and the CDPATH variable are still passed\nthrough to the program running as privileged user, leaving\npossibilities to overload system routines. These vulnerabilities can\nonly be exploited by users who have been granted limited super user\nprivileges.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.6.6-1.3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.6.8p3.
\nWe recommend that you upgrade your sudo package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nStefan Esser discovered several security related problems in the Cyrus\nIMAP daemon. Due to a bug in the command parser it is possible to\naccess memory beyond the allocated buffer in two places which could\nlead to the execution of arbitrary code.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.5.19-9.2
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.1.17-1.
\nWe recommend that you upgrade your cyrus-imapd package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler noticed that yardradius, the YARD radius authentication\nand accounting server, contained a stack overflow similar to the one\nfrom radiusd which is referenced as CAN-2001-0534. This could lead to\nthe execution of arbitrary code as root.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.20-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.20-15.
\nWe recommend that you upgrade your yardradius package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several integer overflows in xpdf, that are\nalso present in tetex-bin, binary files for the teTeX distribution,\nwhich can be exploited remotely by a specially crafted PDF document\nand lead to the execution of arbitrary code.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 20011202-7.3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.2-23.
\nWe recommend that you upgrade your tetex-bin packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in samba, a commonly used\nLanManager-like file and printer server for Unix. A remote attacker\nmay be able to gain access to files which exist outside of the share's\ndefined path. Such files must still be readable by the account used\nfor the connection, though.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.3a-14.1.
\nIn the unstable (sid) and testing (sarge) distributions this problem\nwas not present.
\nWe recommend that you upgrade your samba packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMore potential integer overflows have been found in the GD graphics\nlibrary which weren't covered by our security advisory\nDSA 589. They\ncould be exploited by a specially crafted graphic and could lead to\nthe execution of arbitrary code on the victim's machine.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.8.4-17.woody4.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your libgd1 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMore potential integer overflows have been found in the GD graphics\nlibrary which weren't covered by our security advisory\nDSA 591. They\ncould be exploited by a specially crafted graphic and could lead to\nthe execution of arbitrary code on the victim's machine.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.0.1-10woody2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your libgd2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTrustix developers discovered insecure temporary file creation in a\nsupplemental script (der_chop) of the openssl package which may allow\nlocal users to overwrite files via a symlink attack.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.6c-2.woody.7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.7e-1.
\nWe recommend that you upgrade your openssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered a buffer overflow condition in hpsockd, the\nsocks server written at Hewlett-Packard. An exploit could cause the\nprogram to crash or may have worse effect.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.6.woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.14.
\nWe recommend that you upgrade your hpsockd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHaris Sehic discovered several vulnerabilities in viewcvs, a utility\nfor viewing CVS and Subversion repositories via HTTP. When exporting\na repository as a tar archive the hide_cvsroot and forbidden settings\nwere not honoured enough.
\nWhen upgrading the package for woody, please make a copy of your\n/etc/viewcvs/viewcvs.conf file if you have manually edited this file.\nUpon upgrade the debconf mechanism may alter it in a way so that\nviewcvs doesn't understand it anymore.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.9.2-4woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.9.2+cvs.1.0.dev.2004.07.28-1.2.
\nWe recommend that you upgrade your viewcvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSGI has discovered that rpc.statd from the nfs-utils package, the\nNetwork Status Monitor, did not ignore the \"SIGPIPE\". Hence, a client\nprematurely terminating the TCP connection could also terminate the\nserver process.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0-2woody2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your nfs-utils package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral developers have discovered a number of problems in the libXpm\nlibrary which is provided by X.Org, XFree86 and LessTif. These bugs\ncan be exploited by remote and/or local attackers to gain access to\nthe system or to escalate their local privileges, by using a specially\ncrafted XPM image.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.1.0-16woody5.
\nFor the unstable distribution (sid) this problem will be fixed in\nversion 4.3.0.dfsg.1-9.
\nWe recommend that you upgrade your xlibs package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in zgv, an SVGAlib\ngraphics viewer for the i386 architecture. The Common Vulnerabilities\nand Exposures Project identifies the following problems:
\n\"infamous41md\" discovered multiple\n integer overflows in zgv. Remote exploitation of an integer\n overflow vulnerability could allow the execution of arbitrary\n code.
\nMikulas Patocka discovered that malicious multiple-image (e.g.\n animated) GIF images can cause a segmentation fault in zgv.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 5.5-3woody1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your zgv package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAdam Zabrocki discovered multiple buffer overflows in atari800, an\nAtari emulator. In order to directly access graphics hardware, one of\nthe affected programs is installed setuid root. A local attacker\ncould exploit this vulnerability to gain root privileges.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.2.2-1woody3.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your atari800 package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in cscope, a program to\ninteractively examine C source code, which may allow local users to\noverwrite files via a symlink attack.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 15.3-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 15.5-1.
\nWe recommend that you upgrade your cscope package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered a buffer overflow in htget, a file grabber\nthat will get files from HTTP servers. It is possible to overflow a\nbuffer and execute arbitrary code by accessing a malicious URL.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.93-1.1woody1.
\nThis package is not present in the testing and unstable distributions.
\nWe recommend that you upgrade your htget package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRudolf Polzer discovered a vulnerability in a2ps, a converter and\npretty-printer for many formats to PostScript. The program did not\nescape shell meta characters properly which could lead to the\nexecution of arbitrary commands as a privileged user if a2ps is\ninstalled as a printer filter.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.13b-16woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1:4.13b-4.2.
\nWe recommend that you upgrade your a2ps package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBrian Caswell discovered that an improperly formatted SMB packet could\nmake ethereal hang and eat CPU endlessly.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.4-1woody9.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.10.8-1.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuke \"infamous41md\" discovered multiple vulnerabilities in xzgv, a\npicture viewer for X11 with a thumbnail-based selector. Remote\nexploitation of an integer overflow vulnerability could allow the\nexecution of arbitrary code.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 0.7-6woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.8-3.
\nWe recommend that you upgrade your xzgv package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit Project\nnoticed that the debstd script from\ndebmake, a deprecated helper package for Debian packaging, created\ntemporary directories in an insecure manner. This can be exploited by\na malicious user to overwrite arbitrary files owned by the victim.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.6.10.woody.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.7.7.
\nWe recommend that you upgrade your debmake package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJoel Eriksson discovered a format string vulnerability in telnetd-ssl\nwhich may be able to lead to the execution of arbitrary code on the\nvictims machine.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.17.17+0.1-2woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.17.24+0.1-6.
\nWe recommend that you upgrade your telnetd-ssl package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered a problem in libtiff, the Tag Image File\nFormat library for processing TIFF graphics files. Upon reading a\nTIFF file it is possible to allocate a zero sized buffer and write to\nit which would lead to the execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.5.5-6.woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.6.1-4.
\nWe recommend that you upgrade your libtiff packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPavel Kankovsky discovered that several overflows found in the libXpm\nlibrary were also present in imlib, an imaging library for X and X11.\nAn attacker could create a carefully crafted image file in such a way\nthat it could cause an application linked with imlib to execute\narbitrary code when the file was opened by a victim. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nMultiple heap-based buffer overflows.
\nMultiple integer overflows.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.9.14-2woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.9.14-17.1 of imlib and in version 1.9.14-16.1 of imlib+png2\nwhich produces the imlib1 package.
\nWe recommend that you upgrade your imlib packages immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn iDEFENSE security researcher discovered a buffer overflow in xpdf,\nthe portable document format (PDF) suite. A maliciously crafted PDF\nfile could exploit this problem, resulting in the execution of arbitrary\ncode.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.00-3.3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.00-11.
\nWe recommend that you upgrade your xpdf package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Perl, the popular\nscripting language. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nJeroen van Wolffelaar discovered that the rmtree() function in the\n File::Path module removes directory trees in an insecure manner\n which could lead to the removal of arbitrary files and directories\n through a symlink attack.
\nTrustix developers discovered several insecure uses of temporary\n files in many modules which allow a local attacker to overwrite\n files via a symlink attack.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 5.6.1-8.8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 5.8.4-5.
\nWe recommend that you upgrade your perl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn iDEFENSE security researcher discovered a buffer overflow in xpdf,\nthe Portable Document Format (PDF) suite. Similar code is present in\nthe PDF processing part of CUPS. A maliciously crafted PDF file could\nexploit this problem, leading to the execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.14-5woody11.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.22-2.
\nWe recommend that you upgrade your cupsys packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit Project\nhas discovered multiple insecure uses\nof temporary files that could lead to overwriting arbitrary files via\na symlink attack.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 21.8-3.
\nThe unstable distribution (sid) does not contain this package.
\nWe recommend that you upgrade your htmlheadline package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJonathan Rockway discovered a buffer overflow in nasm, the\ngeneral-purpose x86 assembler, which could lead to the execution of\narbitrary code when compiling a maliciously crafted assembler source\nfile.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.98.28cvs-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.98.38-1.1.
\nWe recommend that you upgrade your nasm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in zip, the archiver for .zip\nfiles. When doing recursive folder compression the program did not\ncheck the resulting path length, which would lead to memory being\noverwritten. A malicious person could convince a user to create an\narchive containing a specially crafted path name, which could lead to\nthe execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.30-5woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.30-8.
\nWe recommend that you upgrade your zip package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDanny Lungstrom discovered two buffer overflows in pcal, a program to\ngenerate Postscript calendars, that could lead to the execution of\narbitrary code when compiling a calendar.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 4.7-8woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.8.0-1.
\nWe recommend that you upgrade your pcal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDmitry V. Levin discovered a buffer overflow in libtiff, the Tag Image\nFile Format library for processing TIFF graphics files. Upon reading\na TIFF file it is possible to crash the application, and maybe also to\nexecute arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.5.5-6.woody5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.6.1-5.
\nWe recommend that you upgrade your libtiff package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA cross-site scripting vulnerability has been discovered in namazu2, a\nfull text search engine. An attacker could prepare specially crafted\ninput that would not be sanitised by namazu2 and hence displayed\nverbatim for the victim.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0.10-1woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.14-1.
\nWe recommend that you upgrade your namazu2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPavel Kankovsky discovered that several overflows found in the libXpm\nlibrary were also present in imlib and imlib2, imaging libraries for\nX11. An attacker could create a carefully crafted image file in such\na way that it could cause an application linked with imlib or imlib2\nto execute arbitrary code when the file was opened by a victim. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nMultiple heap-based buffer overflows. No such code is present in\n imlib2.
\nMultiple integer overflows in the imlib library.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.0.5-2woody2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your imlib2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the MIT Kerberos 5\nadministration library (libkadm5srv) that could lead to the execution\nof arbitrary code upon exploitation by an authenticated user, not\nnecessarily one with administrative privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2.4-5woody7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.6-1.
\nWe recommend that you upgrade your krb5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJeroen van Wolffelaar discovered a problem in lintian, the Debian\npackage checker. The program removes the working directory even if it\nwasn't created at program start, removing an unrelated file or\ndirectory a malicious user inserted via a symlink attack.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.20.17.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.23.6.
\nWe recommend that you upgrade your lintian package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThiago Macieira discovered a vulnerability in the kioslave library,\nwhich is part of kdelibs, which allows a remote attacker to execute\narbitrary FTP commands via an ftp:// URL that contains a URL-encoded\nnewline before the FTP command.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-13.woody.13.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your kdelibs3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStephen Dranger discovered a buffer overflow in linpopup, an X11 port\nof winpopup, running over Samba, that could lead to the execution of\narbitrary code when displaying a maliciously crafted message.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2.0-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.0-7.
\nWe recommend that you upgrade your linpopup package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter Samuelson, upstream maintainer of bmv, a PostScript viewer for\nSVGAlib, discovered that temporary files are created in an insecure\nfashion. A malicious local user could cause arbitrary files to be\noverwritten by a symlink attack.
\nFor the stable distribution (woody) this problem has been\nfixed in version 1.2-14.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2-17.
\nWe recommend that you upgrade your bmv packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPatrice Fournier discovered a vulnerability in the authorisation\nsubsystem of hylafax, a flexible client/server fax system. A local or\nremote user guessing the contents of the hosts.hfaxd database could\ngain unauthorised access to the fax system.
\nSome installations of hylafax may actually utilise the weak hostname\nand username validation for authorized uses. For example, hosts.hfaxd\nentries that may be common are
\n\n 192.168.0\n username:uid:pass:adminpass\n user@host\n\n
After updating, these entries will need to be modified in order to\ncontinue to function. Respectively, the correct entries should be
\n\n 192.168.0.[0-9]+\n username@:uid:pass:adminpass\n user@host\n\n
Unless such matching of \"username\" with \"otherusername\" and \"host\" with\n\"hostname\" is desired, the proper form of these entries should include\nthe delimiter and markers like this
\n\n @192.168.0.[0-9]+$\n ^username@:uid:pass:adminpass\n ^user@host$\n\n
For the stable distribution (woody) this problem has been fixed in\nversion 4.1.1-3.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.2.1-1.
\nWe recommend that you upgrade your hylafax packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPhilip Hazel announced a buffer overflow in the host_aton function in\nexim, the default mail-transport-agent in Debian, which can lead to the\nexecution of arbitrary code via an illegal IPv6 address.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.35-1woody4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.36-13 of exim and 4.34-10 of exim4.
\nWe recommend that you upgrade your exim and exim4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral insecure uses of temporary files have been discovered in\nsupport scripts in the libc6 package which provides the c library for\na GNU/Linux system. Trustix developers found that the catchsegv\nscript uses temporary files insecurely. Openwall developers\ndiscovered insecure temporary files in the glibcbug script. These\nscripts are vulnerable to a symlink attack.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.2.5-11.8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.3.2.ds1-20.
\nWe recommend that you upgrade your libc6 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPhilip Hazel announced a buffer overflow in the host_aton function in\nexim-tls, the SSL-enabled version of the default mail-transport-agent\nin Debian, which can lead to the execution of arbitrary code via an\nillegal IPv6 address.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.35-3woody3.
\nIn the unstable distribution (sid) this package does not exist\nanymore.
\nWe recommend that you upgrade your exim-tls package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"jaguar\" has discovered two security relevant problems in gopherd, the\nGopher server in Debian which is part of the gopher package. The\nCommon Vulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nAn integer overflow can happen when posting content of a specially\n calculated size.
\nA format string vulnerability has been found in the log routine.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.0.3woody2.
\nThe unstable distribution (sid) does not contain a gopherd package.\nIt has been replaced by Pygopherd.
\nWe recommend that you upgrade your gopherd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndrew V. Samoilov has noticed that several bugfixes which were\napplied to the source by upstream developers of mc, the midnight\ncommander, a file browser and manager, were not backported to the\ncurrent version of mc that Debian ships in their stable release. The\nCommon Vulnerabilities and Exposures Project identifies the following\nvulnerabilities:
\nMultiple format string vulnerabilities
\nMultiple buffer overflows
\nOne infinite loop vulnerability
\nDenial of service via corrupted section header
\nDenial of service via null dereference
\nFreeing unallocated memory
\nDenial of service via use of already freed memory
\nDenial of service via manipulating non-existing file handles
\nUnintended program execution via insecure filename quoting
\nDenial of service via a buffer underflow
\nFor the stable distribution (woody) these problems have been fixed in\nversion 4.5.55-1.2woody5.
\nFor the unstable distribution (sid) these problems should already be\nfixed since they were backported from current versions.
\nWe recommend that you upgrade your mc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered a buffer overflow in xatitv, one of the\nprograms in the gatos package, that is used to display video with\ncertain ATI video cards. xatitv is installed setuid root in order to\ngain direct access to the video hardware.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.0.5-6woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.0.5-15.
\nWe recommend that you upgrade your gatos package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered that playmidi, a MIDI player, contains a\nsetuid root program with a buffer overflow that can be exploited by a\nlocal attacker.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.4-4woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.4debian-3.
\nWe recommend that you upgrade your playmidi package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in gallery, a web-based\nphoto album written in PHP4. The Common Vulnerabilities and Exposures\nproject identifies the following vulnerabilities:
\nJim Paris discovered a cross site scripting vulnerability which\n allows code to be inserted by using specially formed URLs.
\nThe upstream developers of gallery have fixed several cases of\n possible variable injection that could trick gallery to unintended\n actions, e.g. leaking database passwords.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.2.5-8woody3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.4.4-pl4-1.
\nWe recommend that you upgrade your gallery package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"jaguar\" of the Debian Security Audit Project has discovered several\nbuffer overflows in queue, a transparent load balancing system.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.30.1-4woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.30.1-5.
\nWe recommend that you upgrade your queue package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDanny Lungstrom discovered a vulnerability in chbg, a tool to change\nbackground pictures. A maliciously crafted configuration/scenario\nfile could overflow a buffer and lead to the execution of arbitrary\ncode on the victim's machine.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.5-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.5-4.
\nWe recommend that you upgrade your chbg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\niDEFENSE has reported a buffer overflow in xpdf, the portable document\nformat (PDF) suite. Similar code is present in the PDF processing\npart of CUPS. A maliciously crafted PDF file could exploit this\nproblem, resulting in the execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.1.14-5woody12.
\nIn the unstable distribution (sid) CUPSYS does not use its own xpdf\nvariant anymore but uses xpdf-utils.
\nWe recommend that you upgrade your cups packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndrei Nigmatulin discovered a buffer overflow in the PSD\nimage-decoding module of ImageMagick, a commonly used image\nmanipulation library. Remote exploitation with a carefully crafted\nimage could lead to the execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 5.4.4.5-1woody5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.0.6.2-2.
\nWe recommend that you upgrade your imagemagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fernandez-Sanguino Pe\u00f1a from the Debian Security Audit Project\ndiscovered a temporary file vulnerability in the mysqlaccess script of\nMySQL that could allow an unprivileged user to let root overwrite\narbitrary files via a symlink attack and could also could unveil the\ncontents of a temporary file which might contain sensitive\ninformation.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.23.49-8.9.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.23-3 of mysql-dfsg and in version 4.1.8a-6 of\nmysql-dfsg-4.1.
\nWe recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\niDEFENSE has reported a buffer overflow in xpdf, the portable document\nformat (PDF) suite. A maliciously crafted PDF file could exploit this\nproblem, resulting in the execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.00-3.4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.00-12.
\nWe recommend that you upgrade your xpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in xtrlock, a minimal X display\nlock program which can be exploited by a malicious local attacker to\ncrash the lock program and take over the desktop session.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0-6woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0-9.
\nWe recommend that you upgrade your xtrlock package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered that due to missing input sanitising in\ndiatheke, a CGI script for making and browsing a bible website, it is\npossible to execute arbitrary commands via a specially crafted URL.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.5.3-3woody2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your diatheke package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Squid, the internet\nobject cache, the popular WWW proxy cache. The Common Vulnerabilities\nand Exposures Project identifies the following vulnerabilities:
\n\"infamous41md\" discovered a buffer overflow in the parser for\n Gopher responses which will lead to memory corruption and usually\n crash Squid.
\n\"infamous41md\" discovered an integer overflow in the receiver of\n WCCP (Web Cache Communication Protocol) messages. An attacker\n could send a specially crafted UDP datagram that will cause Squid\n to crash.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.6-2woody5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.5.7-4.
\nWe recommend that you upgrade your squid package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in unarj, a non-free ARJ\nunarchive utility. The Common Vulnerabilities and Exposures Project\nidentifies the following vulnerabilities:
\nA buffer overflow has been discovered when handling long file\n names contained in an archive. An attacker could create a\n specially crafted archive which could cause unarj to crash or\n possibly execute arbitrary code when being extracted by a victim.
\nA directory traversal vulnerability has been found so that an\n attacker could create a specially crafted archive which would\n create files in the parent directory when being extracted by a\n victim. When used recursively, this vulnerability could be used\n to overwrite critical system files and programs.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.43-3woody1.
\nFor the unstable distribution (sid) these problems don't apply since\nunstable/non-free does not contain the unarj package.
\nWe recommend that you upgrade your unarj package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been detected in the X11 dissector of ethereal,\na commonly used network traffic analyser. A remote attacker may be\nable to overflow a buffer using a specially crafted IP packet. More\nproblems have been discovered which don't apply to the version in\nwoody but are fixed in sid as well.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.4-1woody11.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.10.9-1.
\nWe recommend that you upgrade your ethereal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund has discovered several security relevant problems in\nenscript, a program to convert ASCII text into Postscript and other\nformats. The Common Vulnerabilities and Exposures project identifies\nthe following vulnerabilities:
\nUnsanitised input can cause the execution of arbitrary commands\n via EPSF pipe support. This has been disabled, also upstream.
\nDue to missing sanitising of filenames it is possible that a\n specially crafted filename can cause arbitrary commands to be\n executed.
\nMultiple buffer overflows can cause the program to crash.
\nUsually, enscript is only run locally, but since it is executed inside\nof viewcvs some of the problems mentioned above can easily be turned\ninto a remote vulnerability.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.6.3-1.3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.6.4-6.
\nWe recommend that you upgrade your enscript package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered that zhcon, a fast console CJK system using\nthe Linux framebuffer, accesses a user-controlled configuration file\nwith elevated privileges. Thus, it is possible to read arbitrary\nfiles.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.2-4woody3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your zhcon package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit Team has\ndiscovered that the vdr daemon which is used for video disk recorders\nfor DVB cards can overwrite arbitrary files.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.0-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.6-6.
\nWe recommend that you upgrade your vdr package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA heap overflow has been discovered in the DVD subpicture decoder of\nxine-lib. An attacker could cause arbitrary code to be executed on\nthe victims host by supplying a malicious MPEG. By tricking users to\nview a malicious network stream, this is remotely exploitable.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.8-2woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1-rc6a-1.
\nWe recommend that you upgrade your libxine packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit Project\ndiscovered that the DBI library, the Perl5 database interface, creates\na temporary PID file in an insecure manner. This can be exploited by a\nmalicious user to overwrite arbitrary files owned by the person\nexecuting the parts of the library.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.21-2woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.46-6.
\nWe recommend that you upgrade your libdbi-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo problems have been discovered in the libpam-radius-auth package,\nthe PAM RADIUS authentication module. The Common Vulnerabilities and\nExposures Project identifies the following problems:
\nThe Debian package accidentally installed its configuration file\n /etc/pam_radius_auth.conf world-readable. Since it may possibly\n contain secrets all local users are able to read them if the\n administrator hasn't adjusted file permissions. This problem is\n Debian specific.
\nLeon Juranic discovered an integer underflow in the mod_auth_radius\n module for Apache which is also present in libpam-radius-auth.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.3.14-1.3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.16-3.
\nWe recommend that you upgrade your libpam-radius-auth package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRapha\u00ebl Enrici discovered that the KDE screensaver can crash under\ncertain local circumstances. This can be exploited by an attacker\nwith physical access to the workstation to take over the desktop\nsession.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-14.9.
\nThis problem has been fixed upstream in KDE 3.0.5 and is therefore\nfixed in the unstable (sid) and testing (sarge) distributions already.
\nWe recommend that you upgrade your kscreensaver package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan McMahill noticed that our advisory DSA 661-1 did not correct\nthe multiple insecure files problem, hence, this update. For\ncompleteness below is the original advisory text:
\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit project\ndiscovered that f2c and fc, which are both part of the f2c package, a\nfortran 77 to C/C++ translator, open temporary files insecurely and\nare hence vulnerable to a symlink attack. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\n\n
\n- CAN-2005-0017\n
Multiple insecure temporary files in the f2c translator.
\n- CAN-2005-0018\n
Two insecure temporary files in the f2 shell script.
\n
For the stable distribution (woody) and all others including testing\nthis problem has been fixed in version 20010821-3.2.
\nWe recommend that you upgrade your f2c package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nAndrew Archibald discovered that the last update to squirrelmail which\nwas intended to fix several problems caused a regression which got\nexposed when the user hits a session timeout. \u00a0For completeness below\nis the original advisory text:
\n\n\nSeveral vulnerabilities have been discovered in Squirrelmail, a\ncommonly used webmail system. The Common Vulnerabilities and\nExposures project identifies the following problems:
\n\n
\n- CAN-2005-0104\n
Upstream developers noticed that an unsanitised variable could\n lead to cross site scripting.
\n- CAN-2005-0152\n
Grant Hollingworth discovered that under certain circumstances URL\n manipulation could lead to the execution of arbitrary code with\n the privileges of www-data. This problem only exists in version\n 1.2.6 of Squirrelmail.
\n
For the stable distribution (woody) these problems have been fixed in\nversion 1.2.6-3.
\nFor the unstable distribution (sid) the problem that affects unstable\nhas been fixed in version 1.4.4-1.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral buffer overflows have been discovered in prozilla, a\nmulti-threaded download accelerator which could be exploited by a\nremote attacker to execute arbitrary code on the victim's machine. An\nexploit for prozilla is already in the wild.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.3.6-3woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.7.3-1.
\nWe recommend that you upgrade your prozilla package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered, that cpio, a program to manage archives of\nfiles, creates output files with -O and -F with broken permissions due\nto a reset zero umask which allows local users to read or overwrite\nthose files.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.4.2-39woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your cpio package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered several bugs in ncpfs that provides utilities\nto use resources from NetWare servers of which one also applies to the\nstable Debian distribution. Due to accessing a configuration file\nwithout further checks with root permissions it is possible to read\narbitrary files.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.0.18-10woody2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your ncpfs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe Python development team has discovered a flaw in their language\npackage. The SimpleXMLRPCServer library module could permit remote\nattackers unintended access to internals of the registered object or\nits module or possibly other modules. The flaw only affects Python\nXML-RPC servers that use the register_instance() method to register an\nobject without a _dispatch() method. Servers using only\nregister_function() are not affected.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.1-4.7. No other version of Python in woody is affected.
\nFor the testing (sarge) and unstable (sid) distributions the following\nmatrix explains which version will contain the correction in which\nversion:
\n| \u00a0 | \ntesting | \nunstable | \n
|---|---|---|
| Python 2.2 | \n2.2.3-14 | \n2.2.3-14 | \n
| Python 2.3 | \n2.3.4-20 | \n2.3.4+2.3.5c1-2 | \n
| Python 2.4 | \n2.4-5 | \n2.4-5 | \n
We recommend that you upgrade your Python packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Squid, the internet\nobject cache, the popular WWW proxy cache. The Common Vulnerabilities\nand Exposures project identifies the following vulnerabilities:
\nLDAP is very forgiving about spaces in search filters and this\n could be abused to log in using several variants of the login\n name, possibly bypassing explicit access controls or confusing\n accounting.
\nCache pollution/poisoning via HTTP response splitting has been\n discovered.
\nThe meaning of the access controls becomes somewhat confusing if\n any of the referenced ACLs (access control lists) is declared\n empty, without any members.
\nThe length argument of the WCCP recvfrom() call is larger than it\n should be. An attacker may send a larger than normal WCCP packet\n that could overflow a buffer.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.6-2woody6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.5.7-7.
\nWe recommend that you upgrade your squid package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJohn Heasman and others discovered a bug in the PostgreSQL engine\nwhich would allow any user load an arbitrary local library into it.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 7.2.1-2woody7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 7.4.7-1.
\nWe recommend that you upgrade your postgresql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in php4 which also apply to\nthe version of php3 in the stable Debian distribution. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nThe memory_limit functionality allows remote attackers to execute\n arbitrary code under certain circumstances.
\nThe strip_tags function does not filter null (\\0) characters\n within tag names when restricting input to allowed tags, which\n allows dangerous tags to be processed by some web browsers which\n could lead to cross-site scripting (XSS) vulnerabilities.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.0.18-23.1woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.0.18-27.
\nWe recommend that you upgrade your php3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered several format string vulnerabilities in the\nmovemail utility of Emacs, the well-known editor. Via connecting to a\nmalicious POP server an attacker can execute arbitrary code under the\nprivileges of group mail.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 20.7-13.3.
\nThe unstable distribution (sid) does not contain an Emacs20 package\nanymore.
\nWe recommend that you upgrade your emacs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered several format string vulnerabilities in the\nmovemail utility of Emacs, the well-known editor. Via connecting to a\nmalicious POP server an attacker can execute arbitrary code under the\nprivileges of group mail.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 21.4.6-8woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 21.4.16-2.
\nWe recommend that you upgrade your emacs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered that programs linked against xview are\nvulnerable to a number of buffer overflows in the XView library. When\nthe overflow is triggered in a program which is installed setuid root\na malicious user could perhaps execute arbitrary code as privileged\nuser.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.2p1.4-16woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.2p1.4-19.
\nWe recommend that you upgrade your xview packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered an integer overflow in a helper application\ninside of Evolution, a free groupware suite. A local attacker could\ncause the setuid root helper to execute arbitrary code with elevated\nprivileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.5-1woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.3-1.2.
\nWe recommend that you upgrade your evolution package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDue to an incompatibility between Python 1.5 and 2.1 the last mailman\nupdate did not run with Python 1.5 anymore. This problem is corrected\nwith this update. This advisory only updates the packages updated\nwith DSA 674-2. The version in unstable is not affected since it is\nnot supposed to work with Python 1.5 anymore. For completeness below\nis the original advisory text:
\n\n\nTwo security related problems have been discovered in mailman,\nweb-based GNU mailing list manager. The Common Vulnerabilities and\nExposures project identifies the following problems:
\n\n
\n- CAN-2004-1177\n
Florian Weimer discovered a cross-site scripting vulnerability in\n mailman's automatically generated error messages. An attacker\n could craft a URL containing JavaScript (or other content\n embedded into HTML) which triggered a mailman error page that\n would include the malicious code verbatim.
\n- CAN-2005-0202\n
Several listmasters have noticed unauthorised access to archives\n of private lists and the list configuration itself, including the\n users passwords. Administrators are advised to check the\n webserver logfiles for requests that contain \"/...../\" and the\n path to the archives or configuration. This does only seem to\n affect installations running on web servers that do not strip\n slashes, such as Apache 1.3.
\n
For the stable distribution (woody) these problems have been fixed in\nversion 2.0.11-1woody11.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.1.5-6.
\nWe recommend that you upgrade your mailman package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nErik Sj\u00f6lund discovered that hztty, a converter for GB, Big5 and zW/HZ\nChinese encodings in a tty session, can be triggered to execute\narbitrary commands with group utmp privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0-5.2woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0-6.1.
\nWe recommend that you upgrade your hztty package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered a buffer overflow in pcdsvgaview, an SVGA\nPhotoCD viewer. xpcd-svga is part of xpcd and uses svgalib to display\ngraphics on the Linux console for which root permissions are required.\nA malicious user could overflow a fixed-size buffer and may cause the\nprogram to execute arbitrary code with elevated privileges.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.08-8woody3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your xpcd-svga package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered that a support script of sympa, a mailing list\nmanager, is running setuid sympa and vulnerable to a buffer overflow.\nThis could potentially lead to the execution of arbitrary code under\nthe sympa user id.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.3.3-3woody2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your sympa package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"Vlad902\" discovered a vulnerability in the rwhod program that can be\nused to crash the listening process. The broadcasting one is\nunaffected. This vulnerability only affects little endian\narchitectures (i.e. on Debian: alpha, arm, ia64, i386, mipsel,\nand s390).
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.17-4woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.17-8.
\nWe recommend that you upgrade your rwhod package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSean Finney discovered several insecure temporary file uses in\ntoolchain-source, the GNU binutils and GCC source code and scripts.\nThese bugs can lead a local attacker with minimal knowledge to trick\nthe admin into overwriting arbitrary files via a symlink attack. The\nproblems exist inside the Debian-specific tpkg-* scripts.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.0.4-1woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.4-5.
\nWe recommend that you upgrade your toolchain-source package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Krax discovered a cross site scripting vulnerability in\nht://dig, a web search system for an intranet or small internet.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.1.6-3woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.1.6-11.
\nWe recommend that you upgrade your htdig package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund and Devin Carraway discovered that synaesthesia, a\nprogram for representing sounds visually, accesses user-controlled\nconfiguration and mixer files with elevated privileges. Thus, it is\npossible to read arbitrary files.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.1-2.1woody3.
\nFor the testing (sarge) and unstable (sid) distribution this problem\ndoes not exist since synaesthesia is not installed setuid root\nanymore.
\nWe recommend that you upgrade your synaesthesia package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIn addition to CAN-2005-0116 more vulnerabilities have been found in\nawstats, a powerful and featureful web server log analyzer with a CGI\nfrontend. Missing input sanitising can cause arbitrary commands to be\nexecuted.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.0-0.woody.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.2-1.2.
\nWe recommend that you upgrade your awstats package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral buffer overflows have been discovered in PL/PgSQL as part of\nthe PostgreSQL engine which could lead to the execution of arbitrary\ncode.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 7.2.1-2woody8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 7.4.7-2.
\nWe recommend that you upgrade your postgresql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered a\nproblem in typespeed, a touch-typist trainer disguised as game. This\ncould lead to a local attacker executing arbitrary code as group\ngames.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.4.1-2.3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your typespeed package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered several format string vulnerabilities in the\nmovemail utility of Emacs, the well-known editor. Via connecting to a\nmalicious POP server an attacker can execute arbitrary code under the\nprivileges of group mail.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 21.2-1woody3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 21.3+1-9.
\nWe recommend that you upgrade your emacs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlbert Puigsech Galicia discovered a directory traversal vulnerability\nin a proprietary FTP client (CAN-2004-1376) which is also present in\ngftp, a GTK+ FTP client. A malicious server could provide a specially\ncrafted filename that could cause arbitrary files to be overwritten or\ncreated by the client.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.0.11-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.18-1.
\nWe recommend that you upgrade your gftp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered a\nformat string vulnerability in bidwatcher, a tool for watching and\nbidding on eBay auctions. This problem can be triggered remotely by a\nweb server of eBay, or someone pretending to be eBay, sending certain\ndata back. As of version 1.3.17 the program uses cURL and is not\nvulnerable anymore.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.3.3-1woody1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your bidwatcher package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUpstream developers have discovered several problems in squid, the\nInternet object cache, the popular WWW proxy cache. A remote attacker\ncan cause squid to crash via certain DNS responses.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.4.6-2woody7.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.5.8-3.
\nWe recommend that you upgrade your squid package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGraham Dumpleton discovered a flaw which can affect anyone using the\npublisher handle of the Apache Software Foundation's mod_python. The\npublisher handle lets you publish objects inside modules to make them\ncallable via URL. The flaw allows a carefully crafted URL to obtain\nextra information that should not be visible (information leak).
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.7.8-0.0woody5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.7.10-4 of libapache-mod-python and in version 3.1.3-3 of\nlibapache2-mod-python.
\nWe recommend that you upgrade your libapache-mod-python package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBastian Blank discovered a vulnerability in bsmtpd, a batched SMTP mailer for\nsendmail and postfix. Unsanitised addresses can cause the execution\nof arbitrary commands during alleged mail delivery.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.3pl8b-12woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3pl8b-16.
\nWe recommend that you upgrade your bsmtpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in abuse, the SDL port of\nthe Abuse action game. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nErik Sj\u00f6lund discovered several buffer overflows in the command line\n handling, which could lead to the execution of arbitrary code with\n elevated privileges since it is installed setuid root.
\nSteve Kemp discovered that abuse creates some files without\n dropping privileges first, which may lead to the creation and\n overwriting of arbitrary files.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.00+-3woody4.
\nThe unstable distribution (sid) does not contain an abuse package anymore.
\nWe recommend that you upgrade your abuse package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe KDE team fixed a bug in kppp in 2002 which was now discovered to be\nexploitable by iDEFENSE. By opening a sufficiently large number of\nfile descriptors before executing kppp which is installed setuid root a\nlocal attacker is able to take over privileged file descriptors.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-14.7.
\nThe testing (sarge) and unstable (sid) distributions are not affected\nsince KDE 3.2 already contained the correction.
\nWe recommend that you upgrade your kppp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKevin Finisterre discovered a buffer overflow in luxman, an SVGA based\nPacMan clone, that could lead to the execution of arbitrary commands\nas root.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.41-17.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.41-20.
\nWe recommend that you upgrade your luxman package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in xloadimage, an image\nviewer for X11. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nTavis Ormandy of the Gentoo Linux Security Audit Team has reported\n a flaw in the handling of compressed images, where shell\n meta-characters are not adequately escaped.
\nInsufficient validation of image properties have been\n discovered which could potentially result in buffer management\n errors.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 4.1-10woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.1-14.2.
\nWe recommend that you upgrade your xloadimage package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in xli, an image viewer\nfor X11. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nA buffer overflow in the decoder for FACES format images could be\n exploited by an attacker to execute arbitrary code. This problem\n has already been fixed in xloadimage in\n DSA 069.
\nTavis Ormandy of the Gentoo Linux Security Audit Team has reported\n a flaw in the handling of compressed images, where shell\n meta-characters are not adequately escaped.
\nInsufficient validation of image properties in have been\n discovered which could potentially result in buffer management\n errors.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.17.0-11woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.17.0-18.
\nWe recommend that you upgrade your xli package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Szabo discovered another vulnerability in the File::Path::rmtree\nfunction of perl, the popular scripting language. When a process is\ndeleting a directory tree, a different user could exploit a race\ncondition to create setuid binaries in this directory tree, provided\nthat he already had write permissions in any subdirectory of that\ntree.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 5.6.1-8.9.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.8.4-8.
\nWe recommend that you upgrade your perl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGa\u00ebl Delalleau discovered a buffer overflow in the handling of\nthe LINEMODE suboptions in telnet clients. This can lead to the\nexecution of arbitrary code when connected to a malicious server.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.17-18woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.17-28.
\nWe recommend that you upgrade your telnet package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn unfixed buffer overflow has been discovered by Andrew V. Samoilov\nin mc, the midnight commander, a file browser and manager. This update\nalso fixes a regression from\nDSA 497.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.5.55-1.2woody6.
\nFor the unstable distribution (sid) this problem has already been fixed.
\nWe recommend that you upgrade your mc packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGa\u00ebl Delalleau discovered a buffer overflow in the handling of\nthe LINEMODE suboptions in telnet clients. This can lead to the\nexecution of arbitrary code when connected to a malicious server.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.17.17+0.1-2woody4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.17.24+0.1-8.
\nWe recommend that you upgrade your telnet-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered a\ncross-site scripting problem in mailreader, a simple, but powerful WWW\nmail reader system, when displaying messages of the MIME types\ntext/enriched or text/richtext.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.3.29-5woody2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3.29-11.
\nWe recommend that you upgrade your mailreader package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that the last security update for Samba, a\nLanManager like file and printer server for GNU/Linux and Unix-like\nsystems caused the daemon to crash upon reload. This has been fixed.\nFor reference below is the original advisory text:
\n\n\nGreg MacManus discovered an integer overflow in the smb daemon from\nSamba, a LanManager like file and printer server for GNU/Linux and\nUnix-like systems. Requesting a very large number of access control\ndescriptors from the server could exploit the integer overflow, which\nmay result in a buffer overflow which could lead to the execution of\narbitrary code with root privileges. Upstream developers have\ndiscovered more possible integer overflows that are fixed with this\nupdate as well.
\n
For the stable distribution (woody) these problems have been fixed in\nversion 2.2.3a-15.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.0.10-1.
\nWe recommend that you upgrade your samba packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in ImageMagick, a\ncommonly used image manipulation library. These problems can be\nexploited by a carefully crafted graphic image. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nTavis Ormandy discovered a format string vulnerability in the\n filename handling code which allows a remote attacker to cause a\n denial of service and possibly execute arbitrary code.
\nAndrei Nigmatulin discovered a denial of service condition which\n can be caused by an invalid tag in a TIFF image.
\nAndrei Nigmatulin discovered that the TIFF decoder is vulnerable\n to accessing memory out of bounds which will result in a\n segmentation fault.
\nAndrei Nigmatulin discovered a buffer overflow in the SGI parser\n which allows a remote attacker to execute arbitrary code via a\n specially crafted SGI image file.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 5.4.4.5-1woody6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 6.0.6.2-2.2.
\nWe recommend that you upgrade your imagemagick package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in telnet clients that could be\nexploited by malicious daemons the client connects to. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nGa\u00ebl Delalleau discovered a buffer overflow in the env_opt_add()\n function that allow a remote attacker to execute arbitrary code.
\nGa\u00ebl Delalleau discovered a buffer overflow in the handling of the\n LINEMODE suboptions in telnet clients. This can lead to the\n execution of arbitrary code when connected to a malicious server.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.2.4-5woody8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.6-1.
\nWe recommend that you upgrade your krb5 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJens Steube discovered several vulnerabilities in remstats, the remote\nstatistics system. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nWhen processing uptime data on the unix-server a temporary file is\n opened in an insecure fashion which could be used for a symlink\n attack to create or overwrite arbitrary files with the permissions\n of the remstats user.
\nThe remoteping service can be exploited to execute arbitrary\n commands due to missing input sanitising.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.00a4-8woody1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.13a-5.
\nWe recommend that you upgrade your remstats packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral denial of service conditions have been discovered in wu-ftpd,\nthe popular FTP daemon. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nAdam Zabrocki discovered a denial of service condition in wu-ftpd\n that could be exploited by a remote user and cause the server to\n slow down by resource exhaustion.
\nGeorgi Guninski discovered that /bin/ls may be called from within\n wu-ftpd in a way that will result in large memory consumption and\n hence slow down the server.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.6.2-3woody5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.6.2-19.
\nWe recommend that you upgrade your wu-ftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered a\nbuffer overflow in axel, a light download accelerator. When reading\nremote input the program did not check if a part of the input can\noverflow a buffer and maybe trigger the execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0a-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0b-1.
\nWe recommend that you upgrade your axel package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in MySQL, a popular\ndatabase. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nSergei Golubchik discovered a problem in the access handling for\n similar named databases. If a user is granted privileges to a\n database with a name containing an underscore (\"_\"), the user also\n gains privileges to other databases with similar names.
\nStefano Di Paola discovered that MySQL allows remote\n authenticated users with INSERT and DELETE privileges to execute\n arbitrary code by using CREATE FUNCTION to access libc calls.
\nStefano Di Paola discovered that MySQL allows remote authenticated\n users with INSERT and DELETE privileges to bypass library path\n restrictions and execute arbitrary libraries by using INSERT INTO\n to modify the mysql.func table.
\nStefano Di Paola discovered that MySQL uses predictable file names\n when creating temporary tables, which allows local users with\n CREATE TEMPORARY TABLE privileges to overwrite arbitrary files via\n a symlink attack.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 3.23.49-8.11.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.0.24-5 of mysql-dfsg and in version 4.1.10a-6 of\nmysql-dfsg-4.1.
\nWe recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn iDEFENSE researcher discovered two problems in the image processing\nfunctions of PHP, a server-side, HTML-embedded scripting language, of\nwhich one is present in PHP3 as well. When reading a JPEG image, PHP\ncan be tricked into an endless loop due to insufficient input\nvalidation.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.0.18-23.1woody3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.0.18-31.
\nWe recommend that you upgrade your php3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSylvain Defresne discovered a buffer overflow in libexif, a library\nthat parses EXIF files (such as JPEG files with extra tags). This bug\ncould be exploited to crash the application and maybe to execute\narbitrary code as well.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.5.0-1woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.6.9-5.
\nWe recommend that you upgrade your libexif package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlan Cox discovered a problem in gtkhtml, an HTML rendering widget\nused by the Evolution mail reader. Certain malformed messages could\ncause a crash due to a null pointer dereference.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.2-1.woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.4-6.2.
\nWe recommend that you upgrade your gtkhtml package and restart\nEvolution.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNicolas Gregoire discovered a cross-site scripting vulnerability in\ninfo2www, a converter for info files to HTML. A malicious person\ncould place a harmless looking link on the web that could cause\narbitrary commands to be executed in the browser of the victim user.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.2.2.9-20woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.2.9-23.
\nWe recommend that you upgrade your info2www package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTim Dijkstra discovered a problem during the upgrade of geneweb, a\ngenealogy software with web interface. The maintainer scripts\nautomatically converted files without checking their permissions and\ncontent, which could lead to the modification of arbitrary files.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.06-2woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.10-7.
\nWe recommend that you upgrade your geneweb package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral bugs have been found in junkbuster, a HTTP proxy and filter.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing vulnerabilities:
\nJames Ranson discovered that an attacker can modify the referrer\n setting with a carefully crafted URL by accidentally overwriting a\n global variable.
\nTavis Ormandy from the Gentoo Security Team discovered several\n heap corruptions due to inconsistent use of an internal function\n that can crash the daemon or possibly lead to the execution of\n arbitrary code.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.0.2-0.2woody1.
\nThe unstable distribution (sid) doesn't contain the junkbuster package\nanymore.
\nWe recommend that you upgrade your junkbuster package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKDE security team discovered several vulnerabilities in the PCX and\nother image file format readers in the KDE core libraries, some of\nthem exploitable to execute arbitrary code. To a small extent the\npackages in woody are affected as well.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.2.2-13.woody.14.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.3.2-5.
\nWe recommend that you upgrade your kdelibs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in the CVS server, which serves\nthe popular Concurrent Versions System. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMaks Polunin and Alberto Garcia discovered independently that\n using the pserver access method in connection with the repouid\n patch that Debian uses it is possible to bypass the password and\n gain access to the repository in question.
\nAlberto Garcia discovered that a remote user can cause the cvs\n server to crash when the cvs-repouids file exists but does not\n contain a mapping for the current repository, which can be used as\n a denial of service attack.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.11.1p1debian-10.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.12.9-11.
\nWe recommend that you upgrade your cvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that certain malformed SNAC packets sent by\nother AIM or ICQ users can trigger an infinite loop in Gaim, a\nmulti-protocol instant messaging client, and hence lead to a denial of\nservice of the client.
\nTwo more denial of service conditions have been discovered in newer\nversions of Gaim which are fixed in the package in sid but are not\npresent in the package in woody.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.58-2.5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.1.3-1.
\nWe recommend that you upgrade your gaim packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security relevant problems have been discovered in lsh, the\nalternative secure shell v2 (SSH2) protocol server. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nBennett Todd discovered a heap buffer overflow in lshd which could\n lead to the execution of arbitrary code.
\nNiels M\u00f6ller discovered a denial of service condition in lshd.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.2.5-2woody3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.1-2.
\nWe recommend that you upgrade your lsh-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n[\u00a0This version lists the correct packages in the packages\nsection.\u00a0]
\nA buffer overflow has been detected in the IAPP dissector of Ethereal,\na commonly used network traffic analyser. A remote attacker may be\nable to overflow a buffer using a specially crafted packet. More\nproblems have been discovered which don't apply to the version in\nwoody but are fixed in sid as well.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.9.4-1woody12.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.10.10-1.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral format string problems have been discovered in prozilla, a\nmulti-threaded download accelerator, that can be exploited by a\nmalicious server to execute arbitrary code with the rights of the user\nrunning prozilla.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.3.6-3woody2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.7.4-1.
\nWe recommend that you upgrade your prozilla package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJeroen van Wolffelaar noticed that the confirm add-on of SmartList,\nthe listmanager used on lists.debian.org, which is used on that host\nas well, could be tricked to subscribe arbitrary addresses to the\nlists.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.15-5.woody.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.15-18.
\nWe recommend that you upgrade your smartlist package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Bhola discovered a bug in Squid, the popular WWW proxy cache.\nSquid does not trigger a fatal error when it identifies missing or\ninvalid ACLs in the http_access configuration, which could lead to\nless restrictive ACLs than intended by the administrator.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 2.4.6-2woody8.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.5.9-7.
\nWe recommend that you upgrade your squid packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in Smail, an electronic mail\ntransport system, which allows remote attackers and local users to\nexecute arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 3.2.0.114-4woody1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.2.0.115-7.
\nWe recommend that you upgrade your smail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the Xpm library which is used\nin XFree86. A remote attacker could provide a specially crafted XPM\nimage that could lead to the execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.1.0-16woody6.
\nFor the unstable distribution (sid) this problem will be fixed in\nversion 4.3.0.dfsg.1-13, which is currently in preparation.
\nWe recommend that you upgrade your xfree86 and associated packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMaksymilian Arciemowicz discovered several cross site scripting issues\nin phpsysinfo, a PHP based host information application.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 2.0-3woody2.
\nFor the testing (sarge) and unstable (sid) distribution these problems\nhave been fixed in version 2.3-3.
\nWe recommend that you upgrade your phpsysinfo package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJens Steube discovered that ppxp, yet another PPP program, does not\nrelease root privileges when opening potentially user supplied log\nfiles. This can be tricked into opening a root shell.
\nFor the old stable distribution (woody) this problem has been\nfixed in version 0.2001080415-6woody2 (DSA 725-1).
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.2001080415-10sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.2001080415-11.
\nWe recommend that you upgrade your ppxp package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nA format string vulnerability has been discovered in the MySQL/PgSQL\nauthentication module of Oops, a caching HTTP proxy server written\nfor performance.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.5.19.cvs.20010818-0.1woody1
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your oops package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMark Martinec and Robert Lewis discovered a buffer overflow in\nConvert::UUlib, a Perl interface to the uulib library, which may\nresult in the execution of arbitrary code.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 0.201-2woody1.
\nFor the testing (sarge) and unstable (sid) distributions this problem\nhas been fixed in version 1.0.5.1-1.
\nWe recommend that you upgrade your libconvert-uulib-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis advisory does only cover updated packages for Debian 3.0\nalias woody. For reference below is the original advisory text:
\n\n\nTwo bugs have been discovered in qpopper, an enhanced Post Office\nProtocol (POP3) server. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\n\n
\n- CAN-2005-1151\n
Jens Steube discovered that while processing local files owned or\n provided by a normal user privileges weren't dropped, which could\n lead to the overwriting or creation of arbitrary files as root.
\n- CAN-2005-1152\n
The upstream developers noticed that qpopper could be tricked to\n creating group- or world-writable files.
\n
For the stable distribution (woody) these problems have been fixed in\nversion 4.0.4-2.woody.5.
\nFor the testing distribution (sarge) these problems have been fixed in\nversion 4.0.5-4sarge1.
\nFor the unstable distribution (sid) these problems will be fixed in\nversion 4.0.5-4sarge1.
\nWe recommend that you upgrade your qpopper package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nAn iDEFENSE researcher discovered two problems in the image processing\nfunctions of PHP, a server-side, HTML-embedded scripting language, of\nwhich one is present in woody as well. When reading a JPEG image, PHP\ncan be tricked into an endless loop due to insufficient input\nvalidation.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 4.1.2-7.woody4.
\nFor the testing distribution (sarge) these problems have been fixed in\nversion 4.3.10-10.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.3.10-10.
\nWe recommend that you upgrade your php4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nImran Ghory discovered a race condition in bzip2, a high-quality\nblock-sorting file compressor and decompressor. When decompressing a\nfile in a directory an attacker has access to, bunzip2 could be\ntricked to set the file permissions to a different file the user has\npermissions to.
\nFor the stable distribution (woody) this problem has been fixed in\nversion 1.0.2-1.woody2.
\nFor the testing distribution (sarge) this problem has been fixed in\nversion 1.0.2-6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.2-6.
\nWe recommend that you upgrade your bzip2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in telnet clients that could be\nexploited by malicious daemons the client connects to. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nGa\u00ebl Delalleau discovered a buffer overflow in the env_opt_add()\n function that allow a remote attacker to execute arbitrary code.
\nGa\u00ebl Delalleau discovered a buffer overflow in the handling of the\n LINEMODE suboptions in telnet clients. This can lead to the\n execution of arbitrary code when connected to a malicious server.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 1.1-8-2.4.
\nFor the testing distribution (sarge) these problems have been fixed in\nversion 1.2.2-11.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.2.2-11.2.
\nWe recommend that you upgrade your krb4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered several vulnerabilities in the GNU mailutils\npackage which contains utilities for handling mail. These problems\ncan lead to a denial of service or the execution of arbitrary code.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing vulnerabilities.
\nBuffer overflow mail header handling may allow a remote attacker\n to execute commands with the privileges of the targeted user.
\nCombined integer and heap overflow in the fetch routine can lead\n to the execution of arbitrary code.
\nDenial of service in the fetch routine.
\nFormat string vulnerability can lead to the execution of arbitrary\n code.
\nFor the stable distribution (woody) these problems have been fixed in\nversion 20020409-1woody2.
\nFor the testing distribution (sarge) these problems have been fixed in\nversion 0.6.1-4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.6.1-4.
\nWe recommend that you upgrade your mailutils packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJustin Rye discovered that crip, a terminal-based ripper, encoder and\ntagger tool, utilises temporary files in an insecure fashion in its\nhelper scripts.
\nThe old stable distribution (woody) does not provide the crip package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.5-1sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.5-1sarge2.
\nWe recommend that you upgrade your crip package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo denial of service problems have been discovered in Gaim, a\nmulti-protocol instant messaging client. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nA malformed Yahoo filename can result in a crash of the application.
\nA malformed MSN message can lead to incorrect memory allocation\n resulting in a crash of the application.
\nThe old stable distribution (woody) does not seem to be affected.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.2.1-1.3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.1-1.
\nWe recommend that you upgrade your gaim package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA local user who has been granted permission to run commands via sudo\ncould run arbitrary commands as a privileged user due to a flaw in\nsudo's pathname validation. This bug only affects configurations which\nhave restricted user configurations prior to an ALL directive in the\nconfiguration file. A workaround is to move any ALL directives to the\nbeginning of the sudoers file; see the advisory at\nhttp://www.sudo.ws/sudo/alerts/path_race.html for more information.
\nFor the old stable Debian distribution (woody), this problem has been\nfixed in version 1.6.6-1.3woody1.
\nFor the current stable distribution\n(sarge), this problem has been fixed in version 1.6.8p7-1.1sarge1.
\nNote that packages are not yet ready for certain architectures; these\nwill be released as they become available.
\nWe recommend that you upgrade your sudo package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was recently found in the way that SpamAssassin parses\ncertain email headers. This vulnerability could cause SpamAssassin to\nconsume a large number of CPU cycles when processing messages containing\nthese headers, leading to a potential denial of service (DOS) attack.
\nThe version of SpamAssassin in the old stable distribution (woody) is\nnot vulnerable.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 3.0.3-2. Note that packages are not yet ready for certain\narchitectures; these will be released as they become available.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.0.4-1.
\nWe recommend that you upgrade your sarge or sid spamassassin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA number of potential remote denial of service vulnerabilities have been identified in\nClamAV. In addition to the four issues identified by CVE ID above, there\nare fixes for issues in libclamav/cvd.c and libclamav/message.c.\nTogether, these issues could allow a carefully crafted message to crash\na ClamAV scanner or exhaust various resources on the machine running the\nscanner.
\nFor the stable distribution (sarge), these problems have been fixed in\nversion 0.84-2.sarge.1.
\nWe recommend that you upgrade your clamav package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in the way that Razor parses certain\nemail headers that could potentially be used to crash the Razor program,\ncausing a denial of service.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 2.670-1sarge2.
\nThe old stable distribution (woody) is not affected by this issue.
\nWe recommend that you upgrade your razor package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Esser discovered an input validation flaw within Trac, a wiki\nand issue tracking system, that allows download/upload of files and\ntherefore can lead to remote code execution in some configurations.
\nThe old stable distribution (woody) does not contain the trac package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.8.1-3sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.8.4-1.
\nWe recommend that you upgrade your trac package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn error in the way zlib handles the inflation of certain compressed\nfiles can cause a program which uses zlib to crash when opening an\ninvalid file.
\nThis problem does not affect the old stable distribution (woody).
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 1.2.2-4.sarge.1.
\nFor the unstable distribution, this problem has been fixed in version\n1.2.2-7.
\nWe recommend that you upgrade your zlib package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered that a specially crafted archive can trigger an\ninfinite loop in bzip2, a high-quality block-sorting file compressor.\nDuring uncompression this results in an indefinitely growing output\nfile which will finally fill up the disk. On systems that\nautomatically decompress bzip2 archives this can cause a denial of\nservice.
\nFor the oldstable distribution (woody) this problem has been fixed in\nversion 1.0.2-1.woody5.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.2-7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.2-7.
\nWe recommend that you upgrade your bzip2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDerek Price, the current maintainer of CVS, discovered a buffer\noverflow in the CVS server, that serves the popular Concurrent\nVersions System, which could lead to the execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.11.1p1debian-12.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.12.9-13.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.12.9-13.
\nWe recommend that you upgrade your cvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in ht, a viewer, editor and\nanalyser for various executables, that may lead to the execution of\narbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nTavis Ormandy of the Gentoo Linux Security Team discovered an\n integer overflow in the ELF parser.
\nThe authors have discovered a buffer overflow in the PE parser.
\nFor the old stable distribution (woody) these problems have been fixed\nin version 0.5.0-1woody4. For the HP Precision architecture, you are\nadvised not to use this package anymore since we cannot provide\nupdated packages as it doesn't compile anymore.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8.0-2sarge4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.8.0-3.
\nWe recommend that you upgrade your ht package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSven Tantau discovered a security problem in fuse, a filesystem in\nuserspace, that can be exploited by malicious, local users to disclose\npotentially sensitive information.
\nThe old stable distribution (woody) does not contain the fuse package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.1-4sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3.0-1.
\nWe recommend that you upgrade your fuse package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo input validation errors were discovered in drupal and its bundled\nxmlrpc module. These errors can lead to the execution of arbitrary\ncommands on the web server running drupal.
\ndrupal was not included in the old stable distribution (woody).
\nFor the current stable distribution (sarge), these problems have been\nfixed in version 4.5.3-3.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.5.4-1.
\nWe recommend that you upgrade your drupal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability had been identified in the xmlrpc library included with\nphpgroupware, a web-based application including email, calendar and\nother groupware functionality. This vulnerability could lead to the\nexecution of arbitrary commands on the server running phpgroupware.
\nThe security team is continuing to investigate the version of\nphpgroupware included with the old stable distribution (woody). At this\ntime we recommend disabling phpgroupware or upgrading to the current\nstable distribution (sarge).
\nFor the current stable distribution (sarge) this problem has been fixed\nin version 0.9.16.005-3.sarge0.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.16.006-1.
\nWe recommend that you upgrade your phpgroupware package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been identified in the xmlrpc library included in\nthe egroupware package. This vulnerability could lead to the execution\nof arbitrary commands on the server running egroupware.
\nThe old stable distribution (woody) did not include egroupware.
\nFor the current stable distribution (sarge), this problem is fixed in\nversion 1.0.0.007-2.dfsg-2sarge1.
\nFor the unstable distribution (sid), this problem is fixed in version\n1.0.0.007-3.dfsg-1.
\nWe recommend that you upgrade your egroupware package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in ruby1.8 that could allow arbitrary\ncommand execution on a server running the ruby xmlrpc server.
\nThe old stable distribution (woody) did not include ruby1.8.
\nThis problem is fixed for the current stable distribution (sarge) in\nversion 1.8.2-7sarge1.
\nThis problem is fixed for the unstable distribution in version 1.8.2-8.
\nWe recommend that you upgrade your ruby1.8 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in the ettercap package which could allow\na remote attacker to execute arbitrary code on the system running\nettercap.
\nThe old stable distribution (woody) did not include ettercap.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 0.7.1-1sarge1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.7.3-1.
\nWe recommend that you upgrade your ettercap package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous42md\" discovered that dhcpcd, a DHCP client for automatically\nconfiguring IPv4 networking, can be tricked into reading past the end\nof the supplied DHCP buffer which could lead to the daemon crashing.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.3.22pl4-21sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.22pl4-22.
\nWe recommend that you upgrade your dhcpcd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe upstream developers have discovered a bug in the DNS lookup code\nof Squid, the popular WWW proxy cache. When the DNS client UDP port\n(assigned by the operating system at startup) is unfiltered and the\nnetwork is not protected from IP spoofing, malicious users can spoof\nDNS lookups which could result in users being redirected to arbitrary\nweb sites.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.4.6-2woody9.
\nFor the stable distribution (sarge) this problem has already been\nfixed in version 2.5.9-9.
\nFor the unstable distribution (sid) this problem has already been\nfixed in version 2.5.9-9.
\nWe recommend that you upgrade your squid package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo problems have been discovered in gzip, the GNU compression\nutility. The Common Vulnerabilities and Exposures project identifies\nthe following problems.
\nImran Ghory discovered a race condition in the permissions setting\n code in gzip. When decompressing a file in a directory an\n attacker has access to, gunzip could be tricked to set the file\n permissions to a different file the user has permissions to.
\nUlf H\u00e4rnhammar discovered a path traversal vulnerability in\n gunzip. When gunzip is used with the -N option an attacker could\n use\n this vulnerability to create files in an arbitrary directory with\n the permissions of the user.
\nFor the oldstable distribution (woody) these problems have been fixed in\nversion 1.3.2-3woody5.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.3.5-10.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.5-10.
\nWe recommend that you upgrade your gzip package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA format string vulnerability has been discovered in gedit, a\nlight-weight text editor for GNOME, that may allow attackers to cause\na denial of service (application crash) via a binary file with format\nstring specifiers in the filename. Since gedit supports opening files\nvia \"http://\" URLs (through GNOME vfs) and other schemes, this might\nbe a remotely exploitable vulnerability.
\nThe old stable distribution (woody) is not vulnerable to this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.8.3-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.10.3-1.
\nWe recommend that you upgrade your gedit package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEric Romang discovered that centericq, a text-mode multi-protocol\ninstant messenger client, creates some temporary files with\npredictable filenames and is hence vulnerable to symlink attacks by\nlocal attackers.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.20.0-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.20.0-7.
\nWe recommend that you upgrade your centericq package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFrank Warmerdam discovered a stack-based buffer overflow in libtiff,\nthe Tag Image File Format library for processing TIFF graphics files\nthat can lead to the execution of arbitrary code via malformed TIFF\nfiles.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 3.5.5-7.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.7.2-3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.7.2-3.
\nWe recommend that you upgrade your libtiff packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Squirrelmail, a\ncommonly used webmail system. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMartijn Brinkers discovered cross-site scripting vulnerabilities\n that allow remote attackers to inject arbitrary web script or HTML\n in the URL and e-mail messages.
\nJames Bercegay of GulfTech Security discovered a vulnerability in\n the variable handling which could lead to attackers altering other\n people's preferences and possibly reading them, writing files at\n any location writable for www-data and cross site scripting.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 1.2.6-4.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.4.4-6sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.4.4-6sarge1.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDaniel Wachdorf reported two problems in the MIT krb5 distribution used\nfor network authentication. First, the KDC program from the krb5-kdc\npackage can corrupt the heap by trying to free memory which has already\nbeen freed on receipt of a certain TCP connection. This vulnerability\ncan cause the KDC to crash, leading to a denial of service.\n[CAN-2005-1174] Second, under certain rare circumstances this type of\nrequest can lead to a buffer overflow and remote code execution.\n[CAN-2005-1175]
\nAdditionally, Magnus Hagander reported another problem in which the\nkrb5_recvauth function can in certain circumstances free previously\nfreed memory, potentially leading to the execution of remote code.\n[CAN-2005-1689]
\nAll of these vulnerabilities are believed difficult to exploit, and no\nexploits have yet been discovered.
\nFor the old stable distribution (woody), these problems have been fixed\nin version 1.2.4-5woody10. Note that woody's KDC does not have TCP\nsupport and is not vulnerable to CAN-2005-1174.
\nFor the stable distribution (sarge), these problems have been fixed in\nversion 1.3.6-2sarge2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.3.6-4.
\nWe recommend that you upgrade your krb5 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the telnet server from\nHeimdal, a free implementation of Kerberos 5, that could lead to the\nexecution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.4e-7.woody.10.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.6.3-10sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.6.3-11.
\nWe recommend that you upgrade your heimdal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in phppgadmin, a set of PHP\nscripts to administrate PostgreSQL over the WWW, that can lead to\ndisclose sensitive information. Successful exploitation requires that\n\"magic_quotes_gpc\" is disabled.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.5.2-5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.5.4.
\nWe recommend that you upgrade your phppgadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in ekg, a console Gadu\nGadu client, an instant messaging program. The Common Vulnerabilities\nand Exposures project identifies the following vulnerabilities:
\nMarcin Owsiany and Wojtek Kaniewski discovered insecure temporary\n file creation in contributed scripts.
\nMarcin Owsiany and Wojtek Kaniewski discovered potential shell\n command injection in a contributed script.
\nEric Romang discovered insecure temporary file creation and\n arbitrary command execution in a contributed script that can be\n exploited by a local attacker.
\nThe old stable distribution (woody) does not contain an ekg package.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.5+20050411-4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5+20050712+1.6rc2-1.
\nWe recommend that you upgrade your ekg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe security update DSA 761-1 for heartbeat contained a bug which caused a\nregression. \u00a0This problem is corrected with this advisory. \u00a0For\ncompleteness below please find the original advisory text:
\n\n\nEric Romang discovered several insecure temporary file creations in\nheartbeat, the subsystem for High-Availability Linux.
\n
For the old stable distribution (woody) these problems have been fixed in\nversion 0.4.9.0l-7.3.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.2.3-9sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.2.3-12.
\nWe recommend that you upgrade your heartbeat package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nKevin Finisterre discovered two problems in the Bluetooth FTP client\nfrom affix, user space utilities for the Affix Bluetooth protocol\nstack. The Common Vulnerabilities and Exposures project identifies\nthe following vulnerabilities:
\nA buffer overflow allows remote attackers to execute arbitrary\n code via a long filename in an OBEX file share.
\nMissing input sanitising before executing shell commands allow an\n attacker to execute arbitrary commands as root.
\nThe old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.1.1-2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.1.2-2.
\nWe recommend that you upgrade your affix package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarkus Oberhumer discovered a flaw in the way zlib, a library used for\nfile compression and decompression, handles invalid input. This flaw can\ncause programs which use zlib to crash when opening an invalid file.
\nThis problem does not affect the old stable distribution (woody).
\nFor the current stable distribution (sarge), this problem has been fixed\nin version 1.2.2-4.sarge.2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.2.3-1.
\nWe recommend that you upgrade your zlib package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in cacti, a round-robin\ndatabase (RRD) tool that helps create graphs from database\ninformation. The Common Vulnerabilities and Exposures Project\nidentifies the following problems:
\nMaciej Piotr Falkiewicz and an anonymous researcher discovered an\n input validation bug that allows an attacker to include arbitrary\n PHP code from remote sites which will allow the execution of\n arbitrary code on the server running cacti.
\nDue to missing input validation cacti allows a remote attacker to\n insert arbitrary SQL statements.
\nMaciej Piotr Falkiewicz discovered an input validation bug that\n allows an attacker to include arbitrary PHP code from remote sites\n which will allow the execution of arbitrary code on the server\n running cacti.
\nStefan Esser discovered that the update for the above mentioned\n vulnerabilities does not perform proper input validation to\n protect against common attacks.
\nStefan Esser discovered that the update for CAN-2005-1525 allows\n remote attackers to modify session information to gain privileges\n and disable the use of addslashes to protect against SQL\n injection.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 0.6.7-2.5.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8.6c-7sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.8.6f-2.
\nWe recommend that you upgrade your cacti package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGa\u00ebl Delalleau discovered a buffer overflow in the handling of the\nLINEMODE suboptions in telnet clients. Heimdal, a free implementation\nof Kerberos 5, also contains such a client. This can lead to the\nexecution of arbitrary code when connected to a malicious server.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.4e-7.woody.11.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.6.3-10.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.6.3-10.
\nWe recommend that you upgrade your heimdal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in webcalendar, a PHP based\nmulti-user calendar, that can lead to the disclosure of sensitive\ninformation to unauthorised parties.
\nThe old stable distribution (woody) does not contain the webcalendar package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.45-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.45-6.
\nWe recommend that you upgrade your webcalendar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcin Slusarz discovered two integer overflow vulnerabilities in\nlibgadu, a library provided and used by ekg, a console Gadu Gadu\nclient, an instant messaging program, that could lead to the execution\nof arbitrary code.
\nThe library is also used by other packages such as kopete, which\nshould be restarted to take effect of this update.
\nThe old stable distribution (woody) does not contain an ekg package.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.5+20050411-5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5+20050718+1.6rc3-1.
\nWe recommend that you upgrade your ekg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA cross-site scripting vulnerability has been detected in phpBB2, a\nfully featured and skinnable flat webforum software, that allows\nremote attackers to inject arbitrary web script or HTML via nested\ntags.
\nThe old stable distribution (woody) does not contain phpbb2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.13-6sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.13-6sarge1.
\nWe recommend that you upgrade your phpbb2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSzymon Zygmunt and Michal Bartoszkiewicz discovered a memory alignment\nerror in libgadu (from ekg, console Gadu Gadu client, an instant\nmessaging program) which is included in gaim, a multi-protocol instant\nmessaging client, as well. This can not be exploited on the x86\narchitecture but on others, e.g. on Sparc and lead to a bus error,\nin other words a denial of service.
\nThe old stable distribution (woody) does not seem to be affected by\nthis problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2.1-1.4.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your gaim package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJohn Goerzen discovered that gopher, a client for the Gopher\nDistributed Hypertext protocol, creates temporary files in an insecure\nfashion.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 3.0.3woody3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.0.7sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.0.9.
\nWe recommend that you upgrade your gopher package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in pdns, a versatile nameserver\nthat can lead to a denial of service. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nNorbert Sendetzky and Jan de Groot discovered that the LDAP backend\n did not properly escape all queries, allowing it to fail and not\n answer queries anymore.
\nWilco Baan discovered that queries from clients without recursion\n permission can temporarily blank out domains to clients with\n recursion permitted. This enables outside users to blank out a\n domain temporarily to normal users.
\nThe old stable distribution (woody) does not contain pdns packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.9.17-13sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.9.18-1.
\nWe recommend that you upgrade your pdns package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEduard Bloch discovered a bug in apt-cacher, a caching system for\nDebian package and source files, that could allow remote attackers to\nexecute arbitrary commands on the caching host as user www-data.
\nThe old stable distribution (woody) does not contain this package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.10.
\nWe recommend that you upgrade your apt-cacher package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis advisory adds security support for the stable amd64 distribution.\nIt covers all security updates since the release of sarge, which were\nmissing updated packages for the not yet official amd64 port. Future\nsecurity advisories will include updates for this port as well.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEdward Shornock discovered a bug in the UIDL handling code of\nfetchmail, a common POP3, APOP and IMAP mail fetching utility. A\nmalicious POP3 server could exploit this problem and inject arbitrary\ncode that will be executed on the victim host. If fetchmail is\nrunning as root, this becomes a root exploit.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6.2.5-12sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.2.5-16.
\nWe recommend that you upgrade your fetchmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in Mozilla and Mozilla Firefox\nthat allows remote attackers to inject arbitrary Javascript from one\npage into the frameset of another site. Thunderbird is not affected\nby this and Galeon will be automatically fixed as it uses Mozilla\ncomponents.
\nThe old stable distribution (woody) does not contain Mozilla Firefox\npackages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.4-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.6-1.
\nWe recommend that you upgrade your mozilla-firefox package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral bugs were discovered in Clam AntiVirus, the antivirus scanner\nfor Unix, designed for integration with mail servers to perform\nattachment scanning. The following problems were identified:
\nNeel Mehta and Alex Wheeler discovered that Clam AntiVirus is\n vulnerable to integer overflows when handling the TNEF, CHM and\n FSG file formats.
\nMark Pizzolato fixed a possible infinite loop that could cause a\n denial of service.
\nThe old stable distribution (woody) is not affected as it doesn't contain clamav.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.86.2-1.
\nWe recommend that you upgrade your clamav package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in Mozilla and Mozilla Firefox\nthat allows remote attackers to inject arbitrary Javascript from one\npage into the frameset of another site. Thunderbird is not affected\nby this and Galeon will be automatically fixed as it uses Mozilla\ncomponents.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.7.8-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.7.10-1.
\nWe recommend that you upgrade your Mozilla package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo security related problems have been discovered in Mantis, a\nweb-based bug tracking system. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nA remote attacker could supply a specially crafted URL to scan\n arbitrary ports on arbitrary hosts that may not be accessible\n otherwise.
\nA remote attacker was able to insert arbitrary HTML code in bug\n reports, hence, cross site scripting.
\nA remote attacker was able to insert arbitrary HTML code in bug\n reports, hence, cross site scripting.
\nThe old stable distribution (woody) does not seem to be affected by\nthese problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.19.2-4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.19.2-4.
\nWe recommend that you upgrade your mantis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nWe experienced that the update for Mozilla Firefox from DSA 779-1\nunfortunately was a regression in several cases. \u00a0Since the usual\npraxis of backporting apparently does not work, this update is\nbasically version 1.0.6 with the version number rolled back, and hence\nstill named 1.0.4-*. \u00a0For completeness below is the original advisory\ntext:
\n\n\nSeveral problems have been discovered in Mozilla Firefox, a\nlightweight web browser based on Mozilla. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\n\n
\n- CAN-2005-2260\n
The browser user interface does not properly distinguish between\n user-generated events and untrusted synthetic events, which makes\n it easier for remote attackers to perform dangerous actions that\n normally could only be performed manually by the user.
\n- CAN-2005-2261\n
XML scripts ran even when Javascript disabled.
\n- CAN-2005-2262\n
The user can be tricked to executing arbitrary JavaScript code by\n using a JavaScript URL as wallpaper.
\n- CAN-2005-2263\n
It is possible for a remote attacker to execute a callback\n function in the context of another domain (i.e. frame).
\n- CAN-2005-2264\n
By opening a malicious link in the sidebar it is possible for\n remote attackers to steal sensitive information.
\n- CAN-2005-2265\n
Missing input sanitising of InstallVersion.compareTo() can cause\n the application to crash.
\n- CAN-2005-2266\n
Remote attackers could steal sensitive information such as cookies\n and passwords from web sites by accessing data in alien frames.
\n- CAN-2005-2267\n
By using standalone applications such as Flash and QuickTime to\n open a javascript: URL, it is possible for a remote attacker to\n steal sensitive information and possibly execute arbitrary code.
\n- CAN-2005-2268\n
It is possible for a Javascript dialog box to spoof a dialog box\n from a trusted site and facilitates phishing attacks.
\n- CAN-2005-2269\n
Remote attackers could modify certain tag properties of DOM nodes\n that could lead to the execution of arbitrary script or code.
\n- CAN-2005-2270\n
The Mozilla browser family does not properly clone base objects,\n which allows remote attackers to execute arbitrary code.
\n
The old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.6-1.
\nWe recommend that you upgrade your Mozilla Firefox packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nA bug has been discovered in the font handling code in xpdf, which is\nalso present in kpdf, the PDF viewer for KDE. A specially crafted PDF\nfile could cause infinite resource consumption, in terms of both CPU\nand disk space.
\nThe oldstable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.3.2-2sarge1.
\nFor the unstable distribution (sid) this problem will be fixed as soon\nas the necessary libraries have made their C++ ABI transition.
\nWe recommend that you upgrade your kpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in Mozilla Thunderbird, the\nstandalone mail client of the Mozilla suite. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nRemote attackers could read portions of heap memory into a\n Javascript string via the lambda replace method.
\nThe Javascript interpreter could be tricked to continue execution\n at the wrong memory address, which may allow attackers to cause a\n denial of service (application crash) and possibly execute\n arbitrary code.
\nRemote attackers could override certain properties or methods of\n DOM nodes and gain privileges.
\nRemote attackers could override certain properties or methods due\n to missing proper limitation of Javascript eval and Script objects\n and gain privileges.
\nXML scripts ran even when Javascript disabled.
\nMissing input sanitising of InstallVersion.compareTo() can cause\n the application to crash.
\nRemote attackers could steal sensitive information such as cookies\n and passwords from web sites by accessing data in alien frames.
\nRemote attackers could modify certain tag properties of DOM nodes\n that could lead to the execution of arbitrary script or code.
\nThe Mozilla browser family does not properly clone base objects,\n which allows remote attackers to execute arbitrary code.
\nThe old stable distribution (woody) is not affected by these problems\nsince it does not contain Mozilla Thunderbird packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.0.2-2.sarge1.0.6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.6-1.
\nWe recommend that you upgrade your Mozilla Thunderbird package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHenryk Pl\u00f6tz discovered a vulnerability in bluez-utils, tools and\ndaemons for Bluetooth. Due to missing input sanitising it is possible\nfor an attacker to execute arbitrary commands supplied as device name\nfrom the remote device.
\nThe old stable distribution (woody) is not affected by this problem\nsince it doesn't contain bluez-utils packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.15-1.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.19-1.
\nWe recommend that you upgrade your bluez-utils package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEric Romang discovered a temporary file vulnerability in a script\naccompanied with MySQL, a popular database, that allows an attacker to\nexecute arbitrary SQL commands when the server is installed or\nupdated.
\nThe old stable distribution (woody) as well as mysql-dfsg are not\naffected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.1.11a-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.1.12 for mysql-dfsg-4.1 and 5.0.11beta-3 of mysql-dfsg-5.0.
\nWe recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in the Courier Mail Server. DNS\nfailures were not handled properly when looking up Sender Policy\nFramework (SPF) records, which could allow attackers to cause memory\ncorruption. The default configuration on Debian has SPF checking\ndisabled, so most machines are not vulnerable. This is explained in\nthe \"courier\" manpage, section SENDER POLICY FRAMEWORK KEYWORDS.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.47-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.47-6.
\nWe recommend that you upgrade your courier-mta package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that libpam-ldap, the Pluggable Authentication\nModule allowing LDAP interfaces, ignores the result of an attempt to\nauthenticate against an LDAP server that does not set an optional data\nfield.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 178-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 178-1sarge1.
\nWe recommend that you upgrade your libpam-ldap package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered a\nformat string vulnerability in simpleproxy, a simple TCP proxy, that\ncan be exploited via replies from remote HTTP proxies.
\nThe old stable distribution (woody) is not affected.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.2-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.2-4.
\nWe recommend that you upgrade your simpleproxy package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo bugs have been found in backup-manager, a command-line driven\nbackup utility. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nJeroen Vermeulen discovered that backup files are created with\n default permissions making them world readable, even though they\n may contain sensitive information.
\nSven Joachim discovered that the optional CD-burning feature of\n backup-manager uses a hardcoded filename in a world-writable\n directory for logging. This can be subject to a symlink attack.
\nThe old stable distribution (woody) does not provide the\nbackup-manager package.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.5.7-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.5.8-2.
\nWe recommend that you upgrade your backup-manager package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in kismet, a\nwireless 802.11b monitoring tool. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nInsecure handling of unprintable characters in the SSID.
\nMultiple integer underflows could allow remote attackers to\n execute arbitrary code.
\nThe old stable distribution (woody) does not seem to be affected by\nthese problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2005.04.R1-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2005.08.R1-1.
\nWe recommend that you upgrade your kismet package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been found in PHP4, the\nserver-side, HTML-embedded scripting language. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nEric Romang discovered insecure temporary files in the shtool\n utility shipped with PHP that can exploited by a local attacker to\n overwrite arbitrary files. Only this vulnerability affects\n packages in oldstable.
\nGulfTech has discovered that PEAR XML_RPC is vulnerable to a\n remote PHP code execution vulnerability that may allow an attacker\n to compromise a vulnerable server.
\nStefan Esser discovered another vulnerability in the XML-RPC\n libraries that allows injection of arbitrary PHP code into eval()\n statements.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 4.1.2-7.woody5.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 4.3.10-16.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.4.0-2.
\nWe recommend that you upgrade your PHP packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlexander Gerasiov discovered that phpldapadmin, a web based interface\nfor administering LDAP servers, allows anybody to access the LDAP\nserver anonymously, even if this is disabled in the configuration with\nthe \"disable_anon_bind\" statement.
\nThe old stable distribution (woody) is not vulnerable to this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.5-3sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.6c-5.
\nWe recommend that you upgrade your phpldapadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered that the lockmail program from maildrop, a\nsimple mail delivery agent with filtering abilities, does not drop\ngroup privileges before executing commands given on the commandline,\nallowing an attacker to execute arbitrary commands with privileges of\nthe group mail.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.5.3-1.1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.5.3-2.
\nWe recommend that you upgrade your maildrop package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered that pstotext, a utility to extract text from\nPostScript and PDF files, did not execute ghostscript with the -dSAFER\nargument, which prevents potential malicious operations to happen.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.8g-5woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.9-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.9-2.
\nWe recommend that you upgrade your pstotext package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJakob Balle discovered a vulnerability in the handling of attachments\nin sqwebmail, a web mail application provided by the courier mail\nsuite, which can be exploited by an attacker to conduct script\ninsertion attacks.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.37.3-2.6.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.47-4sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.47-8.
\nWe recommend that you upgrade your sqwebmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJustin Rye noticed that polygen generates precompiled grammar objects\nworld-writable, which can be exploited by a local attacker to at least\nfill up the filesystem.
\nThe old stable distribution (woody) does not contain the polygen package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.6-7sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.6-9.
\nWe recommend that you upgrade your polygen package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\ninfamous42md reported that proftpd suffers from two format string\nvulnerabilities. In the first, a user with the ability to create a\ndirectory could trigger the format string error if there is a\nproftpd shutdown message configured to use the \"%C\", \"%R\", or \"%U\"\nvariables. In the second, the error is triggered if mod_sql is used\nto retrieve messages from a database and if format strings have been\ninserted into the database by a user with permission to do so.
\nThe old stable distribution (woody) is not affected by these\nvulnerabilities.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2.10-15sarge1. There was an error in the packages originally\nprepared for i386, which was corrected in 1.2.10-15sarge1.0.1 for i386.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.10-20.
\nWe recommend that you upgrade your proftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nKevin Finisterre reports that affix, a package used to manage\nbluetooth sessions under Linux, uses the popen call in an unsafe\nfashion. A remote attacker can exploit this vulnerability to execute\narbitrary commands on a vulnerable system.
\nThe old stable distribution (woody) does not contain the affix\npackage.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.1.1-3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.1.2-3.
\nWe recommend that you upgrade your affix package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nzsync, a file transfer program, includes a modified local copy of\nthe zlib library, and is vulnerable to certain bugs fixed previously\nin the zlib package.
\nThere was a build error for the sarge i386 proftpd packages released in\nDSA 797-1. A new build, zsync_0.3.3-1.sarge.1.2, has been prepared to\ncorrect this error. The packages for other architectures are unaffected.
\nThe old stable distribution (woody) does not contain the zsync\npackage.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.3.3-1.sarge.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.4.0-2.
\nWe recommend that you upgrade your zsync package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in phpgroupware, a web\nbased groupware system written in PHP. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nStefan Esser discovered another vulnerability in the XML-RPC\n libraries that allows injection of arbitrary PHP code into eval()\n statements. The XMLRPC component has been disabled.
\nAlexander Heidenreich discovered a cross-site scripting problem\n in the tree view of FUD Forum Bulletin Board Software, which is\n also present in phpgroupware.
\nA global cross-site scripting fix has also been included that\n protects against potential malicious scripts embedded in CSS and\n xmlns in various parts of the application and modules.
\nThis update also contains a postinst bugfix that has been approved for\nthe next update to the stable release.
\nFor the old stable distribution (woody) these problems don't apply.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.9.16.005-3.sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.9.16.008.
\nWe recommend that you upgrade your phpgroupware packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA trivially-exploitable bug was discovered in webcalendar that\nallows an attacker to execute arbitrary code with the privileges of\nthe HTTP daemon on a system running a vulnerable version.
\nThe old stable distribution (woody) does not contain the webcalendar\npackage.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.45-4sarge2.
\nFor the unstable distribution (sid) this problem will be fixed\nshortly.
\nWe recommend that you upgrade your webcalendar package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn integer overflow with subsequent buffer overflow has been detected\nin PCRE, the Perl Compatible Regular Expressions library, which allows\nan attacker to execute arbitrary code.
\nSince several packages link dynamically to this library you are\nadvised to restart the corresponding services or programs\nrespectively. The command \u201capt-cache showpkg libpcre3\u201d will list\nthe corresponding packages in the \"Reverse Depends:\" section.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 3.4-1.1woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.5-1.2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.3-1.
\nWe recommend that you upgrade your libpcre3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSuSE developers discovered that ntp confuses the given group id with\nthe group id of the given user when called with a group id on the\ncommandline that is specified as a string and not as a numeric gid,\nwhich causes ntpd to run with different privileges than intended.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.2.0a+stable-2sarge1.
\nThe unstable distribution (sid) is not affected by this problem.
\nWe recommend that you upgrade your ntp-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner discovered that the cvsbug program from CVS, which\nserves the popular Concurrent Versions System, uses temporary files in\nan insecure fashion.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.11.1p1debian-13.
\nIn the stable distribution (sarge) the cvs package does not expose the\ncvsbug program anymore.
\nIn the unstable distribution (sid) the cvs package does not expose the\ncvsbug program anymore.
\nWe recommend that you upgrade your cvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in the Apache web server. When it\nis acting as an HTTP proxy, it allows remote attackers to poison the\nweb cache, bypass web application firewall protection, and conduct\ncross-site scripting attacks, which causes Apache to incorrectly\nhandle and forward the body of the request.
\nThe fix for this bug is contained in the apache-common package which means\nthat there isn't any need for a separate update of the apache-perl and\napache-ssl package.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.3.26-0woody7.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.3.33-6sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.33-8.
\nWe recommend that you upgrade your Apache package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKDE developers have reported a vulnerability in the backup file\nhandling of Kate and Kwrite. The backup files are created with\ndefault permissions, even if the original file had more strict\npermissions set. This could disclose information unintendedly.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.3.2-6.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.4.1-1.
\nWe recommend that you upgrade your kdelibs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral problems have been discovered in Apache2, the next generation,\nscalable, extendable web server. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMarc Stern discovered an off-by-one error in the mod_ssl\n Certificate Revocation List (CRL) verification callback. When\n Apache is configured to use a CRL this can be used to cause a\n denial of service.
\nA vulnerability has been discovered in the Apache web server.\n When it is acting as an HTTP proxy, it allows remote attackers to\n poison the web cache, bypass web application firewall protection,\n and conduct cross-site scripting attacks, which causes Apache to\n incorrectly handle and forward the body of the request.
\nA problem has been discovered in mod_ssl, which provides strong\n cryptography (HTTPS support) for Apache that allows remote\n attackers to bypass access restrictions.
\nThe byte-range filter in Apache 2.0 allows remote attackers to\n cause a denial of service via an HTTP header with a large Range\n field.
\nThe old stable distribution (woody) does not contain Apache2 packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.0.54-5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.54-5.
\nWe recommend that you upgrade your apache2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner discovered that the cvsbug program from gcvs, the\nGraphical frontend for CVS, which serves the popular Concurrent\nVersions System, uses temporary files in an insecure fashion.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.0a7-2woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0final-5sarge1.
\nThe unstable distribution (sid) does not expose the cvsbug program.
\nWe recommend that you upgrade your gcvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in mod_ssl, which provides strong\ncryptography (HTTPS support) for Apache that allows remote attackers\nto bypass access restrictions.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.8.9-2.5.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.8.22-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.8.24-1.
\nWe recommend that you upgrade your libapache-mod-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYutaka Oiwa and Hiromitsu Takagi discovered a Cross-Site Request\nForgery (CSRF) vulnerability in tdiary, a new generation weblog that\ncan be exploited by remote attackers to alter the users information.
\nThe old stable distribution (woody) does not contain tdiary packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.1-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.2-1.
\nWe recommend that you upgrade your tdiary packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nCertain aborted requests that trigger an assertion in squid, the\npopular WWW proxy cache, may allow remote attackers to cause a denial\nof service. \u00a0This update also fixes a regression caused by\nDSA 751.\nFor completeness below is the original advisory text:
\n\n\nSeveral vulnerabilities have been discovered in Squid, the popular WWW\nproxy cache. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\n\n
\n- CAN-2005-2794\n
Certain aborted requests that trigger an assert may allow remote\n attackers to cause a denial of service.
\n- CAN-2005-2796\n
Specially crafted requests can cause a denial of service.
\n
For the oldstable distribution (woody) this problem has been fixed in\nversion 2.4.6-2woody10.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.5.9-10sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.5.10-5.
\nWe recommend that you upgrade your squid package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral problems have been discovered in Mozilla, the web browser of\nthe Mozilla suite. Since the usual praxis of backporting apparently\ndoes not work for this package, this update is basically version\n1.7.10 with the version number rolled back, and hence still named\n1.7.8. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nA vulnerability has been discovered in Mozilla that allows remote\n attackers to inject arbitrary Javascript from one page into the\n frameset of another site.
The browser user interface does not properly distinguish between\n user-generated events and untrusted synthetic events, which makes\n it easier for remote attackers to perform dangerous actions that\n normally could only be performed manually by the user.
XML scripts ran even when Javascript disabled.
It is possible for a remote attacker to execute a callback\n function in the context of another domain (i.e. frame).
Missing input sanitising of InstallVersion.compareTo() can cause\n the application to crash.
Remote attackers could steal sensitive information such as cookies\n and passwords from web sites by accessing data in alien frames.
It is possible for a Javascript dialog box to spoof a dialog box\n from a trusted site and facilitates phishing attacks.
Remote attackers could modify certain tag properties of DOM nodes\n that could lead to the execution of arbitrary script or code.
The Mozilla browser family does not properly clone base objects,\n which allows remote attackers to execute arbitrary code.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.7.8-1sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.7.10-1.
\nWe recommend that you upgrade your Mozilla packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe bugfix for the problem mentioned below contained an error that\ncaused third party programs to fail. \u00a0The problem is corrected by this\nupdate. \u00a0For completeness we're including the original advisory\ntext:
\n\n\nFran\u00e7ois-Ren\u00e9 Rideau discovered a bug in common-lisp-controller, a\nCommon Lisp source and compiler manager, that allows a local user to\ncompile malicious code into a cache directory which is executed by\nanother user if that user has not used Common Lisp before.
\n
The old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.15sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.18.
\nWe recommend that you upgrade your common-lisp-controller package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nPeter Karlsson discovered a buffer overflow in Turquoise SuperStat, a\nprogram for gathering statistics from Fidonet and Usenet, that can be\nexploited by a specially crafted NNTP server.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.2.1woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.4-1.
\nWe recommend that you upgrade your turqstat package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in libgadu which is also part of\ncentericq, a text-mode multi-protocol instant messenger client. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nMultiple integer signedness errors may allow remote attackers to\n cause a denial of service or execute arbitrary code.
Memory alignment errors may allows remote attackers to cause a\n denial of service on certain architectures such as sparc.
Several endianess errors may allow remote attackers to cause a\n denial of service.
The old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 4.20.0-1sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.20.0-9.
\nWe recommend that you upgrade your centericq package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a discovered that a script of lm-sensors,\nutilities to read temperature/voltage/fan sensors, creates a temporary\nfile with a predictable filename, leaving it vulnerable for a symlink\nattack.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.9.1-1sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.9.1-7.
\nWe recommend that you upgrade your lm-sensors package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIlja van Sprundel discovered a serious lock file handling error in\nkcheckpass that can, in some configurations, be used to gain root\naccess.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.3.2-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.4.2-3.
\nWe recommend that you upgrade your kdebase-bin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nS\u00f8ren Sandmann discovered a bug in memory allocation for pixmap images,\nthat can cause a crash of the X server or to execute arbitrary code.
\nThe update for the old stable distribution (woody) also contains a\ndifferent correction for multiple vulnerabilities in libXpm (DSA 607, CAN-2004-0914,\nBug#309143),\nsince the old fix contained a regression.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 4.1.0-16woody7.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.3.0.dfsg.1-14sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.8.2.dfsg.1-7 of X.Org.
\nWe recommend that you upgrade your xfree86 and xorg packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn integer overflow with a subsequent buffer overflow has been detected\nin PCRE, the Perl Compatible Regular Expressions library, which allows\nan attacker to execute arbitrary code, and is also present in Python.\nExploiting this vulnerability requires an attacker to specify the used\nregular expression.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.2.1-4.8.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.3dfsg-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.3dfsg-4.
\nWe recommend that you upgrade your python2.2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a discovered that langen2kvhtml from the\nkvoctrain package from the kdeedu suite creates temporary files in an\ninsecure fashion. This leaves them open for symlink attacks.
\nThe old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.3.2-3.sarge.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.4.2-1.
\nWe recommend that you upgrade your kvoctrain package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn integer overflow with a subsequent buffer overflow has been detected\nin PCRE, the Perl Compatible Regular Expressions library, which allows\nan attacker to execute arbitrary code, and is also present in Python.\nExploiting this vulnerability requires an attacker to specify the used\nregular expression.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.1.3-3.4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.1.3dfsg-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.1.3dfsg-3.
\nWe recommend that you upgrade your python2.1 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJakob Balle discovered that with \"Conditional Comments\" in Internet\nExplorer it is possible to hide javascript code in comments that will\nbe executed when the browser views a malicious email via sqwebmail.\nSuccessful exploitation requires that the user is using Internet\nExplorer.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.37.3-2.7.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.47-4sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.47-9.
\nWe recommend that you upgrade your sqwebmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn integer overflow with a subsequent buffer overflow has been detected\nin PCRE, the Perl Compatible Regular Expressions library, which allows\nan attacker to execute arbitrary code, and is also present in Python.\nExploiting this vulnerability requires an attacker to specify the used\nregular expression.
\nThe old stable distribution (woody) does not contain python2.3 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.3.5-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3.5-8.
\nWe recommend that you upgrade your python2.3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEric Romang discovered that gtkdiskfree, a GNOME program that shows\nfree and used space on filesystems, creates a temporary file in an\ninsecure fashion.
\nThe old stable distribution (woody) does not contain the gtkdiskfree\npackage.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.9.3-4sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your gtkdiskfree package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDavid Watson discovered a bug in mount as provided by util-linux and\nother packages such as loop-aes-utils that allows local users to\nbypass filesystem access restrictions by re-mounting it read-only.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.11n-7woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.12p-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.12p-8.
\nWe recommend that you upgrade your util-linux package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in Clam AntiVirus, the\nantivirus scanner for Unix, designed for integration with mail servers\nto perform attachment scanning. The following problems were\nidentified:
\nA potentially infinite loop could lead to a denial of service.
A buffer overflow could lead to a denial of service.
The old stable distribution (woody) does not contain ClamAV packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.87-1.
\nWe recommend that you upgrade your clamav package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDavid Watson discovered a bug in mount as provided by util-linux and\nother packages such as loop-aes-utils that allows local users to\nbypass filesystem access restrictions by re-mounting it read-only.
\nThe old stable distribution (woody) does not contain loop-aes-utils\npackages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.12p-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.12p-9.
\nWe recommend that you upgrade your loop-aes-utils package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple security vulnerabilities have been identified in the\nhelix-player media player that could allow an attacker to execute code\non the victim's machine via specially crafted network resources.
\nBuffer overflow in the RealText parser could allow remote code\n execution via a specially crafted RealMedia file with a long\n RealText string.
Format string vulnerability in Real HelixPlayer and RealPlayer 10\n allows remote attackers to execute arbitrary code via the image\n handle attribute in a RealPix (.rp) or RealText (.rt) file.
For the stable distribution (sarge), these problems have been fixed in\nversion 1.0.4-1sarge1
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.0.6-1
\nWe recommend that you upgrade your helix-player package.
\nhelix-player was distributed only on the i386 and powerpc architectures
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMoritz Muehlenhoff discovered the handler code for backupninja creates\na temporary file with a predictable filename, leaving it vulnerable to\na symlink attack.
\nThe old stable distribution (woody) does not contain the backupninja package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.5-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.8-2.
\nWe recommend that you upgrade your backupninja package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUpstream developers of squid, the popular WWW proxy cache, have\ndiscovered that changes in the authentication scheme are not handled\nproperly when given certain request sequences while NTLM\nauthentication is in place, which may cause the daemon to restart.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.5.9-10sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.5.10-6.
\nWe recommend that you upgrade your squid packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA stack-based buffer overflow in the init_syms function of MySQL, a\npopular database, has been discovered that allows remote authenticated\nusers who can create user-defined functions to execute arbitrary code\nvia a long function_name field. The ability to create user-defined\nfunctions is not typically granted to untrusted users.
\nThe following vulnerability matrix shows which version of MySQL in\nwhich distribution has this problem fixed:
\n| \u00a0 | \nwoody | \nsarge | \nsid | \n
|---|---|---|---|
| mysql | \n3.23.49-8.14 | \nn/a | \nn/a | \n
| mysql-dfsg | \nn/a | \n4.0.24-10sarge1 | \n4.0.24-10sarge1 | \n
| mysql-dfsg-4.1 | \nn/a | \n4.1.11a-4sarge2 | \n4.1.14-2 | \n
| mysql-dfsg-5.0 | \nn/a | \nn/a | \n5.0.11beta-3 | \n
We recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDrew Parsons noticed that the post-installation script of ntlmaps, an\nNTLM authorisation proxy server, changes the permissions of the\nconfiguration file to be world-readable. It contains the user name\nand password of the Windows NT system that ntlmaps connects to and,\nhence, leaks them to local users.
\nThe old stable distribution (woody) does not contain an ntlmaps package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.9-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.9-4.
\nWe recommend that you upgrade your ntlmaps package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA stack-based buffer overflow in the init_syms function of MySQL, a\npopular database, has been discovered that allows remote authenticated\nusers who can create user-defined functions to execute arbitrary code\nvia a long function_name field. The ability to create user-defined\nfunctions is not typically granted to untrusted users.
\nThe following vulnerability matrix shows which version of MySQL in\nwhich distribution has this problem fixed:
\n| \u00a0 | \nwoody | \nsarge | \nsid | \n
|---|---|---|---|
| mysql | \n3.23.49-8.14 | \nn/a | \nn/a | \n
| mysql-dfsg | \nn/a | \n4.0.24-10sarge1 | \n4.0.24-10sarge1 | \n
| mysql-dfsg-4.1 | \nn/a | \n4.1.11a-4sarge2 | \n4.1.14-2 | \n
| mysql-dfsg-5.0 | \nn/a | \nn/a | \n5.0.11beta-3 | \n
We recommend that you upgrade your mysql-dfsg packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral buffer overflows have been discovered in gopher, a\ntext-oriented client for the Gopher Distributed Hypertext protocol,\nthat can be exploited by a malicious Gopher server.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 3.0.3woody4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.0.7sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.0.11.
\nWe recommend that you upgrade your gopher package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis update only covers binary packages for the big endian MIPS\narchitecture that was mysteriously forgotten in the earlier update.\nFor completeness below is the original advisory text:
\n\n\nA stack-based buffer overflow in the init_syms function of MySQL, a\npopular database, has been discovered that allows remote authenticated\nusers who can create user-defined functions to execute arbitrary code\nvia a long function_name field. The ability to create user-defined\nfunctions is not typically granted to untrusted users.
\n
The following vulnerability matrix explains which version of MySQL in\nwhich distribution has this problem fixed:
\n| \u00a0 | \nwoody | \nsarge | \nsid | \n
|---|---|---|---|
| mysql | \n3.23.49-8.14 | \nn/a | \nn/a | \n
| mysql-dfsg | \nn/a | \n4.0.24-10sarge1 | \n4.0.24-10sarge1 | \n
| mysql-dfsg-4.1 | \nn/a | \n4.1.11a-4sarge2 | \n4.1.14-2 | \n
| mysql-dfsg-5.0 | \nn/a | \nn/a | \n5.0.11beta-3 | \n
We recommend that you upgrade your mysql-dfsg-4.1 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nTavis Ormandy discovered a buffer overflow in prozilla, a\nmulti-threaded download accelerator, which may be exploited to execute\narbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.3.6-3woody3.
\nThe stable distribution (sarge) does not contain prozilla packages.
\nThe unstable distribution (sid) does not contain prozilla packages.
\nWe recommend that you upgrade your prozilla package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a discovered several insecure temporary\nfile uses in cfengine, a tool for configuring and maintaining\nnetworked machines, that can be exploited by a symlink attack to\noverwrite arbitrary files owned by the user executing cfengine, which\nis probably root.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 1.6.3-9woody1.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.6.5-1sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your cfengine package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a discovered insecure temporary file use\nin cfengine2, a tool for configuring and maintaining networked\nmachines, that can be exploited by a symlink attack to overwrite\narbitrary files owned by the user executing cfengine, which is\nprobably root.
\nThe oldstable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.1.14-1sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your cfengine2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTom Ferris discovered a bug in the IDN hostname handling of Mozilla\nFirefox, which is also present in the other browsers from the same\nfamily that allows remote attackers to cause a denial of service and\npossibly execute arbitrary code via a hostname with dashes.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.4-2sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.6-5.
\nWe recommend that you upgrade your mozilla-firefox package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple security vulnerabilities have been identified in the\nmozilla-firefox web browser. These vulnerabilities could allow an\nattacker to execute code on the victim's machine via specially crafted\nnetwork resources.
\nHeap overrun in XBM image processing
Denial of service (crash) and possible execution of arbitrary\n\tcode via Unicode sequences with \"zero-width non-joiner\"\n\tcharacters.
XMLHttpRequest header spoofing
Object spoofing using XBL <implements>
JavaScript integer overflow
Privilege escalation using about: scheme
Chrome window spoofing allowing windows to be created without\n\tUI components such as a URL bar or status bar that could be\n\tused to carry out phishing attacks
For the stable distribution (sarge), these problems have been fixed in\nversion 1.0.4-2sarge5.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.0.7-1.
\nWe recommend that you upgrade your mozilla-firefox package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEric Romang discovered an insecurely created temporary file in\napachetop, a realtime monitoring tool for the Apache webserver that\ncould be exploited with a symlink attack to overwrite arbitrary files\nwith the user id that runs apachetop.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.12.5-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.12.5-5.
\nWe recommend that you upgrade your apachetop package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Esser of the Hardened-PHP Project reported a serious vulnerability\nin the third-party XML-RPC library included with some Drupal versions. An\nattacker could execute arbitrary PHP code on a target site. This update\npulls in the latest XML-RPC version from upstream.
\nThe old stable distribution (woody) is not affected by this problem since\nno drupal is included.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.5.3-4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.5.5-1.
\nWe recommend that you upgrade your drupal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA format string vulnerability has been discovered in GNU mailutils\nwhich contains utilities for handling mail that allows a remote\nattacker to execute arbitrary code on the IMAP server.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.6.1-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.6.90-3.
\nWe recommend that you upgrade your mailutils package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Esser discovered a vulnerability in the XML-RPC libraries which\nare also present in egroupware, a web-based groupware suite, that\nallows injection of arbitrary PHP code into eval() statements.
\nThe old stable distribution (woody) does not contain egroupware packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.0.007-2.dfsg-2sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.0.009.dfsg-1.
\nWe recommend that you upgrade your egroupware packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in the ARC archive program\nunder Unix. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nEric Romang discovered that the ARC archive program under Unix\n creates a temporary file with insecure permissions which may lead\n to an attacker stealing sensitive information.
Joey Schulze discovered that the temporary file was created in an\n insecure fashion as well, leaving it open to a classic symlink\n attack.
The old stable distribution (woody) does not contain arc packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 5.21l-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 5.21m-1.
\nWe recommend that you upgrade your arc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability in mod_auth_shadow, an Apache module that lets users\nperform HTTP authentication against /etc/shadow, has been discovered.\nThe module runs for all locations that use the 'require group'\ndirective which would bypass access restrictions controlled by another\nauthorisation mechanism, such as AuthGroupFile file, if the username\nis listed in the password file and in the gshadow file in the proper\ngroup and the supplied password matches against the one in the shadow\nfile.
\nThis update requires an explicit \"AuthShadow on\" statement if website\nauthentication should be checked against /etc/shadow.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.3-3.1woody.2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4-2.
\nWe recommend that you upgrade your libapache-mod-auth-shadow package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChristoph Martin noticed that upon configuration mason, which\ninteractively creates a Linux packet filtering firewall, does not\ninstall the init script to actually load the firewall during system\nboot. This will leave the machine without a firewall after a reboot.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.13.0.92-2woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.0-2.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.0-3.
\nWe recommend that you upgrade your mason package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in cpio, a program to manage\narchives of files. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nImran Ghory discovered a race condition in setting the file\n permissions of files extracted from cpio archives. A local\n attacker with write access to the target directory could exploit\n this to alter the permissions of arbitrary files the extracting\n user has write permissions for.
Imran Ghory discovered that cpio does not sanitise the path of\n extracted files even if the --no-absolute-filenames option was\n specified. This can be exploited to install files in arbitrary\n locations where the extracting user has write permissions to.
For the old stable distribution (woody) these problems have been fixed in\nversion 2.4.2-39woody2.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.5-1.3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.6-6.
\nWe recommend that you upgrade your cpio package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJoxean Koret discovered that the Python SVG import plugin in dia, a\nvector-oriented diagram editor, does not properly sanitise data read\nfrom an SVG file and is hence vulnerable to execute arbitrary Python\ncode.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.94.0-7sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.94.0-15.
\nWe recommend that you upgrade your dia package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJens Steube discovered two vulnerabilities in masqmail, a mailer for\nhosts without permanent internet connection. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nWhen sending failed mail messages, the address is not sanitised,\n which allows a local attacker to execute arbitrary commands as the\n mail user.
When opening the log file, masqmail does not relinquish\n privileges, which allows a local attacker to overwrite arbitrary\n files via a symlink attack.
For the old stable distribution (woody) these problems have been fixed in\nversion 0.1.16-2.2.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.2.20-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.2.20-1sarge1.
\nWe recommend that you upgrade your masqmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"Supernaut\" noticed that shorewall, the Shoreline Firewall, could\ngenerate an iptables configuration which is significantly more\npermissive than the rule set given in the shorewall configuration, if\nMAC verification are used in a non-default manner.
\nWhen MACLIST_DISPOSITION is set to ACCEPT in the shorewall.conf file,\nall packets from hosts which fail the MAC verification pass through\nthe firewall, without further checks. When MACLIST_TTL is set to a\nnon-zero value, packets from hosts which pass the MAC verification\npass through the firewall, again without further checks.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.3-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.4.1-2.
\nWe recommend that you upgrade your shorewall package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"Vade 79\" discovered that the BGP dissector in tcpdump, a powerful\ntool for network monitoring and data acquisition, does not properly\nhandle RT_ROUTING_INFO. A specially crafted BGP packet can cause a\ndenial of service via an infinite loop.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 3.6.2-2.9.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.8.3-4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.8.3-4.
\nWe recommend that you upgrade your tcpdump package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in openvpn, a\nVirtual Private Network daemon. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nWrong processing of failed certificate authentication when running\n with \"verb 0\" and without TLS authentication can lead to a denial\n of service by disconnecting the wrong client.
Wrong handling of packets that can't be decrypted on the server\n can lead to the disconnection of unrelated clients.
When running in \"dev tap\" Ethernet bridging mode, openvpn can\n exhaust its memory by receiving a large number of spoofed MAC\n addresses and hence denying service.
Simultaneous TCP connections from multiple clients with the same\n client certificate can cause a denial of service when\n --duplicate-cn is not enabled.
The old stable distribution (woody) does not contain openvpn packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.0-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.2-1.
\nWe recommend that you upgrade your openvpn package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered two format string vulnerabilities in\nup-imapproxy, an IMAP protocol proxy, which may lead remote attackers\nto the execution of arbitrary code.
\nThe old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.2.3-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.2.4-2.
\nWe recommend that you upgrade your imapproxy package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security problems have been discovered in ethereal, a commonly\nused network traffic analyser. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMemory allocation errors in the LDAP dissector can cause a denial\n of service.
Various errors in the AgentX, PER, DOCSIS, RADIUS, Telnet, IS-IS,\n HTTP, DCERPC, DHCP and SCTP dissectors can cause a denial of\n service.
Various errors in the SMPP, 802.3, H1 and DHCP dissectors can\n cause a denial of service.
Null pointer dereferences in the WBXML and GIOP dissectors can\n cause a denial of service.
A buffer overflow and null pointer dereferences in the SMB\n dissector can cause a denial of service.
Wrong address calculation in the BER dissector can cause an\n infinite loop or abortion.
Format string vulnerabilities in several dissectors allow\n remote attackers to write to arbitrary memory locations and thus\n gain privileges.
For the old stable distribution (woody) these problems have been fixed in\nversion 0.9.4-1woody13.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.10.10-2sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.10.12-2.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSimon Nielsen discovered that the BGP dissector in tcpdump, a powerful\ntool for network monitoring and data acquisition, does not properly\nhandle a -1 return value from an internal function that decodes data\npackets. A specially crafted BGP packet can cause a denial of service\nvia an infinite loop.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.8.3-5sarge1.
\nWe recommend that you upgrade your tcpdump package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered a\nformat string vulnerability in weex, a non-interactive FTP client for\nupdating web pages, that could be exploited to execute arbitrary code\non the clients machine.
\nFor the oldstable distribution (woody) this problem has been fixed in\nversion 2.6.1-4woody2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.6.1-6sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.6.1-6sarge1.
\nWe recommend that you upgrade your weex package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nArc Riley discovered that py2play, a peer-to-peer network game engine,\nis able to execute arbitrary code received from the p2p game network\nit is connected to without any security checks.
\nThe old stable distribution (woody) does not contain py2play packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.1.7-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.1.8-1.
\nWe recommend that you upgrade your py2play package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a discovered insecure temporary file\ncreation in graphviz, a rich set of graph drawing tools, that can be\nexploited to overwrite arbitrary files by a local attacker.
\nFor the old stable distribution (woody) this problem probably persists\nbut the package is non-free.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.1-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.1-1sarge1.
\nWe recommend that you upgrade your graphviz package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAriel Berkman discovered several buffer overflows in xloadimage, a\ngraphics file viewer for X11, that can be exploited via large image\ntitles and cause the execution of arbitrary code.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 4.1-10woody2.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 4.1-14.3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.1-15.
\nWe recommend that you upgrade your xloadimage package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAriel Berkman discovered several buffer overflows in xloadimage, which\nare also present in xli, a command line utility for viewing images in\nX11, and could be exploited via large image titles and cause the\nexecution of arbitrary code.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 1.17.0-11woody2.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.17.0-18sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your xli package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYutaka Oiwa discovered a bug in Ruby, the interpreter for the\nobject-oriented scripting language, that can cause illegal program\ncode to bypass the safe level and taint flag protections check and be\nexecuted. The following matrix lists the fixed versions in our\ndistributions:
\n| \u00a0 | \nold stable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| ruby | \n1.6.7-3woody5 | \nn/a | \nn/a | \n
| ruby1.6 | \nn/a | \n1.6.8-12sarge1 | \n1.6.8-13 | \n
| ruby1.8 | \nn/a | \n1.8.2-7sarge2 | \n1.8.3-1 | \n
We recommend that you upgrade your ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered a buffer overflow in uw-imap, the University\nof Washington's IMAP Server that allows attackers to execute arbitrary\ncode.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2002edebian1-11sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2002edebian1-11sarge1.
\nWe recommend that you upgrade your uw-imap packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYutaka Oiwa discovered a bug in Ruby, the interpreter for the\nobject-oriented scripting language, that can cause illegal program\ncode to bypass the safe level and taint flag protections check and be\nexecuted. The following matrix lists the fixed versions in our\ndistributions:
\n| \u00a0 | \nold stable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| ruby | \n1.6.7-3woody5 | \nn/a | \nn/a | \n
| ruby1.6 | \nn/a | \n1.6.8-12sarge1 | \n1.6.8-13 | \n
| ruby1.8 | \nn/a | \n1.8.2-7sarge2 | \n1.8.3-1 | \n
We recommend that you upgrade your ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered a\nformat string vulnerability in the CDDB processing component of\nxine-lib, the xine video/media player library, that could lead to the\nexecution of arbitrary code caused by a malicious CDDB entry.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.9.8-2woody4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.1-1sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your libxine0 and libxine1 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYutaka Oiwa discovered a bug in Ruby, the interpreter for the\nobject-oriented scripting language, that can cause illegal program\ncode to bypass the safe level and taint flag protections check and be\nexecuted. The following matrix lists the fixed versions in our\ndistributions:
\n| \u00a0 | \nold stable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| ruby | \n1.6.7-3woody5 | \nn/a | \nn/a | \n
| ruby1.6 | \nn/a | \n1.6.8-12sarge1 | \n1.6.8-13 | \n
| ruby1.8 | \nn/a | \n1.8.2-7sarge2 | \n1.8.3-1 | \n
We recommend that you upgrade your ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a discovered that several scripts of the\nhylafax suite, a flexible client/server fax software, create temporary\nfiles and directories in an insecure fashion, leaving them vulnerable\nto symlink exploits.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 4.1.1-3.2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.2.1-5sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.2.2-1.
\nWe recommend that you upgrade your hylafax packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security-related problems have been discovered in Mozilla and\nderived programs. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nTom Ferris discovered a bug in the IDN hostname handling of\n Mozilla that allows remote attackers to cause a denial of service\n and possibly execute arbitrary code via a hostname with dashes.
A buffer overflow allows remote attackers to execute arbitrary\n code via an XBM image file that ends in a large number of spaces\n instead of the expected end tag.
Mats Palmgren discovered a buffer overflow in the Unicode string\n parser that allows a specially crafted Unicode sequence to\n overflow a buffer and cause arbitrary code to be executed.
Remote attackers could spoof HTTP headers of XML HTTP requests\n via XMLHttpRequest and possibly use the client to exploit\n vulnerabilities in servers or proxies.
Remote attackers could spoof DOM objects via an XBL control that\n implements an internal XPCOM interface.
Georgi Guninski discovered an integer overflow in the JavaScript\n engine that might allow remote attackers to execute arbitrary\n code.
Remote attackers could execute Javascript code with chrome\n privileges via an about: page such as about:mozilla.
Remote attackers could spawn windows without user interface\n components such as the address and status bar that could be used\n to conduct spoofing or phishing attacks.
Peter Zelezny discovered that shell metacharacters are not\n properly escaped when they are passed to a shell script and allow\n the execution of arbitrary commands, e.g. when a malicious URL is\n automatically copied from another program into Mozilla as default\n browser.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.7.8-1sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.7.12-1.
\nWe recommend that you upgrade your mozilla package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEduard Bloch discovered that a rule file in module-assistant, a tool\nto ease the creation of module packages, creates a temporary file in\nan insecure fashion. It is usually executed from other packages as\nwell.
\nThe old stable distribution (woody) does not contain a module-assistant\npackage.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.10.
\nWe recommend that you upgrade your module-assistant package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security-related problems have been discovered in Mozilla and\nderived programs. Some of the following problems don't exactly apply\nto Mozilla Thunderbird, even though the code is present. In order to\nkeep the codebase in sync with upstream it has been altered\nnevertheless. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nTom Ferris discovered a bug in the IDN hostname handling of\n Mozilla that allows remote attackers to cause a denial of service\n and possibly execute arbitrary code via a hostname with dashes.
A buffer overflow allows remote attackers to execute arbitrary\n code via an XBM image file that ends in a large number of spaces\n instead of the expected end tag.
Mats Palmgren discovered a buffer overflow in the Unicode string\n parser that allows a specially crafted Unicode sequence to\n overflow a buffer and cause arbitrary code to be executed.
Remote attackers could spoof HTTP headers of XML HTTP requests\n via XMLHttpRequest and possibly use the client to exploit\n vulnerabilities in servers or proxies.
Remote attackers could spoof DOM objects via an XBL control that\n implements an internal XPCOM interface.
Georgi Guninski discovered an integer overflow in the JavaScript\n engine that might allow remote attackers to execute arbitrary\n code.
Remote attackers could execute Javascript code with chrome\n privileges via an about: page such as about:mozilla.
Remote attackers could spawn windows without user interface\n components such as the address and status bar that could be used\n to conduct spoofing or phishing attacks.
Peter Zelezny discovered that shell metacharacters are not\n properly escaped when they are passed to a shell script and allow\n the execution of arbitrary commands, e.g. when a malicious URL is\n automatically copied from another program into Mozilla as default\n browser.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.2-2.sarge1.0.7.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.7-1.
\nWe recommend that you upgrade your mozilla-thunderbird package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe developers of eric, a full featured Python IDE, have fixed a bug\nin the processing of project files that could lead to the execution of\narbitrary code.
\nThe old stable distribution (woody) does not contain an eric package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.6.2-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.7.2-1.
\nWe recommend that you upgrade your eric package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy noticed that sudo, a program that provides limited super\nuser privileges to specific users, does not clean the environment\nsufficiently. The SHELLOPTS and PS4 variables are dangerous and are\nstill passed through to the program running as privileged user. This\ncan result in the execution of arbitrary commands as privileged user\nwhen a bash script is executed. These vulnerabilities can only be\nexploited by users who have been granted limited super user\nprivileges.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.6.6-1.4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.6.8p7-1.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.6.8p9-3.
\nWe recommend that you upgrade your sudo package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered two format string vulnerabilities in libgda2,\nthe GNOME Data Access library for GNOME2, which may lead to the\nexecution of arbitrary code in programs that use this library.
\nThe old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.2.1-2sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your libgda2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nChris Evans discovered a buffer overflow in the RTF importer of kword,\na word processor for the KDE Office Suite that can lead to the\nexecution of arbitrary code.
\nThe old stable distribution (woody) does not contain a kword package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.3.5-4.sarge.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.5-5.
\nWe recommend that you upgrade your kword package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA security vulnerability has been found in Net-SNMP releases that\ncould allow a denial of service attack against Net-SNMP agents that\nhave opened a stream based protocol (e.g. TCP but not UDP). By default,\nNet-SNMP does not open a TCP port.
\nThe old stable distribution (woody) does not contain a net-snmp package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 5.1.2-6.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.2.1.2-1.
\nWe recommend that you upgrade your net-snmp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered a buffer overflow in lynx, a text-mode\nbrowser for the WWW that can be remotely exploited. During the\nhandling of Asian characters when connecting to an NNTP server lynx\ncan be tricked to write past the boundary of a buffer which can lead\nto the execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.8.4.1b-3.3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.8.5-2sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your lynx package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYutaka Oiwa discovered a vulnerability in the Open Secure Socket Layer\n(OpenSSL) library that can allow an attacker to perform active\nprotocol-version rollback attacks that could lead to the use of the\nweaker SSL 2.0 protocol even though both ends support SSL 3.0 or TLS\n1.0.
\nThe following matrix explains which version in which distribution has\nthis problem corrected.
\n| \u00a0 | \noldstable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| openssl | \n0.9.6c-2.woody.8 | \n0.9.7e-3sarge1 | \n0.9.8-3 | \n
| openssl094 | \n0.9.4-6.woody.4 | \nn/a | \nn/a | \n
| openssl095 | \n0.9.5a-6.woody.6 | \nn/a | \nn/a | \n
| openssl096 | \nn/a | \n0.9.6m-1sarge1 | \nn/a | \n
| openssl097 | \nn/a | \nn/a | \n0.9.7g-5 | \n
We recommend that you upgrade your libssl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered a buffer overflow in lynx, a text-mode\nbrowser for the WWW that can be remotely exploited. During the\nhandling of Asian characters when connecting to an NNTP server lynx\ncan be tricked to write past the boundary of a buffer which can lead\nto the execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.8.4.1b-3.2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.8.5-2sarge1 of lynx.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your lynx-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered two vulnerabilities in gnump3d, a streaming\nserver for MP3 and OGG files. The Common Vulnerabilities and\nExposures Project identifies the following problems:
\nThe 404 error page does not strip malicious javascript content\n from the resulting page, which would be executed in the victims\n browser.
\nBy using specially crafting URLs it is possible to read arbitrary\n files to which the user of the streaming server has access to.
\nThe old stable distribution (woody) does not contain a gnump3d package.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.9.3-1sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.9.6-1.
\nWe recommend that you upgrade your gnump3d package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been identified in the pnmtopng component of the\nnetpbm package, a set of graphics conversion tools. This\nvulnerability could allow an attacker to execute arbitrary code as a\nlocal user by providing a specially crafted PNM file.
\nThe old stable distribution (woody) it not vulnerable to this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 10.0-8sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 10.0-10.
\nWe recommend that you upgrade your netpbm-free packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA bug in gallery has been discovered that grants all registrated\npostnuke users full access to the gallery.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.5-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.5-2.
\nWe recommend that you upgrade your gallery package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral cross-site scripting vulnerabilities have been discovered in\nphpmyadmin, a set of PHP-scripts to administrate MySQL over the WWW.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nAndreas Kerber and Michal Cihar discovered several cross-site\n scripting vulnerabilities in the error page and in the cookie\n login.
Stefan Esser discovered missing safety checks in grab_globals.php\n that could allow an attacker to induce phpmyadmin to include an\n arbitrary local file.
Tobias Klein discovered several cross-site scripting\n vulnerabilities that could allow attackers to inject arbitrary\n HTML or client-side scripting.
The version in the old stable distribution (woody) has probably its\nown flaws and is not easily fixable without a full audit and patch\nsession. The easier way is to upgrade it from woody to sarge.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.6.2-3sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.6.4-pl3-1.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYutaka Oiwa discovered a vulnerability in the Open Secure Socket Layer\n(OpenSSL) library that can allow an attacker to perform active\nprotocol-version rollback attacks that could lead to the use of the\nweaker SSL 2.0 protocol even though both ends support SSL 3.0 or TLS\n1.0.
\nThe following matrix explains which version in which distribution has\nthis problem corrected.
\n| \u00a0 | \noldstable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| openssl | \n0.9.6c-2.woody.8 | \n0.9.7e-3sarge1 | \n0.9.8-3 | \n
| openssl094 | \n0.9.4-6.woody.4 | \nn/a | \nn/a | \n
| openssl095 | \n0.9.5a-6.woody.6 | \nn/a | \nn/a | \n
| openssl096 | \nn/a | \n0.9.6m-1sarge1 | \nn/a | \n
| openssl097 | \nn/a | \nn/a | \n0.9.7g-5 | \n
We recommend that you upgrade your libssl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYutaka Oiwa discovered a vulnerability in the Open Secure Socket Layer\n(OpenSSL) library that can allow an attacker to perform active\nprotocol-version rollback attacks that could lead to the use of the\nweaker SSL 2.0 protocol even though both ends support SSL 3.0 or TLS\n1.0.
\nThe following matrix explains which version in which distribution has\nthis problem corrected.
\n| \u00a0 | \noldstable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| openssl | \n0.9.6c-2.woody.8 | \n0.9.7e-3sarge1 | \n0.9.8-3 | \n
| openssl094 | \n0.9.4-6.woody.4 | \nn/a | \nn/a | \n
| openssl095 | \n0.9.5a-6.woody.6 | \nn/a | \nn/a | \n
| openssl096 | \nn/a | \n0.9.6m-1sarge1 | \nn/a | \n
| openssl097 | \nn/a | \nn/a | \n0.9.7g-5 | \n
We recommend that you upgrade your libssl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit team\ndiscovered that the syslogtocern script from thttpd, a tiny webserver,\nuses a temporary file insecurely, allowing a local attacker to craft a\nsymlink attack to overwrite arbitrary files.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.21b-11.3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.23beta1-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.23beta1-4.
\nWe recommend that you upgrade your thttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMike O'Connor discovered that the default installation of Horde3 on\nDebian includes an administrator account without a password. Already\nconfigured installations will not be altered by this update.
\nThe old stable distribution (woody) does not contain horde3 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.0.4-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.0.5-2
\nWe recommend that you verify your horde3 admin account if you have\ninstalled Horde3.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in OpenVPN, a free\nvirtual private network daemon. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nA format string vulnerability has been discovered that could allow\n arbitrary code to be executed on the client.
A NULL pointer dereferencing has been discovered that could be\n exploited to crash the service.
The old stable distribution (woody) does not contain openvpn packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.0-1sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.5-1.
\nWe recommend that you upgrade your openvpn package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in chmlib, a library for\ndealing with CHM format files. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nPalasik Sandor discovered a buffer overflow in the LZX\n decompression method.
A buffer overflow has been discovered that could lead to the\n execution of arbitrary code.
Sven Tantau discovered a buffer overflow that could lead to the\n execution of arbitrary code.
The old stable distribution (woody) does not contain chmlib packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.35-6sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.37-2.
\nWe recommend that you upgrade your chmlib packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Clam AntiVirus, the\nantivirus scanner for Unix, designed for integration with mail servers\nto perform attachment scanning. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nThe OLE2 unpacker allows remote attackers to cause a segmentation\n fault via a DOC file with an invalid property tree, which triggers\n an infinite recursion.
A specially crafted executable compressed with FSG 1.33 could\n cause the extractor to write beyond buffer boundaries, allowing an\n attacker to execute arbitrary code.
A specially crafted CAB file could cause ClamAV to be locked in an\n infinite loop and use all available processor resources, resulting\n in a denial of service.
A specially crafted CAB file could cause ClamAV to be locked in an\n infinite loop and use all available processor resources, resulting\n in a denial of service.
The old stable distribution (woody) does not contain clamav packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.87.1-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYutaka Oiwa discovered a vulnerability in the Open Secure Socket Layer\n(OpenSSL) library that can allow an attacker to perform active\nprotocol-version rollback attacks that could lead to the use of the\nweaker SSL 2.0 protocol even though both ends support SSL 3.0 or TLS\n1.0.
\nThe following matrix explains which version in which distribution has\nthis problem corrected.
\n| \u00a0 | \noldstable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| openssl | \n0.9.6c-2.woody.8 | \n0.9.7e-3sarge1 | \n0.9.8-3 | \n
| openssl094 | \n0.9.4-6.woody.4 | \nn/a | \nn/a | \n
| openssl095 | \n0.9.5a-6.woody.6 | \nn/a | \nn/a | \n
| openssl096 | \nn/a | \n0.9.6m-1sarge1 | \nn/a | \n
| openssl097 | \nn/a | \nn/a | \n0.9.7g-5 | \n
We recommend that you upgrade your libssl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHadmut Danish discovered a bug in enigmail, GPG support for Mozilla\nMailNews and Mozilla Thunderbird, that can lead to the encryption of\nmail with the wrong public key, hence, potential disclosure of\nconfidential data to others.
\nThe old stable distribution (woody) does not contain enigmail packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.91-4sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.93-1.
\nWe recommend that you upgrade your enigmail packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several security related problems in libungif4,\na shared library for GIF images. The Common Vulnerabilities and\nExposures project identifies the following vulnerabilities:
\nNull pointer dereference, that could cause a denial of service.
Out of bounds memory access that could cause a denial of service\n or the execution of arbitrary code.
For the old stable distribution (woody) these problems have been fixed in\nversion 4.1.0b1-2woody1.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 4.1.3-2sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your libungif4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKevin Finisterre discovered a format string vulnerability in gpsdrive,\na car navigation system, that can lead to the execution of arbitrary\ncode.
\nThe old stable distribution (woody) does not contain gpsdrive packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.09-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.09-2sarge1.
\nWe recommend that you upgrade your gpsdrive package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter Vreugdenhil discovered that awstats, a featureful web server log\nanalyser, passes user-supplied data to an eval() function, allowing\nremote attackers to execute arbitrary Perl commands.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6.4-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.4-1.1.
\nWe recommend that you upgrade your awstats package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRemco Verhoef has discovered a vulnerability in acidlab, Analysis\nConsole for Intrusion Databases, and in acidbase, Basic Analysis and\nSecurity Engine, which can be exploited by malicious users to conduct\nSQL injection attacks.
\nThe maintainers of Analysis Console for Intrusion Databases (ACID) in Debian,\nof which BASE is a fork off, after a security audit of both BASE and ACID\nhave determined that the flaw found not only affected the base_qry_main.php (in\nBASE) or acid_qry_main.php (in ACID) component but was also found in other\nelements of the consoles due to improper parameter validation and filtering.
\nAll the SQL injection bugs and Cross Site Scripting bugs found have been\nfixed in the Debian package, closing all the different attack vectors detected.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.9.6b20-2.1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.6b20-10.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.6b20-13 and in version 1.2.1-1 of acidbase.
\nWe recommend that you upgrade your acidlab and acidbase package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered several buffer overflows in the RTF import\nmechanism of AbiWord, a WYSIWYG word processor based on GTK 2.\nOpening a specially crafted RTF file could lead to the execution of\narbitrary code.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 1.0.2+cvs.2002.06.05-1woody3.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.2.7-3sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.4.1-1.
\nWe recommend that you upgrade your abiword package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMasanari Yamamoto discovered incorrect use of environment variables in\nuim, a flexible input method collection and library, that could lead\nto escalated privileges in setuid/setgid applications linked to\nlibuim. Affected in Debian is at least mlterm.
\nThe old stable distribution (woody) does not contain uim packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.4.6final1-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.4.7-2.
\nWe recommend that you upgrade your libuim packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in ftpd-ssl, a simple BSD FTP\nserver with SSL encryption support, that could lead to the execution\nof arbitrary code.
\nThe old stable distribution (woody) does not contain linux-ftpd-ssl\npackages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.17.18+0.3-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.17.18+0.3-5.
\nWe recommend that you upgrade your ftpd-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in phpsysinfo, a PHP\nbased host information application. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMaksymilian Arciemowicz discovered several cross site scripting\n problems, of which not all were fixed in DSA 724.
Christopher Kunz discovered that local variables get overwritten\n unconditionally and are trusted later, which could lead to the\n inclusion of arbitrary files.
Christopher Kunz discovered that user-supplied input is used\n unsanitised, causing a HTTP Response splitting problem.
For the old stable distribution (woody) these problems have been fixed in\nversion 2.0-3woody3.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.3-4sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your phpsysinfo package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in phpsysinfo, a PHP\nbased host information application that is included in phpgroupware.\nThe Common Vulnerabilities and\nExposures project identifies the following problems:
\nMaksymilian Arciemowicz discovered several cross site scripting\n problems, of which not all were fixed in\n DSA 724.
Christopher Kunz discovered that local variables get overwritten\n unconditionally and are trusted later, which could lead to the\n inclusion of arbitrary files.
Christopher Kunz discovered that user-supplied input is used\n unsanitised, causing a HTTP Response splitting problem.
For the old stable distribution (woody) these problems have been fixed in\nversion 0.9.14-0.RC3.2.woody5.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.9.16.005-3.sarge4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.9.16.008-2.
\nWe recommend that you upgrade your phpgroupware packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in egroupware, a\nweb-based groupware suite. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nMaksymilian Arciemowicz discovered several cross site scripting\n problems in phpsysinfo, which are also present in the imported\n version in egroupware and of which not all were fixed in\n DSA 724.
Alexander Heidenreich discovered a cross-site scripting problem in\n the tree view of FUD Forum Bulletin Board Software, which is also\n present in egroupware and allows remote attackers to read private\n posts via a modified mid parameter.
Christopher Kunz discovered that local variables get overwritten\n unconditionally in phpsysinfo, which are also present in\n egroupware, and are trusted later, which could lead to the\n inclusion of arbitrary files.
Christopher Kunz discovered that user-supplied input is used\n unsanitised in phpsysinfo and imported in egroupware, causing a\n HTTP Response splitting problem.
The old stable distribution (woody) does not contain egroupware packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.0.007-2.dfsg-2sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.0.009.dfsg-3-3.
\nWe recommend that you upgrade your egroupware packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDue to restrictive dependency definition for fetchmail-ssl the updated fetchmailconf\npackage couldn't be installed on the old stable distribution (woody)\ntogether with fetchmail-ssl. \u00a0Hence, this update loosens it, so that\nthe update can be pulled in. \u00a0For completeness we're including the\noriginal advisory text:
\n\n\nThomas Wolff discovered that the fetchmailconf program which is\nprovided as part of fetchmail, an SSL enabled POP3, APOP, IMAP mail\ngatherer/forwarder, creates the new configuration in an insecure\nfashion that can lead to leaking passwords for mail accounts to local\nusers.
\n
This update also fixes a regression in the package for stable caused\nby the last security update.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 5.9.11-6.4 of fetchmail and in version 5.9.11-6.3 of\nfetchmail-ssl.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6.2.5-12sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.2.5.4-1.
\nWe recommend that you upgrade your fetchmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in gnump3d, a streaming\nserver for MP3 and OGG files. The Common Vulnerabilities and\nExposures Project identifies the following problems:
\nLudwig Nussel discovered several temporary files that are created\n with predictable filenames in an insecure fashion and allows local\n attackers to craft symlink attacks.
Ludwig Nussel discovered that the theme parameter to HTTP\n requests may be used for path traversal.
The old stable distribution (woody) does not contain a gnump3d package.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.9.3-1sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.9.8-1.
\nWe recommend that you upgrade your gnump3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the sendmail program of\nxmail, an advanced, fast and reliable ESMTP/POP3 mail server that\ncould lead to the execution of arbitrary code with group mail\nprivileges.
\nThe old stable distribution (woody) does not contain xmail packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.21-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.22-1.
\nWe recommend that you upgrade your xmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe unzip update in DSA 903 contained a regression so that symbolic\nlinks that are resolved later in a zip archive aren't supported\nanymore. \u00a0This update corrects this behaviour. \u00a0For completeness,\nbelow please find the original advisory text:
\n\n\nImran Ghory discovered a race condition in the permissions setting\ncode in unzip. When decompressing a file in a directory an attacker\nhas access to, unzip could be tricked to set the file permissions to a\ndifferent file the user has permissions to.
\n
For the old stable distribution (woody) this problem has been fixed in\nversion 5.50-1woody5.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 5.52-1sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.52-6.
\nWe recommend that you upgrade your unzip package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nGreg Roelofs discovered and fixed several buffer overflows in pnmtopng\nwhich is also included in netpbm, a collection of graphic conversion\nutilities, that can lead to the execution of arbitrary code via a\nspecially crafted PNM file.
\nFor the oldstable distribution (woody) these problems have been fixed in\nversion 9.20-8.5.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 10.0-8sarge2.
\nFor the unstable distribution (sid) these problems will be fixed in\nversion 10.0-11.
\nWe recommend that you upgrade your netpbm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mantis, a\nweb-based bug tracking system. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nA cross-site scripting vulnerability allows attackers to inject\n arbitrary web script or HTML.
A file inclusion vulnerability allows remote attackers to execute\n arbitrary PHP code and include arbitrary local files.
An SQL injection vulnerability allows remote attackers to execute\n arbitrary SQL commands.
Mantis can be tricked into displaying the otherwise hidden real\n mail address of its users.
The old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.19.2-4.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.19.3-0.1.
\nWe recommend that you upgrade your mantis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nColin Leroy discovered several buffer overflows in a number of\nimporter routines in sylpheed, a light-weight e-mail client with GTK+,\nthat could lead to the execution of arbitrary code.
\nThe following matrix explains which versions fix this vulnerability
\n| \u00a0 | \nold stable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| sylpheed | \n0.7.4-4woody1 | \n1.0.4-1sarge1 | \n2.0.4-1 | \n
| sylpheed-gtk1 | \nn/a | \nn/a | \n1.0.6-1 | \n
| sylpheed-claws | \n0.7.4claws-3woody1 | \n1.0.4-1sarge1 | \n1.0.5-2 | \n
| sylpheed-claws-gtk2 | \nn/a | \nn/a | \n1.9.100-1 | \n
We recommend that you upgrade your sylpheed package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAkira Yoshiyama noticed that ipmenu, an cursel iptables/iproute2 GUI,\ncreates a temporary file in an insecure fashion allowing a local\nattacker to overwrite arbitrary files utilising a symlink attack.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.0.3-4woody1
\nThe stable distribution (sarge) does not contain the ipmenu package.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.0.3-5.
\nWe recommend that you upgrade your ipmenu package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nColin Leroy discovered several buffer overflows in a number of\nimporter routines in sylpheed-claws, an extended version of the\nSylpheed mail client, that could lead to the execution of arbitrary\ncode.
\nThe following matrix explains which versions fix this vulnerability
\n| \u00a0 | \nold stable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| sylpheed | \n0.7.4-4woody1 | \n1.0.4-1sarge1 | \n2.0.4-1 | \n
| sylpheed-gtk1 | \nn/a | \nn/a | \n1.0.6-1 | \n
| sylpheed-claws | \n0.7.4claws-3woody1 | \n1.0.4-1sarge1 | \n1.0.5-2 | \n
| sylpheed-claws-gtk2 | \nn/a | \nn/a | \n1.9.100-1 | \n
We recommend that you upgrade your sylpheed-claws package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDaniel Schreckling discovered that the MIME viewer in horde3, a web\napplication suite, does not always sanitise its input leaving a\npossibility to force the return of malicious code that could be\nexecuted on the victims machine.
\nThe old stable distribution (woody) does not contain horde3 packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.0.4-4sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.0.7-1.
\nWe recommend that you upgrade your horde3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in zope 2.7, an Open Source web\napplication server, that allows remote attackers to insert arbitrary\nfiles via include directives in reStructuredText functionality.
\nThe old stable distribution (woody) does not contain zope2.7 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.7.5-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.7.8-1.
\nWe recommend that you upgrade your zope2.7 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in gtk+2.0, the Gtk+ GdkPixBuf\nXPM image rendering library. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nLudwig Nussel discovered an infinite loop when processing XPM\n images that allows an attacker to cause a denial of service via a\n specially crafted XPM file.
Ludwig Nussel discovered an integer overflow in the way XPM images\n are processed that could lead to the execution of arbitrary code\n or crash the application via a specially crafted XPM file.
\"infamous41md\" discovered an integer overflow in the XPM processing\n routine that can be used to execute arbitrary code via a traditional heap\n overflow.
The following matrix explains which versions fix these problems:
\n| \u00a0 | \nold stable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| gdk-pixbuf | \n0.17.0-2woody3 | \n0.22.0-8.1 | \n0.22.0-11 | \n
| gtk+2.0 | \n2.0.2-5woody3 | \n2.6.4-3.1 | \n2.6.10-2 | \n
We recommend that you upgrade your gtk+2.0 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nWernfried Haas discovered that centericq, a text-mode multi-protocol\ninstant messenger client, can crash when it receives certain zero\nlength packets and is directly connected to the Internet.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 4.5.1-1.1woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.20.0-1sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.21.0-4.
\nWe recommend that you upgrade your centericq package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in gdk-pixbuf, the Gtk+\nGdkPixBuf XPM image rendering library. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nLudwig Nussel discovered an infinite loop when processing XPM\n images that allows an attacker to cause a denial of service via a\n specially crafted XPM file.
Ludwig Nussel discovered an integer overflow in the way XPM images\n are processed that could lead to the execution of arbitrary code\n or crash the application via a specially crafted XPM file.
\"infamous41md\" discovered an integer in the XPM processing routine\n that can be used to execute arbitrary code via a traditional heap\n overflow.
The following matrix explains which versions fix these problems:
\n| \u00a0 | \nold stable (woody) | \nstable (sarge) | \nunstable (sid) | \n
|---|---|---|---|
| gdk-pixbuf | \n0.17.0-2woody3 | \n0.22.0-8.1 | \n0.22.0-11 | \n
| gtk+2.0 | \n2.0.2-5woody3 | \n2.6.4-3.1 | \n2.6.10-2 | \n
We recommend that you upgrade your gdk-pixbuf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in horde2, a web application\nsuite, that allows attackers to insert arbitrary script code into the\nerror web page.
\nThe old stable distribution (woody) does not contain horde2 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.8-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.9-1.
\nWe recommend that you upgrade your horde2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn integer overflow has been discovered in helix-player, the helix\naudio and video player. This flaw could allow a remote attacker to\nrun arbitrary code on a victims computer by supplying a specially\ncrafted network resource.
\nThe old stable distribution (woody) does not contain a helix-player\npackage.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-1sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.6-1.
\nWe recommend that you upgrade your helix-player package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Inkscape, a\nvector-based drawing program. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nJoxean Koret discovered a buffer overflow in the SVG parsing\n routines that can lead to the execution of arbitrary code.
Javier Fern\u00e1ndez-Sanguino Pe\u00f1a noticed that the ps2epsi extension\n shell script uses a hardcoded temporary file making it vulnerable\n to symlink attacks.
The old stable distribution (woody) does not contain inkscape packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.41-4.99.sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.42.2+0.43pre1-1.
\nWe recommend that you upgrade your inkscape package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPatrick Cheong Shu Yang discovered that courier-authdaemon, the\nauthentication daemon of the Courier Mail Server, grants access to\naccounts that are already deactivated.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.37.3-2.8.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.47-4sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.47-12.
\nWe recommend that you upgrade your courier packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in osh, the\noperator's shell for executing defined programs in a privileged\nenvironment. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:
\nCharles Stevenson discovered a bug in the substitution of\n variables that allows a local attacker to open a root shell.
Solar Eclipse discovered a buffer overflow caused by the current\n working directory plus a filename that could be used to execute\n arbitrary code and e.g. open a root shell.
For the old stable distribution (woody) these problems have been fixed in\nversion 1.7-11woody2.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.7-13sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.7-15, however, the package has been removed entirely.
\nWe recommend that you upgrade your osh package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe upstream developer of curl, a multi-protocol file transfer\nlibrary, informed us that the former correction to several off-by-one\nerrors are not sufficient. For completeness please find the original\nbug description below:
\n\n\nSeveral problems were discovered in libcurl, a multi-protocol file\ntransfer library. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\n\n
\n- CVE-2005-3185\n
\nA buffer overflow has been discovered in libcurl\n that could allow the execution of arbitrary code.
- CVE-2005-4077\n
\nStefan Esser discovered several off-by-one errors that allows\n local users to trigger a buffer overflow and cause a denial of\n service or bypass PHP security restrictions via certain URLs.
For the old stable distribution (woody) these problems have been fixed in\nversion 7.9.5-1woody2.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 7.13.2-2sarge5. This update also includes a bugfix against\ndata corruption.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 7.15.1-1.
\nWe recommend that you upgrade your libcurl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nA buffer overflow has been discovered in ethereal, a commonly used\nnetwork traffic analyser that causes a denial of service and may\npotentially allow the execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.9.4-1woody14.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.10.10-2sarge3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the\nLinux kernel that may lead to a denial of service or the execution of\narbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nAlexander Nyberg discovered that the ptrace() system call does not\n properly verify addresses on the amd64 architecture which can be\n exploited by a local attacker to crash the kernel.
A problem in the offset handling in the xattr file system code for\n ext3 has been discovered that may allow users on 64-bit systems\n that have access to an ext3 filesystem with extended attributes to\n cause the kernel to crash.
A vulnerability has been discovered in the ptrace() system call on\n the amd64 architecture that allows a local attacker to cause the\n kernel to crash.
A vulnerability has been discovered in the stack segment fault\n handler that could allow a local attacker to cause a stack exception\n that will lead the kernel to crash under certain circumstances.
Ilja van Sprundel discovered a race condition in the IA32 (x86)\n compatibility execve() systemcall for amd64 and IA64 that allows\n local attackers to cause the kernel to panic and possibly execute\n arbitrary code.
Balazs Scheidler discovered that a local attacker could call\n setsockopt() with an invalid xfrm_user policy message which would\n cause the kernel to write beyond the boundaries of an array and\n crash.
Vladimir Volovich discovered a bug in the zlib routines which are\n also present in the Linux kernel and allows remote attackers to\n crash the kernel.
Another vulnerability has been discovered in the zlib routines\n which are also present in the Linux kernel and allows remote\n attackers to crash the kernel.
A null pointer dereference in ptrace when tracing a 64-bit\n executable can cause the kernel to crash.
Andreas Gruenbacher discovered a bug in the ext2 and ext3 file\n systems. When data areas are to be shared among two inodes not\n all information were compared for equality, which could expose\n wrong ACLs for files.
Chad Walstrom discovered that the ipt_recent kernel module to stop\n SSH bruteforce attacks could cause the kernel to crash on 64-bit\n architectures.
An error in the NAT code allows remote attackers to cause a denial\n of service (memory corruption) by causing two packets for the same\n protocol to be NATed at the same time, which leads to memory\n corruption.
The following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| \u00a0 | \nDebian 3.1 (sarge) | \n
|---|---|
| Source | \n2.4.27-10sarge1 | \n
| Alpha architecture | \n2.4.27-10sarge1 | \n
| ARM architecture | \n2.4.27-2sarge1 | \n
| Intel IA-32 architecture | \n2.4.27-10sarge1 | \n
| Intel IA-64 architecture | \n2.4.27-10sarge1 | \n
| Motorola 680x0 architecture | \n2.4.27-3sarge1 | \n
| Big endian MIPS architecture | \n2.4.27-10.sarge1.040815-1 | \n
| Little endian MIPS architecture | \n2.4.27-10.sarge1.040815-1 | \n
| PowerPC architecture | \n2.4.27-10sarge1 | \n
| IBM S/390 architecture | \n2.4.27-2sarge1 | \n
| Sun Sparc architecture | \n2.4.27-9sarge1 | \n
We recommend that you upgrade your kernel package immediately and\nreboot the machine.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the\nLinux kernel that may lead to a denial of service or the execution of\narbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nA race condition in the sysfs filesystem allows local users to\n read kernel memory and cause a denial of service (crash).
\nAlexander Nyberg discovered that the ptrace() system call does not\n properly verify addresses on the amd64 architecture which can be\n exploited by a local attacker to crash the kernel.
A problem in the offset handling in the xattr file system code for\n ext3 has been discovered that may allow users on 64-bit systems\n that have access to an ext3 filesystem with extended attributes to\n cause the kernel to crash.
Chris Wright discovered that the mmap() function could create\n illegal memory maps that could be exploited by a local user to\n crash the kernel or potentially execute arbitrary code.
A vulnerability on the IA-64 architecture can lead local attackers\n to overwrite kernel memory and crash the kernel.
A vulnerability has been discovered in the ptrace() system call on\n the amd64 architecture that allows a local attacker to cause the\n kernel to crash.
A buffer overflow in the ptrace system call for 64-bit\n architectures allows local users to write bytes into arbitrary\n kernel memory.
Zou Nan Hai has discovered that a local user could cause the\n kernel to hang on the amd64 architecture after invoking syscall()\n with specially crafted arguments.
A vulnerability has been discovered in the stack segment fault\n handler that could allow a local attacker to cause a stack exception\n that will lead the kernel to crash under certain circumstances.
Balazs Scheidler discovered that a local attacker could call\n setsockopt() with an invalid xfrm_user policy message which would\n cause the kernel to write beyond the boundaries of an array and\n crash.
Vladimir Volovich discovered a bug in the zlib routines which are\n also present in the Linux kernel and allows remote attackers to\n crash the kernel.
Another vulnerability has been discovered in the zlib routines\n which are also present in the Linux kernel and allows remote\n attackers to crash the kernel.
Peter Sandstrom noticed that snmpwalk from a remote host could\n cause a denial of service (kernel oops from null dereference) via\n certain UDP packets that lead to a function call with the wrong\n argument.
Andreas Gruenbacher discovered a bug in the ext2 and ext3 file\n systems. When data areas are to be shared among two inodes not\n all information were compared for equality, which could expose\n wrong ACLs for files.
Chad Walstrom discovered that the ipt_recent kernel module on\n 64-bit processors such as AMD64 allows remote attackers to cause a\n denial of service (kernel panic) via certain attacks such as SSH\n brute force.
The mprotect code on Itanium IA-64 Montecito processors does not\n properly maintain cache coherency as required by the architecture,\n which allows local users to cause a denial of service and possibly\n corrupt data by modifying PTE protections.
A race condition in the thread management may allow local users to\n cause a denial of service (deadlock) when threads are sharing\n memory and waiting for a thread that has just performed an exec.
When one thread is tracing another thread that shares the same\n memory map a local user could cause a denial of service (deadlock)\n by forcing a core dump when the traced thread is in the\n TASK_TRACED state.
A bug in the ioremap() system call has been discovered on the\n amd64 architecture that could allow local users to cause a\n denial of service or an information leak when performing a lookup\n of a non-existent memory page.
The HFS and HFS+ (hfsplus) modules allow local attackers to cause\n a denial of service (oops) by using hfsplus to mount a filesystem\n that is not hfsplus.
A race condition in the ebtables netfilter module on an SMP system\n running under high load may allow remote attackers to cause a\n denial of service (crash).
Roland McGrath discovered that exec() does not properly clear\n posix-timers in multi-threaded environments, which results in a\n resource leak and could allow a large number of multiple local\n users to cause a denial of service by using more posix-timers than\n specified by the quota for a single user.
The kernel allows remote attackers to poison the bridge forwarding\n table using frames that have already been dropped by filtering,\n which can cause the bridge to forward spoofed packets.
The ioctl for the packet radio ROSE protocol does not properly\n verify the arguments when setting a new router, which allows\n attackers to trigger out-of-bounds errors.
A race condition on SMP systems allows local users to cause a\n denial of service (null dereference) by causing a connection timer\n to expire while the connection table is being flushed before the\n appropriate lock is acquired.
An error in the NAT code allows remote attackers to cause a denial\n of service (memory corruption) by causing two packets for the same\n protocol to be NATed at the same time, which leads to memory\n corruption.
A missing memory cleanup in the thread handling routines before\n copying data into userspace allows a user process to obtain\n sensitive information.
This update also contains a number of corrections for issues that\nturned out to have no security implication afterwards.
\nThe following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| \u00a0 | \nDebian 3.1 (sarge) | \n
|---|---|
| Source | \n2.6.8-16sarge1 | \n
| Alpha architecture | \n2.6.8-16sarge1 | \n
| AMD64 architecture | \n2.6.8-16sarge1 | \n
| HP Precision architecture | \n2.6.8-6sarge1 | \n
| Intel IA-32 architecture | \n2.6.8-16sarge1 | \n
| Intel IA-64 architecture | \n2.6.8-14sarge1 | \n
| Motorola 680x0 architecture | \n2.6.8-4sarge1 | \n
| PowerPC architecture | \n2.6.8-12sarge1 | \n
| IBM S/390 architecture | \n2.6.8-5sarge1 | \n
| Sun Sparc architecture | \n2.6.8-15sarge1 | \n
We recommend that you upgrade your kernel package immediately and\nreboot the machine.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in dropbear, a lightweight SSH2\nserver and client, that may allow authenticated users to execute\narbitrary code as the server user (usually root).
\nThe old stable distribution (woody) does not contain dropbear packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.45-2sarge0.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.47-1.
\nWe recommend that you upgrade your dropbear package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKurt Fitzner discovered a buffer overflow in nbd, the network block\ndevice client and server that could potentially allow arbitrary code on\nthe NBD server.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.2cvs20020320-3.woody.3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.7.3-3sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your nbd-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in phpBB, a fully\nfeatured and skinnable flat webforum. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nMultiple interpretation errors allow remote authenticated users to\n inject arbitrary web script when remote avatars and avatar\n uploading are enabled.
phpBB allows remote attackers to bypass protection mechanisms that\n deregister global variables that allows attackers to manipulate\n the behaviour of phpBB.
phpBB allows remote attackers to bypass security checks when\n register_globals is enabled and the session_start function has not\n been called to handle a session.
phpBB allows remote attackers to modify global variables and\n bypass security mechanisms.
Multiple cross-site scripting (XSS) vulnerabilities allow remote\n attackers to inject arbitrary web scripts.
An SQL injection vulnerability allows remote attackers to execute\n arbitrary SQL commands.
phpBB allows remote attackers to modify regular expressions and\n execute PHP code via the signature_bbcode_uid parameter.
Missing input sanitising of the topic type allows remote attackers\n to inject arbitrary SQL commands.
Missing request validation permitted remote attackers to edit\n private messages of other users.
The old stable distribution (woody) does not contain phpbb2 packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.0.13+1-6sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.18-1.
\nWe recommend that you upgrade your phpbb2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit Project discovered a buffer\noverflow in ketm, an old school 2D-scrolling shooter game, that can be\nexploited to execute arbitrary code with group games privileges.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.0.6-7woody0.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.0.6-17sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.0.6-17sarge1.
\nWe recommend that you upgrade your ketm package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nThe last update of tkdiff contained a programming error which is\nfixed by this version. \u00a0For completeness we're adding the original\nadvisory text:
\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit project\ndiscovered that tkdiff, a graphical side by side \"diff\" utility,\ncreates temporary files in an insecure fashion.
\n
For the old stable distribution (woody) this problem has been fixed in\nversion 3.08-3woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.0.2-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.2-4.
\nWe recommend that you upgrade your tkdiff package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit project\ndiscovered that two scripts in the dhis-tools-dns package, DNS\nconfiguration utilities for a dynamic host information System, which\nare usually executed by root, create temporary files in an insecure\nfashion.
\nThe old stable distribution (woody) does not contain a dhis-tools-dns\npackage.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 5.0-3sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 5.0-5.
\nWe recommend that you upgrade your dhis-tools-dns package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered a buffer\noverflow in petris, a clone of the Tetris game, which may be exploited\nto execute arbitrary code with group games privileges.
\nThe old stable distribution (woody) does not contain the petris package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.1-4sarge0.
\nFor the unstable distribution the package will be updated shortly.
\nWe recommend that you upgrade your petris package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit project discovered a\nformat string attack in the logging code of smstools, which may be\nexploited to execute arbitrary code with root privileges.
\nThe original advisory for this issue said that the old stable\ndistribution (woody) was not affected because it did not contain\nsmstools. This was incorrect, and the only change in this updated\nadvisory is the inclusion of corrected packages for woody.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.5.0-2woody0.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.14.8-1sarge0.
\nFor the unstable distribution the package will be updated shortly.
\nWe recommend that you upgrade your smstools package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\n\"infamous41md\" and Chris Evans discovered several heap based buffer\noverflows in xpdf, the Portable Document Format (PDF) suite, that can\nlead to a denial of service by crashing the application or possibly to\nthe execution of arbitrary code.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 1.00-3.8.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.00-13.4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.01-4.
\nWe recommend that you upgrade your xpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" and Chris Evans discovered several heap based buffer\noverflows in xpdf, the Portable Document Format (PDF) suite, that can\nlead to a denial of service by crashing the application or possibly to\nthe execution of arbitrary code. The same code is present in kpdf\nwhich is part of the kdegraphics package.
\nThe old stable distribution (woody) does not contain kpdf packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.3.2-2sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.5.0-3.
\nWe recommend that you upgrade your kpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPatrice Fournier found that hylafax passes unsanitized user data in the\nnotify script, allowing users with the ability to submit jobs to run\narbitrary commands with the privileges of the hylafax server.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 4.1.1-4woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.2.1-5sarge3.
\nFor the unstable distribution the problem has been fixed in version\n4.2.4-2.
\nWe recommend that you upgrade your hylafax package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in Pound, a reverse proxy and\nload balancer for HTTP. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nOverly long HTTP Host: headers may trigger a buffer overflow in the\n add_port() function, which may lead to the execution of arbitrary\n code.
HTTP requests with conflicting Content-Length and Transfer-Encoding\n headers could lead to HTTP Request Smuggling Attack, which can be\n exploited to bypass packet filters or poison web caches.
The old stable distribution (woody) does not contain pound packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.8.2-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.9.4-1.
\nWe recommend that you upgrade your pound package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\niDEFENSE reports that a format string vulnerability in mod_auth_pgsql, a\nlibrary used to authenticate web users against a PostgreSQL database,\ncould be used to execute arbitrary code with the privileges of the httpd\nuser.
\nThe old stable distribution (woody) does not contain\nlibapache2-mod-auth-pgsql.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.2b1-5sarge0.
\nFor the unstable distribution (sid) this problem will be fixed shortly.
\nWe recommend that you upgrade your libapache2-mod-auth-pgsql package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" and Chris Evans discovered several heap based buffer\noverflows in xpdf, the Portable Document Format (PDF) suite, which is\nalso present in libextractor, a library to extract arbitrary meta-data\nfrom files, and which can lead to a denial of service by crashing the\napplication or possibly to the execution of arbitrary code.
\nThe old stable distribution (woody) does not contain libextractor\npackages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.4.2-2sarge2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your libextractor packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" and Chris Evans discovered several heap based buffer overflows in xpdf,\nthe Portable Document Format (PDF) suite, which is also present in\ntetex-bin, the binary files of teTeX, and which can lead to a denial of\nservice by crashing the application or possibly to the execution of\narbitrary code.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 1.0.7+20011202-7.7.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.0.2-30sarge4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.4.3-2 of poppler against which tetex-bin links.
\nWe recommend that you upgrade your tetex-bin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" and chris Evans discovered several heap based buffer\noverflows in xpdf, the Portable Document Format (PDF) suite, which is\nalso present in koffice, the KDE Office Suite, and which can lead to a\ndenial of service by crashing the application or possibly to the\nexecution of arbitrary code.
\nThe old stable distribution (woody) does not contain koffice packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.3.5-4.sarge.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.4.2-6.
\nWe recommend that you upgrade your koffice package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDaniel Drake discovered a problem in fetchmail, an SSL enabled POP3,\nAPOP, IMAP mail gatherer/forwarder, that can cause a crash when the\nprogram is running in multidrop mode and receives messages without\nheaders.
\nThe old stable distribution (woody) does not seem to be affected by\nthis problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6.2.5-12sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.3.1-1.
\nWe recommend that you upgrade your fetchmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" and Chris Evans discovered several heap based buffer\noverflows in xpdf, the Portable Document Format (PDF) suite, which is\nalso present in gpdf, the GNOME version of the Portable Document\nFormat viewer, and which can lead to a denial of service by crashing\nthe application or possibly to the execution of arbitrary code.
\nThe old stable distribution (woody) does not contain gpdf packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.8.2-1.2sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.10.0-2.
\nWe recommend that you upgrade your gpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit project\ndiscovered that a script in tuxpaint, a paint program for young\nchildren, creates a temporary file in an insecure fashion.
\nThe old stable distribution (woody) does not contain tuxpaint packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.14-2sarge0.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.15b-1.
\nWe recommend that you upgrade your tuxpaint package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA design error has been discovered in the Albatross web application\ntoolkit that causes user supplied data to be used as part of template\nexecution and hence arbitrary code execution.
\nThe old stable distribution (woody) does not contain albatross packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.20-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.33-1.
\nWe recommend that you upgrade your albatross package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJack Louis discovered an integer overflow in Perl, Larry Wall's\nPractical Extraction and Report Language, that allows attackers to\noverwrite arbitrary memory and possibly execute arbitrary code via\nspecially crafted content that is passed to vulnerable format strings\nof third party software.
\nThe old stable distribution (woody) does not seem to be affected by\nthis problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 5.8.4-8sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.8.7-9.
\nWe recommend that you upgrade your perl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mantis, a\nweb-based bug tracking system. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMissing input sanitising allows remote attackers to inject\n arbitrary web script or HTML.
Tobias Klein discovered that Mantis allows remote attackers to\n bypass the file upload size restriction.
Tobias Klein discovered several SQL injection vulnerabilities that\n allow remote attackers to execute arbitrary SQL commands.
Tobias Klein discovered unspecified \"port injection\"\n vulnerabilities in filters.
Tobias Klein discovered a CRLF injection vulnerability that allows\n remote attackers to modify HTTP headers and conduct HTTP response\n splitting attacks.
Tobias Klein discovered several cross-site scripting (XSS)\n vulnerabilities that allow remote attackers to inject arbitrary\n web script or HTML.
Tobias Klein discovered that Mantis discloses private bugs via\n public RSS feeds, which allows remote attackers to obtain\n sensitive information.
Tobias Klein discovered that Mantis does not properly handle \"Make\n note private\" when a bug is being resolved, which has unknown\n impact and attack vectors, probably related to an information\n leak.
The old stable distribution (woody) does not seem to be affected by\nthese problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.19.2-5sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.19.4-1.
\nWe recommend that you upgrade your mantis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit project\ndiscovered that two scripts in antiword, utilities to convert Word\nfiles to text and Postscript, create a temporary file in an insecure\nfashion.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 0.32-2woody0.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.35-2sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.35-2.
\nWe recommend that you upgrade your antiword package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe former correction to vulnerabilities in the sudo package worked\nfine but were too strict for some environments. Therefore we have\nreviewed the changes again and allowed some environment variables to\ngo back into the privileged execution environment. Hence, this\nupdate.
\nThe configuration option \"env_reset\" is now activated by default.\nIt will preserve only the environment variables HOME, LOGNAME, PATH,\nSHELL, TERM, DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE,\nLC_*, and USER in addition to the separate SUDO_* variables.
\nFor completeness please find below the original advisory text:
\n\n\nIt has been discovered that sudo, a privileged program, that provides\nlimited super user privileges to specific users, passes several\nenvironment variables to the program that runs with elevated\nprivileges. In the case of include paths (e.g. for Perl, Python, Ruby\nor other scripting languages) this can cause arbitrary code to be\nexecuted as privileged user if the attacker points to a manipulated\nversion of a system library.
\nThis update alters the former behaviour of sudo and limits the number\nof supported environment variables to LC_*, LANG, LANGUAGE and TERM.\nAdditional variables are only passed through when set as env_check in\n/etc/sudoers, which might be required for some scripts to continue to\nwork.
\n
For the old stable distribution (woody) this problem has been fixed in\nversion 1.6.6-1.6.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.6.8p7-1.4.
\nFor the unstable distribution (sid) the same behaviour will be\nimplemented soon.
\nWe recommend that you upgrade your sudo package. For unstable\n\"Defaults = env_reset\" need to be added to /etc/sudoers manually.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nA heap overflow has been discovered in ClamAV, a virus scanner, which\ncould allow an attacker to execute arbitrary code by sending a carefully\ncrafted UPX-encoded executable to a system running ClamAV. In addition,\nother potential overflows have been corrected.
\nPackages for the ARM architecture were not available when DSA 947-1 was\nreleased; these packages are now available. Also, DSA 947-1 incorrectly\nidentified the package version which corrected these issues in the\nunstable distribution (sid).
\nThe old stable distribution (woody) does not include ClamAV.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.84-2.sarge.7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.88-1.
\nWe recommend that you upgrade your clamav package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nMaksim Orlovich discovered that the kjs Javascript interpreter, used\nin the Konqueror web browser and in other parts of KDE, performs\ninsufficient bounds checking when parsing UTF-8 encoded Uniform Resource\nIdentifiers, which may lead to a heap based buffer overflow and the\nexecution of arbitrary code.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.3.2-6.4
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your kdelibs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered a\nsecurity related problem in crawl, another console based dungeon\nexploration game in the vein of nethack and rogue. The program\nexecutes commands insecurely when saving or loading games which can\nallow local attackers to gain group games privileges.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 4.0.0beta23-2woody2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.0.0beta26-4sarge0.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.0beta26-7.
\nWe recommend that you upgrade your crawl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" and Chris Evans discovered several heap based buffer\noverflows in xpdf which are also present in CUPS, the Common UNIX\nPrinting System, and which can lead to a denial of service by crashing\nthe application or possibly to the execution of arbitrary code.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 1.1.14-5woody14.
\nCUPS doesn't use the xpdf source anymore since 1.1.22-7, when it switched\nto using xpdf-utils for PDF processing.
\nWe recommend that you upgrade your CUPS packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis update corrects the search feature in trac, an enhanced wiki\nand issue tracking system for software development projects, which\nbroke with the last security update. For completeness please find\nbelow the original advisory text:
\n\n\nSeveral vulnerabilities have been discovered in trac, an enhanced wiki\nand issue tracking system for software development projects. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\n\n
\n- CVE-2005-4065\n
\nDue to missing input sanitising it is possible to inject arbitrary\n SQL code into the SQL statements.
- CVE-2005-4644\n
\nA cross-site scripting vulnerability has been discovered that\n allows remote attackers to inject arbitrary web script or HTML.
The old stable distribution (woody) does not contain trac packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8.1-3sarge4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.9.3-1.
\nWe recommend that you upgrade your trac package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\n\"Seregorn\" discovered a format string vulnerability in the logging\nfunction of libapache-auth-ldap, an LDAP authentication module for the\nApache webserver, that can lead to the execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.6.0-3.1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.6.0-8.1
\nThe unstable distribution (sid) does no longer contain libapache-auth-ldap.
\nWe recommend that you upgrade your libapache-auth-ldap package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral cross-site scripting vulnerabilities have been discovered in\nflyspray, a lightweight bug tracking system, which allows attackers to\ninsert arbitrary script code into the index page.
\nThe old stable distribution (woody) does not contain flyspray.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.7-2.1.
\nFor the testing (etch) and unstable distribution (sid) this problem has\nbeen fixed in version 0.9.8-5.
\nWe recommend that you upgrade your flyspray package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nH D Moore has discovered that Wine, a free implementation of the Microsoft\nWindows APIs, inherits a design flaw from the Windows GDI API, which may\nlead to the execution of code through GDI escape functions in WMF files.
\nThe old stable distribution (woody) does not seem to be affected by this\nproblem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.0.20050310-1.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.2-1.
\nWe recommend that you upgrade your wine packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo denial of service bugs were found in the mailman list server. In\none, attachment filenames containing UTF8 strings were not properly\nparsed, which could cause the server to crash. In another, a message\ncontaining a bad date string could cause a server crash.
\nThe old stable distribution (woody) is not vulnerable to this issue.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.1.5-8sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.1.5-10.
\nWe recommend that you upgrade your mailman package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Pfetzing discovered that lshd, a Secure Shell v2 (SSH2)\nprotocol server, leaks a couple of file descriptors, related to the\nrandomness generator, to user shells which are started by lshd. A\nlocal attacker can truncate the server's seed file, which may prevent\nthe server from starting, and with some more effort, maybe also crack\nsession keys.
\nAfter applying this update, you should remove the server's seed file\n(/var/spool/lsh/yarrow-seed-file) and then regenerate it with\n\"lsh-make-seed --server\" as root.
\nFor security reasons, lsh-make-seed really needs to be run from the\nconsole of the system you are running it on. If you run lsh-make-seed\nusing a remote shell, the timing information lsh-make-seed uses for\nits random seed creation is likely to be screwed. If need be, you can\ngenerate the random seed on a different system than that which it will\neventually be on, by installing the lsh-utils package and running\n\"lsh-make-seed -o my-other-server-seed-file\". You may then transfer\nthe seed to the destination system as using a secure connection.
\nThe old stable distribution (woody) may not be affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.1-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.1cdbs-4.
\nWe recommend that you upgrade your lsh-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFlorian Weimer discovered that delegate code in ImageMagick is\nvulnerable to shell command injection using specially crafted file\nnames. This allows attackers to encode commands inside of graphic\ncommands. With some user interaction, this is exploitable through\nGnus and Thunderbird. This update filters out the '$' character as\nwell, which was forgotten in the former update.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 5.4.4.5-1woody8.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6.0.6.2-2.6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.2.4.5-0.6.
\nWe recommend that you upgrade your imagemagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral security related problems have been discovered in drupal, a\nfully-featured content management/discussion engine. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nSeveral cross-site scripting vulnerabilities allow remote\n attackers to inject arbitrary web script or HTML.
When running on PHP5, Drupal does not correctly enforce user\n privileges, which allows remote attackers to bypass the \"access\n user profiles\" permission.
An interpretation conflict allows remote authenticated users to\n inject arbitrary web script or HTML via HTML in a file with a GIF\n or JPEG file extension.
The old stable distribution (woody) does not contain drupal packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 4.5.3-5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.5.6-1.
\nWe recommend that you upgrade your drupal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered that unalz, a\ndecompressor for ALZ archives, performs insufficient bounds checking\nwhen parsing file names. This can lead to arbitrary code execution if\nan attacker provides a crafted ALZ archive.
\nThe old stable distribution (woody) does not contain unalz.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.30.1
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your unalz package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe former update caused temporary files to be created in the current\nworking directory due to a wrong function argument. This update will\ncreate temporary files in the users home directory if HOME is set or\nin the common temporary directory otherwise, usually /tmp. For\ncompleteness below is a copy of the original advisory text:
\n\n\nNiko Tyni discovered that the Mail::Audit module, a Perl library for\ncreating simple mail filters, logs to a temporary file with a\npredictable filename in an insecure fashion when logging is turned on,\nwhich is not the case by default.
\n
For the old stable distribution (woody) these problems have been fixed in\nversion 2.0-4woody3.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.1-5sarge4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.1-5.1.
\nWe recommend that you upgrade your libmail-audit-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\n\"infamous41md\" and Chris Evans discovered several heap based buffer\noverflows in xpdf which are also present in pdfkit.framework, the\nGNUstep framework for rendering PDF content, and which can lead to a\ndenial of service by crashing the application or possibly to the\nexecution of arbitrary code.
\nThe old stable distribution (woody) does not contain pdfkit.framework\npackages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8-2sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your pdfkit.framework package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" and Chris Evans discovered several heap based buffer\noverflows in xpdf which are also present in pdftohtml, a utility that\ntranslates PDF documents into HTML format, and which can lead to a\ndenial of service by crashing the application or possibly to the\nexecution of arbitrary code.
\nThe old stable distribution (woody) does not contain pdftohtml packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.36-11sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your pdftohtml package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNISCC reported that MyDNS, a DNS server using an SQL database for data\nstorage, can be tricked into an infinite loop by a remote attacker and\nhence cause a denial of service condition.
\nThe old stable distribution (woody) does not contain mydns packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.0-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.0+pre-3.
\nWe recommend that you upgrade your mydns package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in gnocatan, the computer version of the\nsettlers of Catan boardgame, that can lead the server and other clients\nto exit via an assert, and hence does not permit the execution of\narbitrary code. The game has been renamed into Pioneers after the\nrelease of Debian sarge.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.6.1-5woody3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.8.1.59-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.49-1 of pioneers.
\nWe recommend that you upgrade your gnocatan and pioneers packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe Internet Key Exchange version 1 (IKEv1) implementation in racoon\nfrom ipsec-tools, IPsec tools for Linux, try to dereference a NULL\npointer under certain conditions which allows a remote attacker to\ncause a denial of service.
\nThe old stable distribution (woody) does not contain ipsec-tools.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.5.2-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.6.3-1.
\nWe recommend that you upgrade your racoon package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThomas Reifferscheid discovered that adzapper, a proxy advertisement\nzapper add-on, when installed as plugin in squid, the Internet object\ncache, can consume a lot of CPU resources and hence cause a denial of\nservice on the proxy host.
\nThe old stable distribution (woody) does not contain an adzapper package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 20050316-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 20060115-1.
\nWe recommend that you upgrade your adzapper package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security problems have been found in elog, an electronic logbook\nto manage notes. The Common Vulnerabilities and Exposures Project\nidentifies the following problems:
\n\"GroundZero Security\" discovered that elog insufficiently checks the\n size of a buffer used for processing URL parameters, which might lead\n to the execution of arbitrary code.
It was discovered that elog contains a directory traversal vulnerability\n in the processing of \"../\" sequences in URLs, which might lead to\n information disclosure.
The code to write the log file contained a format string vulnerability,\n which might lead to the execution of arbitrary code.
Overly long revision attributes might trigger a crash due to a buffer\n overflow.
The code to write the log file does not enforce bounds checks properly,\n which might lead to the execution of arbitrary code.
elog emitted different errors messages for invalid passwords and invalid\n users, which allows an attacker to probe for valid user names.
An attacker could be driven into infinite redirection with a crafted\n \"fail\" request, which has denial of service potential.
The old stable distribution (woody) does not contain elog packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.5.7+r1558-4+sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.6.1+r1642-1.
\nWe recommend that you upgrade your elog package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a from the Debian Security Audit project\ndiscovered that a script in noweb, a web like literate-programming\ntool, creates a temporary file in an insecure fashion.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.9a-7.4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.10c-3.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.10c-3.2.
\nWe recommend that you upgrade your nowebm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler discovered a vulnerability in scponly, a utility to\nrestrict user commands to scp and sftp, that could lead to the\nexecution of arbitrary commands as root. The system is only vulnerable\nif the program scponlyc is installed setuid root and if regular users\nhave shell access to the machine.
\nThe old stable distribution (woody) does not contain an scponly package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.0-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.6-1.
\nWe recommend that you upgrade your scponly package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJohannes Greil of SEC Consult discovered several cross-site scripting\nvulnerabilities in kronolith, the Horde calendar application.
\nThe old stable distribution (woody) does not contain kronolith packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.1.4-2sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.6-1 of kronolith2.
\nWe recommend that you upgrade your kronolith and kronolith2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSuSE researchers discovered heap overflow errors in xpdf, the Portable\nDocument Format (PDF) suite, that can allow attackers to cause a\ndenial of service by crashing the application or possibly execute\narbitrary code.
\nThe old stable distribution (woody) is not affected.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.00-13.5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.01-6.
\nWe recommend that you upgrade your xpdf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSuSE researchers discovered heap overflow errors in xpdf, the Portable\nDocument Format (PDF) suite, which is also present in\npdfkit.framework, the GNUstep framework for rendering PDF content, and\nwhich can allow attackers to cause a denial of service by crashing the\napplication or possibly execute arbitrary code.
\nThe old stable distribution (woody) does not contain pdfkit.framework\npackages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8-2sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.8-4 by switching to poppler.
\nWe recommend that you upgrade your pdfkit.framework package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in otrs, the Open Ticket\nRequest System, that can be exploited remotely. The Common\nVulnerabilities and Exposures Project identifies the following\nproblems:
\nMultiple SQL injection vulnerabilities allow remote attackers to\n execute arbitrary SQL commands and bypass authentication.
Multiple cross-site scripting vulnerabilities allow remote\n authenticated users to inject arbitrary web script or HTML.
Internally attached text/html mails are rendered as HTML when the\n queue moderator attempts to download the attachment, which allows\n remote attackers to execute arbitrary web script or HTML.
The old stable distribution (woody) does not contain OTRS packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.3.2p01-6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.4p01-1.
\nWe recommend that you upgrade your otrs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSuSE researchers discovered heap overflow errors in xpdf, the Portable\nDocument Format (PDF) suite, which is also present in gpdf, the GNOME\nversion of the Portable Document Format viewer, and which can allow\nattackers to cause a denial of service by crashing the application or\npossibly execute arbitrary code.
\nThe old stable distribution (woody) does not contain gpdf packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.8.2-1.2sarge3.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your gpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner discovered that attackers can trigger a buffer overflow\nin the path handling code by creating or abusing existing symlinks, which\nmay lead to the execution of arbitrary code.
\nThis vulnerability isn't present in the kernel NFS server.
\nThis update includes a bugfix for attribute handling of symlinks. This\nfix does not have security implications, but at the time when this DSA\nwas prepared it was already queued for the next stable point release, so\nwe decided to include it beforehand.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.2beta47-12woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2beta47-20sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2beta47-22.
\nWe recommend that you upgrade your nfs-user-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJohnny Mast discovered a buffer overflow in libast, the library of\nassorted spiffy things, that can lead to the execution of arbitrary\ncode. This library is used by eterm which is installed setgid uid\nwhich leads to a vulnerability to alter the utmp file.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.4-3woody2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.6-0pre2003010606sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your libast packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in heimdal, a free\nimplementation of Kerberos 5. The Common Vulnerabilities and\nExposures project identifies the following vulnerabilities:
\nPrivilege escalation in the rsh server allows an authenticated\n attacker to overwrite arbitrary files and gain ownership of them.
A remote attacker could force the telnet server to crash before\n the user logged in, resulting in inetd turning telnetd off because\n it forked too fast.
The old stable distribution (woody) does not expose rsh and telnet servers.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.6.3-10sarge2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your heimdal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy noticed that gnupg, the GNU privacy guard - a free PGP\nreplacement, verifies external signatures of files successfully even\nthough they don't contain a signature at all.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.0.6-4woody4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4.1-1sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your gnupg package.
\nPlease note that this security advisory has been superseded by\nDSA 993. Therefore, the\nupdated packages are no longer available from this page.
\nDerek Noonburg has fixed several potential vulnerabilities in xpdf,\nthe Portable Document Format (PDF) suite, which are also present in\npdfkit.framework, the GNUstep framework for rendering PDF content.
\nThe old stable distribution (woody) does not contain pdfkit.framework\npackages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8-2sarge3.
\nThe unstable distribution (sid) is not affected by these problems.
\nWe recommend that you upgrade your pdfkit.framework package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJoxean Koret discovered several security problems in tutos, a web-based\nteam organization software. The Common Vulnerabilities and Exposures Project\nidentifies the following problems:
\nAn SQL injection vulnerability allows the execution of SQL commands\n through the link_id parameter in file_overview.php.
Cross-Site-Scripting vulnerabilities in the search function of the\n address book and in app_new.php allow the execution of web script\n code.
The old stable distribution (woody) does not contain tutos packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.1.20031017-2+1sarge1.
\nThe unstable distribution (sid) does no longer contain tutos packages.
\nWe recommend that you upgrade your tutos package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"felinemalice\" discovered an integer overflow in BMV, a post script viewer\nfor SVGAlib, that may lead to the execution of arbitrary code through\nspecially crafted Postscript files.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.2-14.3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2-17sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2-18.
\nWe recommend that you upgrade your bmv package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDerek Noonburg has fixed several potential vulnerabilities in xpdf,\nwhich are also present in gpdf, the Portable Document Format (PDF)\nviewer with Gtk bindings.
\nThe old stable distribution (woody) does not contain gpdf packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.8.2-1.2sarge4.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your gpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDerek Noonburg has fixed several potential vulnerabilities in xpdf,\nwhich are also present in pdftohtml, a utility that translates PDF\ndocuments into HTML format.
\nThe old stable distribution (woody) does not contain pdftohtml packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.36-11sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.36-12.
\nWe recommend that you upgrade your pdftohtml package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDerek Noonburg has fixed several potential vulnerabilities in xpdf,\nthe Portable Document Format (PDF) suite.
\nThe old stable distribution (woody) does not seem to be affected.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.00-13.6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.01-7.
\nWe recommend that you upgrade your xpdf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component of the Tiny ASN.1 Library that allows\nattackers to crash the DER decoder and possibly execute arbitrary code.
\nThe old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2_0.2.10-3sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your libtasn1 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component of the Tiny ASN.1 Library, which is\nalso present and used in GnuTLS, the GNU implementation for Transport\nLayer Security (TLS) 1.0 and Secure Sockets Layer (SSL) 3.0 protocols\nand which allows attackers to crash the DER decoder and possibly\nexecute arbitrary code.
\nThe old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.0.16-13.2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your gnutls packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJim Meyering discovered several buffer overflows in GNU tar, which may\nlead to the execution of arbitrary code through specially crafted tar\narchives.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.14-2.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.15.1-3.
\nWe recommend that you upgrade your tar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Squirrelmail, a\ncommonly used webmail system. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMartijn Brinkers and Ben Maurer found a flaw in webmail.php that\n allows remote attackers to inject arbitrary web pages into the right\n frame via a URL in the right_frame parameter.
Martijn Brinkers and Scott Hughes discovered an interpretation\n conflict in the MagicHTML filter that allows remote attackers to\n conduct cross-site scripting (XSS) attacks via style sheet\n specifiers with invalid (1) \"/*\" and \"*/\" comments, or (2) slashes\n inside the \"url\" keyword, which is processed by some web browsers\n including Internet Explorer.
Vicente Aguilera of Internet Security Auditors, S.L. discovered a\n CRLF injection vulnerability, which allows remote attackers to\n inject arbitrary IMAP commands via newline characters in the mailbox\n parameter of the sqimap_mailbox_select command, aka \"IMAP\n injection.\" There's no known way to exploit this yet.
For the old stable distribution (woody) these problems have been fixed in\nversion 1.2.6-5.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2:1.4.4-8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2:1.4.6-1.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNeil McBride discovered that Zoph, a web based photo management system\nperforms insufficient sanitising for input passed to photo searches, which\nmay lead to the execution of SQL commands through a SQL injection attack.
\nThe old stable distribution (woody) does not contain zoph packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.3.3-12sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.5-1.
\nWe recommend that you upgrade your zoph package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA denial of service condition has been discovered in bluez-hcidump, a\nutility that analyses Bluetooth HCI packets, which can be triggered\nremotely.
\nThe old stable distribution (woody) does not contain bluez-hcidump packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.17-1sarge1
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.30-1.
\nWe recommend that you upgrade your bluez-hcidump package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJean-S\u00e9bastien Guay-Leroux discovered a buffer overflow in zoo, a\nutility to manipulate zoo archives, that could lead to the execution\nof arbitrary code when unpacking a specially crafted zoo archive.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.10-9woody0.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.10-11sarge0.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.10-17.
\nWe recommend that you upgrade your zoo package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSimon Kilvington discovered that specially crafted PNG images can trigger\na heap overflow in libavcodec, the multimedia library of ffmpeg, which may\nlead to the execution of arbitrary code.
\nThe old stable distribution (woody) doesn't contain ffmpeg packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.cvs20050313-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.cvs20050918-5.1.
\nWe recommend that you upgrade your ffmpeg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy noticed that gnupg, the GNU privacy guard - a free PGP\nreplacement, can be tricked to emit a \"good signature\" status message\nwhen a valid signature is included which does not belong to the data\npacket. This update basically adds fixed packages for woody whose\nversion turned out to be vulnerable as well.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.0.6-4woody5.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4.1-1.sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4.2.2-1.
\nWe recommend that you upgrade your gnupg package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nLuigi Auriemma discovered a denial of service condition in the free\nCivilization server that allows a remote user to trigger a server\ncrash.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.1-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.8-1.
\nWe recommend that you upgrade your freeciv-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered a buffer overflow in metamail, an\nimplementation of MIME (Multi-purpose Internet Mail Extensions), that\ncould lead to a denial of service or potentially execute arbitrary\ncode when processing messages.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.7-45woody.4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.7-47sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.7-51.
\nWe recommend that you upgrade your metamail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLincoln Stein discovered that the Perl Crypt::CBC module produces weak\nciphertext when used with block encryption algorithms with blocksize >\n8 bytes.
\nThe old stable distribution (woody) does not contain a Crypt::CBC module.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.12-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.17-1.
\nWe recommend that you upgrade your libcrypt-cbc-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Cornelius of Gentoo Security discovered that bomberclone, a\nfree Bomberman-like game, crashes when receiving overly long error\npackets, which may also allow remote attackers to execute arbitrary\ncode.
\nThe old stable distribution (woody) does not contain bomberclone packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.11.5-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.11.6.2-1.
\nWe recommend that you upgrade your bomberclone package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDerek Noonburg has fixed several potential vulnerabilities in xpdf,\nwhich are also present in libextractor, a library to extract arbitrary\nmeta-data from files.
\nThe old stable distribution (woody) does not contain libextractor packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.4.2-2sarge3.
\nFor the unstable distribution (sarge) these problems have been fixed in\nversion 0.5.10-1.
\nWe recommend that you upgrade your libextractor package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in lurker, an\narchive tool for mailing lists with integrated search engine. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nLurker's mechanism for specifying configuration files was\n vulnerable to being overridden. As lurker includes sections of\n unparsed config files in its output, an attacker could manipulate\n lurker into reading any file readable by the www-data user.
It is possible for a remote attacker to create or overwrite files\n in any writable directory that is named \"mbox\".
Missing input sanitising allows an attacker to inject arbitrary\n web script or HTML.
The old stable distribution (woody) does not contain lurker packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.2-5sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.1-1.
\nWe recommend that you upgrade your lurker package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGunnar Wolf noticed that the correction for the following problem was\nnot complete and requires an update. For completeness we're\nproviding the original problem description:
\n\n\nAn algorithm weakness has been discovered in Apache2::Request, the\ngeneric request library for Apache2 which can be exploited remotely\nand cause a denial of service via CPU consumption.
\n
The old stable distribution (woody) does not contain this package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.04-dev-1sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.07-1.
\nWe recommend that you upgrade your libapreq2, libapache2-mod-apreq2\nand libapache2-request-perl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nIt was discovered that Crossfire, a multiplayer adventure game, performs\ninsufficient bounds checking on network packets when run in \"oldsocketmode\",\nwhich may possibly lead to the execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.1.0-1woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.6.0.dfsg.1-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.9.0-1.
\nWe recommend that you upgrade your crossfire packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in webcalendar,\na PHP based multi-user calendar. The Common Vulnerabilities and\nExposures project identifies the following vulnerabilities:
\nMultiple SQL injection vulnerabilities allow remote attackers to\n execute arbitrary SQL commands.
Missing input sanitising allows an attacker to overwrite local\n files.
A CRLF injection vulnerability allows remote attackers to modify\n HTTP headers and conduct HTTP response splitting attacks.
The old stable distribution (woody) does not contain webcalendar packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.9.45-4sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.2-1.
\nWe recommend that you upgrade your webcalendar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEric Romang discovered that xpvm, a graphical console and monitor for\nPVM, creates a temporary file that allows local attackers to create or\noverwrite arbitrary files with the privileges of the user running\nxpvm.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.2.5-7.2woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2.5-7.3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.5-8.
\nWe recommend that you upgrade your xpvm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSimon Kilvington discovered that specially crafted PNG images can trigger\na heap overflow in libavcodec, the multimedia library of ffmpeg, which may\nlead to the execution of arbitrary code.\nThe vlc media player links statically against libavcodec.
\nThe old stable distribution (woody) isn't affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.8.1.svn20050314-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.8.4.debian-2.
\nWe recommend that you upgrade your vlc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSimon Kilvington discovered that specially crafted PNG images can trigger\na heap overflow in libavcodec, the multimedia library of ffmpeg, which may\nlead to the execution of arbitrary code.\nxine-lib includes a local copy of libavcodec.
\nThe old stable distribution (woody) isn't affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.1-1sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.1-1.5.
\nWe recommend that you upgrade your xine-lib package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"kcope\" discovered that the wzdftpd FTP server lacks input sanitising\nfor the SITE command, which may lead to the execution of arbitrary\nshell commands.
\nThe old stable distribution (woody) does not contain wzdftpd packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.5.2-1.1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.5.5-1.
\nWe recommend that you upgrade your wzdftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe Drupal Security Team discovered several vulnerabilities in Drupal,\na fully-featured content management and discussion engine. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nDue to missing input sanitising a remote attacker could inject\n headers of outgoing e-mail messages and use Drupal as a spam\n proxy.
Missing input sanity checks allows attackers to inject arbitrary\n web script or HTML.
Menu items created with the menu.module lacked access control,\n which might allow remote attackers to access administrator pages.
Markus Petrux discovered a bug in the session fixation which may\n allow remote attackers to gain Drupal user privileges.
The old stable distribution (woody) does not contain Drupal packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 4.5.3-6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.5.8-1.
\nWe recommend that you upgrade your drupal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcelo Ricardo Leitner noticed that the current patch in DSA 932\n(CVE-2005-3627) for kpdf, the PDF viewer for KDE, does not fix all\nbuffer overflows, still allowing an attacker to execute arbitrary\ncode.
\nThe old stable distribution (woody) does not contain kpdf packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.3.2-2sarge4.
\nThe unstable distribution (sid) is not affected by this problem.
\nWe recommend that you upgrade your kpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the crossfire game which\nallows remote attackers to execute arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.1.0-1woody2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.6.0.dfsg.1-4sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.9.0-2.
\nWe recommend that you upgrade your crossfire package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered that\nilohamail, a lightweight multilingual web-based IMAP/POP3 client, does\nnot always sanitise input provided by users which allows remote\nattackers to inject arbitrary web script or HTML.
\nThe old stable distribution (woody) does not contain an ilohamail\npackage.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8.14-0rc3sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.8.14-0rc3sarge1.
\nWe recommend that you upgrade your ilohamail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Debian vserver\nsupport for Linux. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nBj\u00f8rn Steinbrink discovered that the chroot barrier is not set\n correctly with util-vserver which may result in unauthorised\n escapes from a vserver to the host system.
\nThis vulnerability is limited to the 2.4 kernel patch included in\n kernel-patch-vserver. The correction to this problem requires\n updating the util-vserver package as well and installing a new\n kernel built from the updated kernel-patch-vserver package.
The default policy of util-vserver is set to trust all unknown\n capabilities instead of considering them as insecure.
The old stable distribution (woody) does not contain a\nkernel-patch-vserver package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.9.5.5 of kernel-patch-vserver and in version\n0.30.204-5sarge3 of util-vserver.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3 of kernel-patch-vserver and in version 0.30.208-1 of\nutil-vserver.
\nWe recommend that you upgrade your util-vserver and\nkernel-patch-vserver packages and build a new kernel immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow in the command line argument parsing has been\ndiscovered in unzip, the de-archiver for ZIP files, that could lead to\nthe execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 5.50-1woody6.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 5.52-1sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.52-7.
\nWe recommend that you upgrade your unzip package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nWill Aoki discovered that snmptrapfmt, a configurable snmp trap\nhandler daemon for snmpd, does not prevent overwriting existing files\nwhen writing to a temporary log file.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.03woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.08sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.10-1.
\nWe recommend that you upgrade your snmptrapfmt package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAviram Jenik and Damyan Ivanov discovered a buffer overflow in\nfirebird2, an RDBMS based on InterBase 6.0 code, that allows remote\nattackers to crash.
\nThe old stable distribution (woody) does not contain firebird2 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.5.1-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.5.3.4870-3
\nWe recommend that you upgrade your firebird2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMark Dowd discovered a flaw in the handling of asynchronous signals in\nsendmail, a powerful, efficient, and scalable mail transport agent.\nThis allows a remote attacker to exploit a race condition to\nexecute arbitrary code as root.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 8.12.3-7.2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 8.13.4-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 8.13.6-1.
\nWe recommend that you upgrade your sendmail package immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered several format string vulnerabilities in\nEvolution, a free groupware suite, that could lead to crashes of the\napplication or the execution of arbitrary code.
\nFor the old stable distribution (woody) these problems have been fixed\nin version 1.0.5-1woody3.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.0.4-2sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.2.3-3.
\nWe recommend that you upgrade your evolution package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nMultiple overflows exist in the io_edgeport driver which might be usable\n as a denial of service attack vector.
Bryan Fulton reported a bounds checking bug in the coda_pioctl function\n which may allow local users to execute arbitrary code or trigger a denial\n of service attack.
An error in the skb_checksum_help() function from the netfilter framework\n has been discovered that allows the bypass of packet filter rules or\n a denial of service attack.
Tim Yamin discovered that insufficient input validation in the zisofs driver\n for compressed ISO file systems allows a denial of service attack through\n maliciously crafted ISO images.
A buffer overflow in the sendmsg() function allows local users to execute\n arbitrary code.
Herbert Xu discovered that the setsockopt() function was not restricted to\n users/processes with the CAP_NET_ADMIN capability. This allows attackers to\n manipulate IPSEC policies or initiate a denial of service attack.
Al Viro discovered a race condition in the /proc handling of network devices.\n A (local) attacker could exploit the stale reference after interface shutdown\n to cause a denial of service or possibly execute code in kernel mode.
Jan Blunck discovered that repeated failed reads of /proc/scsi/sg/devices\n leak memory, which allows a denial of service attack.
Tetsuo Handa discovered that the udp_v6_get_port() function from the IPv6 code\n can be forced into an endless loop, which allows a denial of service attack.
Vasiliy Averin discovered that the reference counters from sockfd_put() and\n fput() can be forced into overlapping, which allows a denial of service attack\n through a null pointer dereference.
Eric Dumazet discovered that the set_mempolicy() system call accepts a negative\n value for its first argument, which triggers a BUG() assert. This allows a\n denial of service attack.
Harald Welte discovered that if a process issues a USB Request Block (URB)\n to a device and terminates before the URB completes, a stale pointer\n would be dereferenced. This could be used to trigger a denial of service\n attack.
Pavel Roskin discovered that the driver for Orinoco wireless cards clears\n its buffers insufficiently. This could leak sensitive information into\n user space.
Robert Derr discovered that the audit subsystem uses an incorrect function to\n free memory, which allows a denial of service attack.
Rudolf Polzer discovered that the kernel improperly restricts access to the\n KDSKBSENT ioctl, which can possibly lead to privilege escalation.
Doug Chapman discovered that the mq_open syscall can be tricked into\n decrementing an internal counter twice, which allows a denial of service attack\n through a kernel panic.
Doug Chapman discovered that passing a zero bitmask to the set_mempolicy()\n system call leads to a kernel panic, which allows a denial of service attack.
The ptrace code using CLONE_THREAD didn't use the thread group ID to\n determine whether the caller is attaching to itself, which allows a denial\n of service attack.
The auto-reaping of child processes functionality included ptraced-attached\n processes, which allows denial of service through dangling references.
Yen Zheng discovered that the IPv6 flow label code modified an incorrect variable,\n which could lead to memory corruption and denial of service.
It was discovered that a threaded real-time process, which is currently dumping\n core can be forced into a dead-lock situation by sending it a SIGKILL signal,\n which allows a denial of service attack.
Ollie Wild discovered a memory leak in the icmp_push_reply() function, which\n allows denial of service through memory consumption.
Chris Wright discovered that excessive allocation of broken file lock leases\n in the VFS layer can exhaust memory and fill up the system logging, which allows\n denial of service.
Patrick McHardy discovered a memory leak in the ip6_input_finish() function from\n the IPv6 code, which allows denial of service.
Karl Janmar discovered that a signedness error in the procfs code can be exploited\n to read kernel memory, which may disclose sensitive information.
Yi Ying discovered that sysctl does not properly enforce the size of a buffer, which\n allows a denial of service attack.
Stefan Rompf discovered that dm_crypt does not clear an internal struct before freeing\n it, which might disclose sensitive information.
It was discovered that the SDLA driver's capability checks were too lax\n for firmware upgrades.
Ludovic Courtes discovered that get_compat_timespec() performs insufficient input\n sanitizing, which allows a local denial of service attack.
It was discovered that ptrace() on the ia64 architecture allows a local denial of\n service attack, when preemption is enabled.
The following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.6.8-16sarge2 |
| Alpha architecture | 2.6.8-16sarge2 |
| AMD64 architecture | 2.6.8-16sarge2 |
| HP Precision architecture | 2.6.8-6sarge2 |
| Intel IA-32 architecture | 2.6.8-16sarge2 |
| Intel IA-64 architecture | 2.6.8-14sarge2 |
| Motorola 680x0 architecture | 2.6.8-4sarge2 |
| PowerPC architecture | 2.6.8-12sarge2 |
| IBM S/390 architecture | 2.6.8-5sarge2 |
| Sun Sparc architecture | 2.6.8-15sarge2 |
The following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| Debian 3.1 (sarge) | |
|---|---|
| kernel-latest-2.6-alpha | 101sarge1 |
| kernel-latest-2.6-amd64 | 103sarge1 |
| kernel-latest-2.6-hppa | 2.6.8-1sarge1 |
| kernel-latest-2.6-sparc | 101sarge1 |
| kernel-latest-2.6-i386 | 101sarge1 |
| kernel-latest-powerpc | 102sarge1 |
| fai-kernels | 1.9.1sarge1 |
| hostap-modules-i386 | 0.3.7-1sarge1 |
| mol-modules-2.6.8 | 0.9.70+2.6.8+12sarge1 |
| ndiswrapper-modules-i386 | 1.1-2sarge1 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nThis update introduces a change in the kernel's binary interface, the affected\nkernel packages inside Debian have been rebuilt, if you're running local addons\nyou'll need to rebuild these as well. Due to the change in the package\nname you need to use apt-get dist-upgrade to update your system.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe original update lacked recompiled ALSA modules against the new kernel\nABI. Furthermore, kernel-latest-2.4-sparc now correctly depends on the\nupdated packages. For completeness we're providing the original problem description:\n
\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\n\n
\n- CVE-2004-0887\n
\nMartin Schwidefsky discovered that the privileged instruction SACF (Set\n Address Space Control Fast) on the S/390 platform is not handled properly,\n allowing for a local user to gain root privileges.
- CVE-2004-1058\n
\nA race condition allows for a local user to read the environment variables\n of another process that is still spawning through /proc/.../cmdline.
- CVE-2004-2607\n
\nA numeric casting discrepancy in sdla_xfer allows local users to read\n portions of kernel memory via a large len argument which is received as an\n int but cast to a short, preventing read loop from filling a buffer.
- CVE-2005-0449\n
\nAn error in the skb_checksum_help() function from the netfilter framework\n has been discovered that allows the bypass of packet filter rules or\n a denial of service attack.
- CVE-2005-1761\n
\nA vulnerability in the ptrace subsystem of the IA-64 architecture can\n allow local attackers to overwrite kernel memory and crash the kernel.
- CVE-2005-2457\n
\nTim Yamin discovered that insufficient input validation in the compressed\n ISO file system (zisofs) allows a denial of service attack through\n maliciously crafted ISO images.
- CVE-2005-2555\n
\nHerbert Xu discovered that the setsockopt() function was not restricted to\n users/processes with the CAP_NET_ADMIN capability. This allows attackers to\n manipulate IPSEC policies or initiate a denial of service attack.
- CVE-2005-2709\n
\nAl Viro discovered a race condition in the /proc handling of network devices.\n A (local) attacker could exploit the stale reference after interface shutdown\n to cause a denial of service or possibly execute code in kernel mode.
- CVE-2005-2973\n
\nTetsuo Handa discovered that the udp_v6_get_port() function from the IPv6 code\n can be forced into an endless loop, which allows a denial of service attack.
- CVE-2005-3257\n
\nRudolf Polzer discovered that the kernel improperly restricts access to the\n KDSKBSENT ioctl, which can possibly lead to privilege escalation.
- CVE-2005-3783\n
\nThe ptrace code using CLONE_THREAD didn't use the thread group ID to\n determine whether the caller is attaching to itself, which allows a denial\n of service attack.
- CVE-2005-3806\n
\nYen Zheng discovered that the IPv6 flow label code modified an incorrect variable,\n which could lead to memory corruption and denial of service.
- CVE-2005-3848\n
\nOllie Wild discovered a memory leak in the icmp_push_reply() function, which\n allows denial of service through memory consumption.
- CVE-2005-3857\n
\nChris Wright discovered that excessive allocation of broken file lock leases\n in the VFS layer can exhaust memory and fill up the system logging, which allows\n denial of service.
- CVE-2005-3858\n
\nPatrick McHardy discovered a memory leak in the ip6_input_finish() function from\n the IPv6 code, which allows denial of service.
- CVE-2005-4618\n
\nYi Ying discovered that sysctl does not properly enforce the size of a\n buffer, which allows a denial of service attack.
The following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.4.27-10sarge2 |
| Alpha architecture | 2.4.27-10sarge2 |
| ARM architecture | 2.4.27-2sarge2 |
| Intel IA-32 architecture | 2.4.27-10sarge2 |
| Intel IA-64 architecture | 2.4.27-10sarge2 |
| Motorola 680x0 architecture | 2.4.27-3sarge2 |
| Big endian MIPS architecture | 2.4.27-10.sarge1.040815-2 |
| Little endian MIPS architecture | 2.4.27-10.sarge1.040815-2 |
| PowerPC architecture | 2.4.27-10sarge2 |
| IBM S/390 architecture | 2.4.27-2sarge2 |
| Sun Sparc architecture | 2.4.27-9sarge2 |
The following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| Debian 3.1 (sarge) | |
|---|---|
| kernel-latest-2.4-alpha | 101sarge1 |
| kernel-latest-2.4-i386 | 101sarge1 |
| kernel-latest-2.4-s390 | 2.4.27-1sarge1 |
| kernel-latest-2.4-sparc | 42sarge1 |
| kernel-latest-powerpc | 102sarge1 |
| fai-kernels | 1.9.1sarge1 |
| i2c | 1:2.9.1-1sarge1 |
| kernel-image-speakup-i386 | 2.4.27-1.1sasrge1 |
| lm-sensors | 1:2.9.1-1sarge3 |
| mindi-kernel | 2.4.27-2sarge1 |
| pcmcia-modules-2.4.27-i386 | 3.2.5+2sarge1 |
| systemimager | 3.2.3-6sarge1 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nThis update introduces a change in the kernel's binary interface, the affected\nkernel packages inside Debian have been rebuilt, if you're running local addons\nyou'll need to rebuild these as well.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nDerek Noonburg has fixed several potential vulnerabilities in xpdf,\nthe Portable Document Format (PDF) suite, which is also present in\nkoffice, the KDE Office Suite.
\nThe old stable distribution (woody) does not contain koffice packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.3.5-4.sarge.3.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your koffice packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Moore discovered that flex, a scanner generator, generates code,\nwhich allocates insufficient memory, if the grammar contains REJECT\nstatements or trailing context rules. This may lead to a buffer overflow\nand the execution of arbitrary code.
\nIf you use code, which is derived from a vulnerable lex grammar in\nan untrusted environment you need to regenerate your scanner with the\nfixed version of flex.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.5.31-31sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.5.33-1.
\nWe recommend that you upgrade your flex package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Vozeler from the Debian Audit Project discovered that pstopnm, a\nconverter from Postscript to the PBM, PGM and PNM formats, launches\nGhostscript in an insecure manner, which might lead to the execution\nof arbitrary shell commands, when converting specially crafted Postscript\nfiles.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 9.20-8.6.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 10.0-8sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 10.0-9.
\nWe recommend that you upgrade your netpbm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the backup utility\nstorebackup. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nStorebackup creates a temporary file predictably, which can be\n exploited to overwrite arbitrary files on the system with a symlink\n attack.
The backup root directory wasn't created with fixed permissions, which may lead to\n inproper permissions if the umask is too lax.
The user and group rights of symlinks are set incorrectly when making\n or restoring a backup, which may leak sensitive data.
The old stable distribution (woody) doesn't contain storebackup packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.18.4-2sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.19-2.
\nWe recommend that you upgrade your storebackup package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner discovered that kaffeine, a versatile media player for\nKDE 3, contains an unchecked buffer that can be overwritten remotely\nwhen fetching remote RAM playlists which can cause the execution of\narbitrary code.
\nThe old stable distribution (woody) does not contain kaffeine packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.6-1sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your kaffeine package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the ClamAV\nanti-virus toolkit, which may lead to denial of service and potentially\nto the execution of arbitrary code. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nDamian Put discovered an integer overflow in the PE header parser.\n This is only exploitable if the ArchiveMaxFileSize option is disabled.
Format string vulnerabilities in the logging code have been discovered,\n which might lead to the execution of arbitrary code.
David Luyer discovered, that ClamAV can be tricked into an invalid\n memory access in the cli_bitset_set() function, which may lead to\n a denial of service.
The old stable distribution (woody) doesn't contain clamav packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.88.1-1.
\nWe recommend that you upgrade your clamav package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"infamous41md\" discovered three buffer overflow errors in the xfig\nimport code of dia, a diagram editor, that can lead to the execution\nof arbitrary code.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 0.88.1-3woody1.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.94.0-7sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.94.0-18.
\nWe recommend that you upgrade your dia package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarkus Oberhumer discovered a flaw in the way zlib, a library used for\nfile compression and decompression, handles invalid input. This flaw can\ncause programs which use zlib to crash when opening an invalid file.\nA further error in the way zlib handles the inflation of certain\ncompressed files can cause a program which uses zlib to crash when opening\nan invalid file.
\nsash, the stand-alone shell, links statically against zlib, and was\nthus affected by these problems.
\nThe old stable distribution (woody) isn't affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.7-5sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.7-6.
\nWe recommend that you upgrade your sash package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA potential denial of service problem has been discovered in mailman,\nthe web-based GNU mailing list manager. The (failing) parsing of\nmessages with malformed mime multiparts sometimes caused the whole\nmailing list to become inoperative.
\nThe old stable distribution (woody) is not vulnerable to this issue.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.1.5-8sarge2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your mailman package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKjetil Kjernsmo discovered a bug in libimager-perl, a Perl extension\nfor generating 24 bit images, which can lead to a segmentation fault\nif it operates on 4-channel JPEG images.
\nThe old stable distribution (woody) does not contain this package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.44-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.50-1.
\nWe recommend that you upgrade your libimager-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in libphp-adodb, the 'adodb'\ndatabase abstraction layer for PHP. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nAndreas Sandblad discovered that improper user input sanitisation\n results in a potential remote SQL injection vulnerability enabling\n an attacker to compromise applications, access or modify data, or\n exploit vulnerabilities in the underlying database implementation.\n This requires the MySQL root password to be empty. It is fixed by\n limiting access to the script in question.
A dynamic code evaluation vulnerability allows remote attackers to\n execute arbitrary PHP functions via the 'do' parameter.
Andy Staudacher discovered an SQL injection vulnerability due to\n insufficient input sanitising that allows remote attackers to\n execute arbitrary SQL commands.
GulfTech Security Research discovered multiple cross-site\n scripting vulnerabilities due to improper user-supplied input\n sanitisation. Attackers can exploit these vulnerabilities to\n cause arbitrary scripts to be executed in the browser of an\n unsuspecting user's machine, or result in the theft of\n cookie-based authentication credentials.
For the old stable distribution (woody) these problems have been fixed in\nversion 1.51-1.2.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 4.52-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.72-0.1.
\nWe recommend that you upgrade your libphp-adodb package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in libphp-adodb, the\n'adodb' database abstraction layer for PHP, which is embedded in\nmoodle, a course management system for online learning. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nAndreas Sandblad discovered that improper user input sanitisation\n results in a potential remote SQL injection vulnerability enabling\n an attacker to compromise applications, access or modify data, or\n exploit vulnerabilities in the underlying database implementation.\n This requires the MySQL root password to be empty. It is fixed by\n limiting access to the script in question.
A dynamic code evaluation vulnerability allows remote attackers to\n execute arbitrary PHP functions via the 'do' parameter.
Andy Staudacher discovered an SQL injection vulnerability due to\n insufficient input sanitising that allows remote attackers to\n execute arbitrary SQL commands.
GulfTech Security Research discovered multiple cross-site\n scripting vulnerabilities due to improper user-supplied input\n sanitisation. Attackers can exploit these vulnerabilities to\n cause arbitrary scripts to be executed in the browser of an\n unsuspecting user's machine, or result in the theft of\n cookie-based authentication credentials.
The old stable distribution (woody) does not contain moodle packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.4.4.dfsg.1-3sarge1.
\nFor the unstable distribution these problems will be fixed soon.
\nWe recommend that you upgrade your moodle package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in libphp-adodb, the\n'adodb' database abstraction layer for PHP, which is embedded in\ncacti, a frontend to rrdtool for monitoring systems and services. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nAndreas Sandblad discovered that improper user input sanitisation\n results in a potential remote SQL injection vulnerability enabling\n an attacker to compromise applications, access or modify data, or\n exploit vulnerabilities in the underlying database implementation.\n This requires the MySQL root password to be empty. It is fixed by\n limiting access to the script in question.
A dynamic code evaluation vulnerability allows remote attackers to\n execute arbitrary PHP functions via the 'do' parameter.
Andy Staudacher discovered an SQL injection vulnerability due to\n insufficient input sanitising that allows remote attackers to\n execute arbitrary SQL commands.
GulfTech Security Research discovered multiple cross-site\n scripting vulnerabilities due to improper user-supplied input\n sanitisation. Attackers can exploit these vulnerabilities to\n cause arbitrary scripts to be executed in the browser of an\n unsuspecting user's machine, or result in the theft of\n cookie-based authentication credentials.
The old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8.6c-7sarge3.
\nFor the unstable distribution these problems will be fixed soon.
\nWe recommend that you upgrade your cacti package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Plone content management system lacks security\ndeclarations for three internal classes. This allows manipulation of user\nportraits by unprivileged users.
\nThe old stable distribution (woody) doesn't contain Plone.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.4-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.1.2-2.
\nWe recommend that you upgrade your zope-cmfplone package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Horde web\napplication framework, which may lead to the execution of arbitrary\nweb script code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nSeveral Cross-Site-Scripting vulnerabilities have been discovered in\n the \"share edit window\".
Null characters in the URL parameter bypass a sanity check, which\n allowed remote attackers to read arbitrary files, which allowed\n information disclosure.
User input in the help viewer was passed unsanitised to the eval()\n function, which allowed injection of arbitrary web code.
The old stable distribution (woody) doesn't contain horde3 packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.0.4-4sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.1.1-1.
\nWe recommend that you upgrade your horde3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Horde web\napplication framework, which may lead to the execution of arbitrary\nweb script code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nNull characters in the URL parameter bypass a sanity check, which\n allowed remote attackers to read arbitrary files, which allowed\n information disclosure.
User input in the help viewer was passed unsanitised to the eval()\n function, which allowed injection of arbitrary web code.
The old stable distribution (woody) doesn't contain horde2 packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.2.8-1sarge2.
\nThe unstable distribution (sid) does no longer contain horde2 packages.
\nWe recommend that you upgrade your horde2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered that\na cronjob contained in fcheck, a file integrity checker, creates\na temporary file in an insecure fashion.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.7.59-7sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.7.59-8.
\nWe recommend that you upgrade your fcheck package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow problem has been discovered in sail, a game contained\nin the bsdgames package, a collection of classic textual Unix games, which\ncould lead to games group privilege escalation.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.13-7woody0.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.17-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.17-7.
\nWe recommend that you upgrade your bsdgames package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndrea Barisani discovered that zgv, an svgalib graphics viewer,\nattempts to decode JPEG images within the CMYK/YCCK colour space\nincorrectly, which could lead to the execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 5.5-3woody3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 5.7-1.4.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your zgv package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndrea Barisani discovered that xzgv, a picture viewer for X with a\nthumbnail-based selector, attempts to decode JPEG images within the\nCMYK/YCCK colour space incorrectly, which could lead to the execution\nof arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.7-6woody3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.8-3sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your xzgv package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in blender, a very fast\nand versatile 3D modeller/renderer. The Common Vulnerabilities and\nExposures Project identifies the following problems:
\nJoxean Koret discovered that due to missing input validation a\n provided script is vulnerable to arbitrary command execution.
Damian Put discovered a buffer overflow that allows remote\n attackers to cause a denial of service and possibly execute\n arbitrary code.
The old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.36-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.40-1.
\nWe recommend that you upgrade your blender package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been identified in gdm, a display manager for X,\nthat could allow a local attacker to gain elevated privileges by\nexploiting a race condition in the handling of the .ICEauthority file.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.6.0.8-1sarge2.
\nFor the unstable distribution (sid) this problem will be fixed in\nversion 2.14.1-1.
\nWe recommend that you upgrade your gdm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered that abc2ps, a translator for ABC music\ndescription files into PostScript, does not check the boundaries when\nreading in ABC music files resulting in buffer overflows.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 1.3.3-2woody1.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.3.3-3sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.3-3sarge1.
\nWe recommend that you upgrade your abc2ps package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe Mu Security research team discovered a denial of service condition\nin the Simple Authentication and Security Layer authentication library\n(SASL) during DIGEST-MD5 negotiation. This potentially affects\nmultiple products that use SASL DIGEST-MD5 authentication including\nOpenLDAP, Sendmail, Postfix, etc.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.1.19-1.5sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.1.19.dfsg1-0.2.
\nWe recommend that you upgrade your cyrus-sasl2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered that abcmidi-yaps, a translator for ABC music\ndescription files into PostScript, does not check the boundaries when\nreading in ABC music files resulting in buffer overflows.
\nFor the old stable distribution (woody) these problems have been fixed in\nversion 17-1woody1.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 20050101-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 20060422-1.
\nWe recommend that you upgrade your abcmidi-yaps package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla\nFirefox. The Common Vulnerabilities and Exposures project identifies\nthe following vulnerabilities:
\nWeb pages with extremely long titles cause subsequent launches of\n the browser to appear to \"hang\" for up to a few minutes, or even\n crash if the computer has insufficient memory. [MFSA-2006-03]
The JavaScript interpreter does not properly dereference objects,\n which allows remote attackers to cause a denial of service or\n execute arbitrary code. [MFSA-2006-01]
The function allocation code allows attackers to cause a denial of\n service and possibly execute arbitrary code. [MFSA-2006-01]
XULDocument.persist() did not validate the attribute name,\n allowing an attacker to inject arbitrary XML and JavaScript code\n into localstore.rdf that would be read and acted upon during\n startup. [MFSA-2006-05]
An anonymous researcher for TippingPoint and the Zero Day\n Initiative reported that an invalid and nonsensical ordering of\n table-related tags can be exploited to execute arbitrary code.\n [MFSA-2006-27]
A particular sequence of HTML tags can cause memory corruption\n that can be exploited to execute arbitrary code. [MFSA-2006-18]
Georgi Guninski reported two variants of using scripts in an XBL\n control to gain chrome privileges when the page is viewed under\n \"Print Preview\". [MFSA-2006-25]
\"shutdown\" discovered that the crypto.generateCRMFRequest method\n can be used to run arbitrary code with the privilege of the user\n running the browser, which could enable an attacker to install\n malware. [MFSA-2006-24]
Claus J\u00f8rgensen reported that a text input box can be pre-filled\n with a filename and then turned into a file-upload control,\n allowing a malicious website to steal any local file whose name\n they can guess. [MFSA-2006-23]
An anonymous researcher for TippingPoint and the Zero Day\n Initiative discovered an integer overflow triggered by the CSS\n letter-spacing property, which could be exploited to execute\n arbitrary code. [MFSA-2006-22]
\"moz_bug_r_a4\" discovered that some internal functions return\n prototypes instead of objects, which allows remote attackers to\n conduct cross-site scripting attacks. [MFSA-2006-19]
\"shutdown\" discovered that it is possible to bypass same-origin\n protections, allowing a malicious site to inject script into\n content from another site, which could allow the malicious page to\n steal information such as cookies or passwords from the other\n site, or perform transactions on the user's behalf if the user\n were already logged in. [MFSA-2006-17]
\"moz_bug_r_a4\" discovered that the compilation scope of privileged\n built-in XBL bindings is not fully protected from web content and\n can still be executed which could be used to execute arbitrary\n JavaScript, which could allow an attacker to install malware such\n as viruses and password sniffers. [MFSA-2006-16]
\"shutdown\" discovered that it is possible to access an internal\n function object which could then be used to run arbitrary\n JavaScript code with full permissions of the user running the\n browser, which could be used to install spyware or viruses.\n [MFSA-2006-15]
It is possible to create JavaScript functions that would get\n compiled with the wrong privileges, allowing an attacker to run\n code of their choice with full permissions of the user running the\n browser, which could be used to install spyware or viruses.\n [MFSA-2006-14]
It is possible to trick users into downloading and saving an\n executable file via an image that is overlaid by a transparent\n image link that points to the executable. [MFSA-2006-13]
An integer overflow allows remote attackers to cause a denial of\n service and possibly execute arbitrary bytecode via JavaScript\n with a large regular expression. [MFSA-2006-11]
An unspecified vulnerability allows remote attackers to cause a\n denial of service. [MFSA-2006-11]
Certain Cascading Style Sheets (CSS) can cause an out-of-bounds\n array write and buffer overflow that could lead to a denial of\n service and the possible execution of arbitrary code. [MFSA-2006-11]
It is possible for remote attackers to spoof secure site\n indicators such as the locked icon by opening the trusted site in\n a popup window, then changing the location to a malicious site.\n [MFSA-2006-12]
\"shutdown\" discovered that it is possible to inject arbitrary\n JavaScript code into a page on another site using a modal alert to\n suspend an event handler while a new page is being loaded. This\n could be used to steal confidential information. [MFSA-2006-09]
Igor Bukanov discovered that the JavaScript engine does not\n properly handle temporary variables, which might allow remote\n attackers to trigger operations on freed memory and cause memory\n corruption. [MFSA-2006-10]
A regression fix that could lead to memory corruption allows\n remote attackers to cause a denial of service and possibly execute\n arbitrary code. [MFSA-2006-11]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.dfsg+1.5.0.2-2.
\nWe recommend that you upgrade your Mozilla Firefox packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHendrik Weimer discovered that OpenVPN, the Virtual Private Network\ndaemon, allows to push environment variables to a client allowing a\nmalicious VPN server to take over connected clients.
\nThe old stable distribution (woody) does not contain openvpn packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0-1sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.6-1.
\nWe recommend that you upgrade your openvpn package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing vulnerabilities:
\nThe \"run-mozilla.sh\" script allows local users to create or\n overwrite arbitrary files when debugging is enabled via a symlink\n attack on temporary files.
Web pages with extremely long titles cause subsequent launches of\n the browser to appear to \"hang\" for up to a few minutes, or even\n crash if the computer has insufficient memory. [MFSA-2006-03]
The JavaScript interpreter does not properly dereference objects,\n which allows remote attackers to cause a denial of service or\n execute arbitrary code. [MFSA-2006-01]
The function allocation code allows attackers to cause a denial of\n service and possibly execute arbitrary code. [MFSA-2006-01]
XULDocument.persist() did not validate the attribute name,\n allowing an attacker to inject arbitrary XML and JavaScript code\n into localstore.rdf that would be read and acted upon during\n startup. [MFSA-2006-05]
An anonymous researcher for TippingPoint and the Zero Day\n Initiative reported that an invalid and nonsensical ordering of\n table-related tags can be exploited to execute arbitrary code.\n [MFSA-2006-27]
A particular sequence of HTML tags can cause memory corruption\n that can be exploited to execute arbitrary code. [MFSA-2006-18]
Georgi Guninski reports that forwarding mail in-line while using\n the default HTML \"rich mail\" editor will execute JavaScript\n embedded in the e-mail message with full privileges of the client.\n [MFSA-2006-21]
The HTML rendering engine does not properly block external images\n from inline HTML attachments when \"Block loading of remote images\n in mail messages\" is enabled, which could allow remote attackers\n to obtain sensitive information. [MFSA-2006-26]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
Due to an interaction between XUL content windows and the history\n mechanism, some windows may to become translucent, which might\n allow remote attackers to execute arbitrary code. [MFSA-2006-29]
\"shutdown\" discovered that the security check of the function\n js_ValueToFunctionObject() can be circumvented and exploited to\n allow the installation of malware. [MFSA-2006-28]
Georgi Guninski reported two variants of using scripts in an XBL\n control to gain chrome privileges when the page is viewed under\n \"Print Preview\". [MFSA-2006-25]
\"shutdown\" discovered that the crypto.generateCRMFRequest method\n can be used to run arbitrary code with the privilege of the user\n running the browser, which could enable an attacker to install\n malware. [MFSA-2006-24]
Claus J\u00f8rgensen reported that a text input box can be pre-filled\n with a filename and then turned into a file-upload control,\n allowing a malicious website to steal any local file whose name\n they can guess. [MFSA-2006-23]
An anonymous researcher for TippingPoint and the Zero Day\n Initiative discovered an integer overflow triggered by the CSS\n letter-spacing property, which could be exploited to execute\n arbitrary code. [MFSA-2006-22]
\"moz_bug_r_a4\" discovered that some internal functions return\n prototypes instead of objects, which allows remote attackers to\n conduct cross-site scripting attacks. [MFSA-2006-19]
\"shutdown\" discovered that it is possible to bypass same-origin\n protections, allowing a malicious site to inject script into\n content from another site, which could allow the malicious page to\n steal information such as cookies or passwords from the other\n site, or perform transactions on the user's behalf if the user\n were already logged in. [MFSA-2006-17]
\"moz_bug_r_a4\" discovered that the compilation scope of privileged\n built-in XBL bindings is not fully protected from web content and\n can still be executed which could be used to execute arbitrary\n JavaScript, which could allow an attacker to install malware such\n as viruses and password sniffers. [MFSA-2006-16]
\"shutdown\" discovered that it is possible to access an internal\n function object which could then be used to run arbitrary\n JavaScript code with full permissions of the user running the\n browser, which could be used to install spyware or viruses.\n [MFSA-2006-15]
It is possible to create JavaScript functions that would get\n compiled with the wrong privileges, allowing an attacker to run\n code of their choice with full permissions of the user running the\n browser, which could be used to install spyware or viruses.\n [MFSA-2006-14]
It is possible to trick users into downloading and saving an\n executable file via an image that is overlaid by a transparent\n image link that points to the executable. [MFSA-2006-13]
An integer overflow allows remote attackers to cause a denial of\n service and possibly execute arbitrary bytecode via JavaScript\n with a large regular expression. [MFSA-2006-11]
An unspecified vulnerability allows remote attackers to cause a\n denial of service. [MFSA-2006-11]
Certain Cascading Style Sheets (CSS) can cause an out-of-bounds\n array write and buffer overflow that could lead to a denial of\n service and the possible execution of arbitrary code. [MFSA-2006-11]
It is possible for remote attackers to spoof secure site\n indicators such as the locked icon by opening the trusted site in\n a popup window, then changing the location to a malicious site.\n [MFSA-2006-12]
\"shutdown\" discovered that it is possible to inject arbitrary\n JavaScript code into a page on another site using a modal alert to\n suspend an event handler while a new page is being loaded. This\n could be used to steal confidential information. [MFSA-2006-09]
Igor Bukanov discovered that the JavaScript engine does not\n properly handle temporary variables, which might allow remote\n attackers to trigger operations on freed memory and cause memory\n corruption. [MFSA-2006-10]
A regression fix that could lead to memory corruption allows\n remote attackers to cause a denial of service and possibly execute\n arbitrary code. [MFSA-2006-11]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.7.8-1sarge5.
\nFor the unstable distribution (sid) these problems will be fixed in\nversion 1.7.13-1.
\nWe recommend that you upgrade your Mozilla packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in resmgr, a resource manager library\ndaemon and PAM module, that allows local users to bypass access\ncontrol rules and open any USB device when access to one device was\ngranted.
\nThe old stable distribution (woody) does not contain resmgr packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0-2sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0-4.
\nWe recommend that you upgrade your resmgr package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in Asterisk, an Open Source\nPrivate Branch Exchange (telephone control center). The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nAdam Pointon discovered that due to missing input sanitising it is\n possible to retrieve recorded phone messages for a different\n extension.
Emmanouel Kellinis discovered an integer signedness error that\n could trigger a buffer overflow and hence allow the execution of\n arbitrary code.
For the old stable distribution (woody) this problem has been fixed in\nversion 0.1.11-3woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.7.dfsg.1-2sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.7.1.dfsg-1.
\nWe recommend that you upgrade your asterisk package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGerald Combs reported several vulnerabilities in ethereal, a popular\nnetwork traffic analyser. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nThe OID printing routine is susceptible to an off-by-one error.
The UMA and BER dissectors could go into an infinite loop.
The Network Instruments file code could overrun a buffer.
The COPS dissector contains a potential buffer overflow.
The telnet dissector contains a buffer overflow.
Bugs in the SRVLOC and AIM dissector, and in the statistics\n counter could crash ethereal.
Null pointer dereferences in the SMB PIPE dissector and when\n reading a malformed Sniffer capture could crash ethereal.
Null pointer dereferences in the ASN.1, GSM SMS, RPC and\n ASN.1-based dissector and an invalid display filter could crash\n ethereal.
The SNDCP dissector could cause an unintended abortion.
For the old stable distribution (woody) these problems have been fixed in\nversion 0.9.4-1woody15.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.10.10-2sarge5.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar and an anonymous researcher from Germany discovered a\nvulnerability in the protocol code of freshclam, a command line\nutility responsible for downloading and installing virus signature\nupdates for ClamAV, the antivirus scanner for Unix. This could lead\nto a denial of service or potentially the execution of arbitrary code.
\nThe old stable distribution (woody) does not contain clamav packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.84-2.sarge.9.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.88.2-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla\nThunderbird. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:
\nThe \"run-mozilla.sh\" script allows local users to create or\n overwrite arbitrary files when debugging is enabled via a symlink\n attack on temporary files.
Web pages with extremely long titles cause subsequent launches of\n the browser to appear to \"hang\" for up to a few minutes, or even\n crash if the computer has insufficient memory. [MFSA-2006-03]
The JavaScript interpreter does not properly dereference objects,\n which allows remote attackers to cause a denial of service or\n execute arbitrary code. [MFSA-2006-01]
The function allocation code allows attackers to cause a denial of\n service and possibly execute arbitrary code. [MFSA-2006-01]
XULDocument.persist() did not validate the attribute name,\n allowing an attacker to inject arbitrary XML and JavaScript code\n into localstore.rdf that would be read and acted upon during\n startup. [MFSA-2006-05]
An anonymous researcher for TippingPoint and the Zero Day\n Initiative reported that an invalid and nonsensical ordering of\n table-related tags can be exploited to execute arbitrary code.\n [MFSA-2006-27]
A particular sequence of HTML tags can cause memory corruption\n that can be exploited to execute arbitrary code. [MFSA-2006-18]
Georgi Guninski reports that forwarding mail in-line while using\n the default HTML \"rich mail\" editor will execute JavaScript\n embedded in the e-mail message with full privileges of the client.\n [MFSA-2006-21]
The HTML rendering engine does not properly block external images\n from inline HTML attachments when \"Block loading of remote images\n in mail messages\" is enabled, which could allow remote attackers\n to obtain sensitive information. [MFSA-2006-26]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
A vulnerability potentially allows remote attackers to cause a\n denial of service and possibly execute arbitrary code. [MFSA-2006-20]
Georgi Guninski reported two variants of using scripts in an XBL\n control to gain chrome privileges when the page is viewed under\n \"Print Preview\". [MFSA-2006-25]
\"shutdown\" discovered that the crypto.generateCRMFRequest method\n can be used to run arbitrary code with the privilege of the user\n running the browser, which could enable an attacker to install\n malware. [MFSA-2006-24]
Claus J\u00f8rgensen reported that a text input box can be pre-filled\n with a filename and then turned into a file-upload control,\n allowing a malicious website to steal any local file whose name\n they can guess. [MFSA-2006-23]
An anonymous researcher for TippingPoint and the Zero Day\n Initiative discovered an integer overflow triggered by the CSS\n letter-spacing property, which could be exploited to execute\n arbitrary code. [MFSA-2006-22]
\"moz_bug_r_a4\" discovered that some internal functions return\n prototypes instead of objects, which allows remote attackers to\n conduct cross-site scripting attacks. [MFSA-2006-19]
\"shutdown\" discovered that it is possible to bypass same-origin\n protections, allowing a malicious site to inject script into\n content from another site, which could allow the malicious page to\n steal information such as cookies or passwords from the other\n site, or perform transactions on the user's behalf if the user\n were already logged in. [MFSA-2006-17]
\"moz_bug_r_a4\" discovered that the compilation scope of privileged\n built-in XBL bindings is not fully protected from web content and\n can still be executed which could be used to execute arbitrary\n JavaScript, which could allow an attacker to install malware such\n as viruses and password sniffers. [MFSA-2006-16]
\"shutdown\" discovered that it is possible to access an internal\n function object which could then be used to run arbitrary\n JavaScript code with full permissions of the user running the\n browser, which could be used to install spyware or viruses.\n [MFSA-2006-15]
It is possible to create JavaScript functions that would get\n compiled with the wrong privileges, allowing an attacker to run\n code of their choice with full permissions of the user running the\n browser, which could be used to install spyware or viruses.\n [MFSA-2006-14]
It is possible to trick users into downloading and saving an\n executable file via an image that is overlaid by a transparent\n image link that points to the executable. [MFSA-2006-13]
An integer overflow allows remote attackers to cause a denial of\n service and possibly execute arbitrary bytecode via JavaScript\n with a large regular expression. [MFSA-2006-11]
An unspecified vulnerability allows remote attackers to cause a\n denial of service. [MFSA-2006-11]
Certain Cascading Style Sheets (CSS) can cause an out-of-bounds\n array write and buffer overflow that could lead to a denial of\n service and the possible execution of arbitrary code. [MFSA-2006-11]
It is possible for remote attackers to spoof secure site\n indicators such as the locked icon by opening the trusted site in\n a popup window, then changing the location to a malicious site.\n [MFSA-2006-12]
\"shutdown\" discovered that it is possible to inject arbitrary\n JavaScript code into a page on another site using a modal alert to\n suspend an event handler while a new page is being loaded. This\n could be used to steal confidential information. [MFSA-2006-09]
Igor Bukanov discovered that the JavaScript engine does not\n properly handle temporary variables, which might allow remote\n attackers to trigger operations on freed memory and cause memory\n corruption. [MFSA-2006-10]
A regression fix that could lead to memory corruption allows\n remote attackers to cause a denial of service and possibly execute\n arbitrary code. [MFSA-2006-11]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.2-2.sarge1.0.8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.0.2-1 of thunderbird.
\nWe recommend that you upgrade your Mozilla Thunderbird packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral buffer overflows have been discovered in cgiirc, a web-based\nIRC client, which could be exploited to execute arbitrary code.
\nThe old stable distribution (woody) does not contain cgiirc packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.5.4-6sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.5.4-6sarge1.
\nWe recommend that you upgrade your cgiirc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMartijn Wargers and Nick Mott described crashes of Mozilla due to the\nuse of a deleted controller context. In theory this could be abused to\nexecute malicious code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.7.8-1sarge6.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your mozilla packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy discovered several vulnerabilities in the TIFF library\nthat can lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nMultiple vulnerabilities allow attackers to cause a denial of\n service.
An integer overflow allows attackers to cause a denial of service\n and possibly execute arbitrary code.
A double-free vulnerability allows attackers to cause a denial of\n service and possibly execute arbitrary code.
For the old stable distribution (woody) these problems have been fixed\nin version 3.5.5-7woody1.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 3.7.2-3sarge1.
\nThe unstable distribution (sid) is not vulnerable to these problems.
\nWe recommend that you upgrade your libtiff packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMartijn Wargers and Nick Mott described crashes of Mozilla due to the\nuse of a deleted controller context. In theory this could be abused to\nexecute malicious code. Since Mozilla and Firefox share the same\ncodebase, Firefox may be vulnerable as well.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.4-2sarge7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.5.dfsg+1.5.0.3-1.
\nWe recommend that you upgrade your Mozilla Firefox packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDavid Maciejak noticed that webcalendar, a PHP-based multi-user\ncalendar, returns different error messages on login attempts for an\ninvalid password and a non-existing user, allowing remote attackers to\ngain information about valid usernames.
\nThe old stable distribution (woody) does not contain a webcalendar package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.45-4sarge4.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your webcalendar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral cross-site scripting vulnerabilities have been discovered in\nphpLDAPadmin, a web based interface for administering LDAP servers,\nthat allows remote attackers to inject arbitrary web script or HTML.
\nThe old stable distribution (woody) does not contain phpldapadmin\npackages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.9.5-3sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.9.8.3-1.
\nWe recommend that you upgrade your phpldapadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHendrik Weimer discovered that specially crafted web requests can\ncause awstats, a powerful and featureful web server log analyzer, to\nexecute arbitrary commands.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6.4-1sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.5-2.
\nWe recommend that you upgrade your awstats package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKonstantin Gavrilenko discovered several vulnerabilities in quagga,\nthe BGP/OSPF/RIP routing daemon. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nRemote attackers may obtain sensitive information via RIPv1\n REQUEST packets even if the quagga has been configured to use MD5\n authentication.
Remote attackers could inject arbitrary routes using the RIPv1\n RESPONSE packet even if the quagga has been configured to use MD5\n authentication.
Fredrik Widell discovered that local users can cause a denial\n of service in a certain sh ip bgp command entered in the telnet\n interface.
The old stable distribution (woody) does not contain quagga packages.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.98.3-7.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.99.4-1.
\nWe recommend that you upgrade your quagga package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJan Rekorajski discovered that the kernel patch for virtual private servers\ndoes not limit context capabilities to the root user within the virtual\nserver, which might lead to privilege escalation for some virtual server\nspecific operations.
\nThe old stable distribution (woody) does not contain kernel-patch-vserver\npackages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.9.5.6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.1-4.
\nWe recommend that you upgrade your kernel-patch-vserver package and\nrebuild your kernel immediately.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that popfile, a bayesian mail classifier, can\nbe forced into a crash through malformed character sets within email\nmessages, which allows denial of service.
\nThe old stable distribution (woody) does not contain popfile packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.22.2-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.22.4-1.
\nWe recommend that you upgrade your popfile package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSven Dreyer discovered that KPhone, a Voice over IP client for KDE,\ncreates a configuration file world-readable, which could leak sensitive\ninformation like SIP passwords.
\nThe old stable distribution (woody) doesn't contain kphone packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.1.0-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.2-6.
\nWe recommend that you upgrade your kphone package. If your current kphonerc\nhas too lax permissions, you'll need to reset them manually.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Avatar upload feature of FUD Forum, a component\nof the web based groupware system phpgroupware, does not sufficiently\nvalidate uploaded files, which might lead to the execution of injected web\nscript code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.9.14-0.RC3.2.woody6.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.16.005-3.sarge5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.16.009-1.
\nWe recommend that you upgrade your phpgroupware packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJason Duell discovered that cscope, a source code browsing tool, does not\nverify the length of file names sourced in include statements, which may\npotentially lead to the execution of arbitrary code through specially\ncrafted source code files.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 15.3-1woody3.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 15.5-1.1sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your cscope package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMatteo Rosi and Leonardo Maccari discovered that hostapd, a wifi network\nauthenticator daemon, performs insufficient boundary checks on a key length\nvalue, which might be exploited to crash the service.
\nThe old stable distribution (woody) does not contain hostapd packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.3.7-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.5-1.
\nWe recommend that you upgrade your hostapd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that phpbb2, a web based bulletin board, does\ninsufficiently sanitise values passed to the \"Font Colour 3\" setting,\nwhich might lead to the execution of injected code by admin users.
\nThe old stable distribution (woody) does not contain phpbb2 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.13+1-6sarge3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your phpbb2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nA local denial of service vulnerability in do_fork() has been found.
A local denial of service vulnerability in proc memory handling has\n been found.
A buffer overflow in the panic handling code has been found.
A local denial of service vulnerability through a null pointer\n dereference in the IA64 process handling code has been found.
A local denial of service vulnerability through an infinite loop in\n the signal handler code has been found.
An information leak in the context switch code has been found on\n the IA64 architecture.
Unsafe use of copy_to_user in USB drivers may disclose sensitive\n information.
A race condition in the i386 page fault handler may allow privilege\n escalation.
Multiple vulnerabilities in the SMB filesystem code may allow denial\n of service or information disclosure.
An information leak discovered in the SMB filesystem code.
A local denial of service vulnerability has been found in the SCM layer.
An integer overflow in the terminal code may allow a local denial of\n service vulnerability.
A local privilege escalation in the MIPS assembly code has been found.
A memory leak in the ip_options_get() function may lead to denial of\n service.
Multiple overflows exist in the io_edgeport driver which might be usable\n as a denial of service attack vector.
Bryan Fulton reported a bounds checking bug in the coda_pioctl function\n which may allow local users to execute arbitrary code or trigger a denial\n of service attack.
Inproper initialization of the RTC may disclose information.
Insufficient input sanitising in the load_elf_binary() function may\n lead to privilege escalation.
Incorrect error handling in the binfmt_elf loader may lead to privilege\n escalation.
A buffer overflow in the binfmt_elf loader may lead to privilege\n escalation or denial of service.
The open_exec function may disclose information.
The binfmt code is vulnerable to denial of service through malformed\n a.out binaries.
A denial of service vulnerability in the ELF loader has been found.
A programming error in the unix_dgram_recvmsg() function may lead to\n privilege escalation.
The ELF loader is vulnerable to denial of service through malformed\n binaries.
Crafted ELF binaries may lead to privilege escalation, due to\n insufficient checking of overlapping memory regions.
A race condition in the load_elf_library() and binfmt_aout() functions\n may allow privilege escalation.
An integer overflow in the Moxa driver may lead to privilege escalation.
A remote denial of service vulnerability has been found in the PPP\n driver.
An IA64 specific local denial of service vulnerability has been found\n in the unw_unwind_to_user() function.
The following matrix explains which kernel version for which architecture\nfixes the problems mentioned above:
\n| Debian 3.0 (woody) | |
|---|---|
| Source | 2.4.16-1woody2 |
| arm/lart | 20040419woody1 |
| arm/netwinder | 20040419woody1 |
| arm/riscpc | 20040419woody1 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJan Braun discovered that the fbgs script of fbi, an image viewer for\nthe framebuffer environment, creates an directory in a predictable manner,\nwhich allows denial of service through symlink attacks.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.23woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.01-1.2sarge1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your fbi package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nA local denial of service vulnerability in do_fork() has been found.
A local denial of service vulnerability in proc memory handling has\n been found.
A buffer overflow in the panic handling code has been found.
A local denial of service vulnerability through a null pointer\n dereference in the IA64 process handling code has been found.
A local denial of service vulnerability through an infinite loop in\n the signal handler code has been found.
An information leak in the context switch code has been found on\n the IA64 architecture.
Unsafe use of copy_to_user in USB drivers may disclose sensitive\n information.
A race condition in the i386 page fault handler may allow privilege\n escalation.
Multiple vulnerabilities in the SMB filesystem code may allow denial\n of service or information disclosure.
An information leak discovered in the SMB filesystem code.
A local denial of service vulnerability has been found in the SCM layer.
An integer overflow in the terminal code may allow a local denial of\n service vulnerability.
A local privilege escalation in the MIPS assembly code has been found.
A memory leak in the ip_options_get() function may lead to denial of\n service.
Multiple overflows exist in the io_edgeport driver which might be usable\n as a denial of service attack vector.
Bryan Fulton reported a bounds checking bug in the coda_pioctl function\n which may allow local users to execute arbitrary code or trigger a denial\n of service attack.
Inproper initialization of the RTC may disclose information.
Insufficient input sanitising in the load_elf_binary() function may\n lead to privilege escalation.
Incorrect error handling in the binfmt_elf loader may lead to privilege\n escalation.
A buffer overflow in the binfmt_elf loader may lead to privilege\n escalation or denial of service.
The open_exec function may disclose information.
The binfmt code is vulnerable to denial of service through malformed\n a.out binaries.
A denial of service vulnerability in the ELF loader has been found.
A programming error in the unix_dgram_recvmsg() function may lead to\n privilege escalation.
The ELF loader is vulnerable to denial of service through malformed\n binaries.
Crafted ELF binaries may lead to privilege escalation, due to\n insufficient checking of overlapping memory regions.
A race condition in the load_elf_library() and binfmt_aout() functions\n may allow privilege escalation.
An integer overflow in the Moxa driver may lead to privilege escalation.
A remote denial of service vulnerability has been found in the PPP\n driver.
An IA64 specific local denial of service vulnerability has been found\n in the unw_unwind_to_user() function.
The following matrix explains which kernel version for which architecture\nfixes the problems mentioned above:
\n| Debian 3.0 (woody) | |
|---|---|
| Source | 2.4.18-14.4 |
| Alpha architecture | 2.4.18-15woody1 |
| Intel IA-32 architecture | 2.4.18-13.2 |
| HP Precision architecture | 62.4 |
| PowerPC architecture | 2.4.18-1woody6 |
| PowerPC architecture/XFS | 20020329woody1 |
| PowerPC architecture/benh | 20020304woody1 |
| Sun Sparc architecture | 22woody1 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nA local denial of service vulnerability in do_fork() has been found.
A local denial of service vulnerability in proc memory handling has\n been found.
A buffer overflow in the panic handling code has been found.
A local denial of service vulnerability through a null pointer\n dereference in the IA64 process handling code has been found.
A local denial of service vulnerability through an infinite loop in\n the signal handler code has been found.
An information leak in the context switch code has been found on\n the IA64 architecture.
Unsafe use of copy_to_user in USB drivers may disclose sensitive\n information.
A race condition in the i386 page fault handler may allow privilege\n escalation.
Multiple vulnerabilities in the SMB filesystem code may allow denial\n of service or information disclosure.
An information leak discovered in the SMB filesystem code.
A local denial of service vulnerability has been found in the SCM layer.
An integer overflow in the terminal code may allow a local denial of\n service vulnerability.
A local privilege escalation in the MIPS assembly code has been found.
A memory leak in the ip_options_get() function may lead to denial of\n service.
Multiple overflows exist in the io_edgeport driver which might be usable\n as a denial of service attack vector.
Bryan Fulton reported a bounds checking bug in the coda_pioctl function\n which may allow local users to execute arbitrary code or trigger a denial\n of service attack.
Inproper initialization of the RTC may disclose information.
Insufficient input sanitising in the load_elf_binary() function may\n lead to privilege escalation.
Incorrect error handling in the binfmt_elf loader may lead to privilege\n escalation.
A buffer overflow in the binfmt_elf loader may lead to privilege\n escalation or denial of service.
The open_exec function may disclose information.
The binfmt code is vulnerable to denial of service through malformed\n a.out binaries.
A denial of service vulnerability in the ELF loader has been found.
A programming error in the unix_dgram_recvmsg() function may lead to\n privilege escalation.
The ELF loader is vulnerable to denial of service through malformed\n binaries.
Crafted ELF binaries may lead to privilege escalation, due to\n insufficient checking of overlapping memory regions.
A race condition in the load_elf_library() and binfmt_aout() functions\n may allow privilege escalation.
An integer overflow in the Moxa driver may lead to privilege escalation.
A remote denial of service vulnerability has been found in the PPP\n driver.
An IA64 specific local denial of service vulnerability has been found\n in the unw_unwind_to_user() function.
The following matrix explains which kernel version for which architecture\nfixes the problems mentioned above:
\n| Debian 3.0 (woody) | |
|---|---|
| Source | 2.4.19-4 |
| Sun Sparc architecture | 26woody1 |
| Little endian MIPS architecture | 0.020911.1.woody5 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in MySQL, a popular SQL\ndatabase. The Common Vulnerabilities and Exposures Project identifies\nthe following problems:
\nImproper handling of SQL queries containing the NULL character\n allows local users to bypass logging mechanisms.
Usernames without a trailing null byte allow remote attackers to\n read portions of memory.
A request with an incorrect packet length allows remote attackers\n to obtain sensitive information.
Specially crafted request packets with invalid length values allow\n the execution of arbitrary code.
The following vulnerability matrix shows which version of MySQL in\nwhich distribution has this problem fixed:
\n| \u00a0 | \nwoody | \nsarge | \nsid | \n
|---|---|---|---|
| mysql | \n3.23.49-8.15 | \nn/a | \nn/a | \n
| mysql-dfsg | \nn/a | \n4.0.24-10sarge2 | \nn/a | \n
| mysql-dfsg-4.1 | \nn/a | \n4.1.11a-4sarge3 | \nn/a | \n
| mysql-dfsg-5.0 | \nn/a | \nn/a | \n5.0.21-3 | \n
We recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in nagios, a host, service and\nnetwork monitoring and management system, that could be exploited by\nremote attackers to execute arbitrary code.
\nThe old stable distribution (woody) does not contain nagios packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.3-cvs.20050402-2.sarge.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4-1 and 2.3-1.
\nWe recommend that you upgrade your nagios package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in MySQL, a popular SQL\ndatabase. The Common Vulnerabilities and Exposures Project identifies\nthe following problems:
\nImproper handling of SQL queries containing the NULL character\n allows local users to bypass logging mechanisms.
Usernames without a trailing null byte allow remote attackers to\n read portions of memory.
A request with an incorrect packet length allows remote attackers\n to obtain sensitive information.
Specially crafted request packets with invalid length values allow\n the execution of arbitrary code.
The following vulnerability matrix shows which version of MySQL in\nwhich distribution has this problem fixed:
\n| \u00a0 | \nwoody | \nsarge | \nsid | \n
|---|---|---|---|
| mysql | \n3.23.49-8.15 | \nn/a | \nn/a | \n
| mysql-dfsg | \nn/a | \n4.0.24-10sarge2 | \nn/a | \n
| mysql-dfsg-4.1 | \nn/a | \n4.1.11a-4sarge3 | \nn/a | \n
| mysql-dfsg-5.0 | \nn/a | \nn/a | \n5.0.21-3 | \n
We recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA. Alejandro Hern\u00e1ndez discovered a vulnerability in mpg123, a\ncommand-line player for MPEG audio files. Insufficient validation of\nMPEG 2.0 layer 3 files results in several buffer overflows.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.59r-20sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.59r-22.
\nWe recommend that you upgrade your mpg123 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHendrik Weimer discovered that awstats can execute arbitrary commands\nunder the user id the web-server runs when users are allowed to supply\narbitrary configuration files. Even though, this bug was referenced\nin DSA 1058 accidentally, it was not fixed yet.
\nThe new default behaviour is not to accept arbitrary configuration\ndirectories from the user. This can be overwritten by the\nAWSTATS_ENABLE_CONFIG_DIR environment variable when users are to be\ntrusted.
\nThe old stable distribution (woody) does not seem to be affected by\nthis problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6.4-1sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.5-2.
\nWe recommend that you upgrade your awstats package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichal Zalewski discovered that lynx, the popular text-mode WWW\nBrowser, is not able to grok invalid HTML including a TEXTAREA tag\nwith a large COLS value and a large tag name in an element that is not\nterminated, and loops forever trying to render the broken HTML.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.8.4.1b-3.4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.8.5-2sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.8.5-2sarge2.
\nWe recommend that you upgrade your lynx package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichal Zalewski discovered that lynx, the popular text-mode WWW\nBrowser, is not able to grok invalid HTML including a TEXTAREA tag\nwith a large COLS value and a large tag name in an element that is not\nterminated, and loops forever trying to render the broken HTML. The\nsame code is present in lynx-ssl.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.8.4.1b-3.3.
\nThe stable distribution (sarge) does not contain lynx-ssl packages\nanymore.
\nThe unstable distribution (sid) does not contain lynx-ssl packages\nanymore.
\nWe recommend that you upgrade your lynx-ssl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndrey Kiselev discovered a problem in the TIFF library that may allow\nan attacker with a specially crafted TIFF image with Yr/Yg/Yb values\nthat exceed the YCR/YCG/YCB values to crash the library and hence the\nsurrounding application.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.7.2-4.
\nThe unstable distribution (sid) is not affected by this problem.
\nWe recommend that you upgrade your tiff packages and restart the\nprograms using it.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in MySQL, a popular SQL\ndatabase. The Common Vulnerabilities and Exposures Project identifies\nthe following problems:
\nImproper handling of SQL queries containing the NULL character\n allows local users to bypass logging mechanisms.
Usernames without a trailing null byte allow remote attackers to\n read portions of memory.
A request with an incorrect packet length allows remote attackers\n to obtain sensitive information.
Specially crafted request packets with invalid length values allow\n the execution of arbitrary code.
The following vulnerability matrix shows which version of MySQL in\nwhich distribution has this problem fixed:
\n| \u00a0 | \nwoody | \nsarge | \nsid | \n
|---|---|---|---|
| mysql | \n3.23.49-8.15 | \nn/a | \nn/a | \n
| mysql-dfsg | \nn/a | \n4.0.24-10sarge2 | \nn/a | \n
| mysql-dfsg-4.1 | \nn/a | \n4.1.11a-4sarge3 | \nn/a | \n
| mysql-dfsg-5.0 | \nn/a | \nn/a | \n5.0.21-3 | \n
We recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in the IMAP component of Dovecot, a\nsecure mail server that supports mbox and maildir mailboxes, which can\nlead to information disclosure via directory traversal by\nauthenticated users.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.99.14-1sarge0.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0beta8-1.
\nWe recommend that you upgrade your dovecot-imapd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered a buffer overflow in the processing of ASF\nfiles in libextractor, a library to extract arbitrary meta-data from\nfiles, which can lead to the execution of arbitrary code.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.4.2-2sarge5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.5.14-1.
\nWe recommend that you upgrade your libextractor packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nA local denial of service vulnerability in do_fork() has been found.
A local denial of service vulnerability in proc memory handling has\n been found.
A buffer overflow in the panic handling code has been found.
A local denial of service vulnerability through a null pointer\n dereference in the IA64 process handling code has been found.
A local denial of service vulnerability through an infinite loop in\n the signal handler code has been found.
An information leak in the context switch code has been found on\n the IA64 architecture.
Unsafe use of copy_to_user in USB drivers may disclose sensitive\n information.
A race condition in the i386 page fault handler may allow privilege\n escalation.
Multiple vulnerabilities in the SMB filesystem code may allow denial\n of service or information disclosure.
An information leak discovered in the SMB filesystem code.
A local denial of service vulnerability has been found in the SCM layer.
An integer overflow in the terminal code may allow a local denial of\n service vulnerability.
A local privilege escalation in the MIPS assembly code has been found.
A memory leak in the ip_options_get() function may lead to denial of\n service.
Multiple overflows exist in the io_edgeport driver which might be usable\n as a denial of service attack vector.
Bryan Fulton reported a bounds checking bug in the coda_pioctl function\n which may allow local users to execute arbitrary code or trigger a denial\n of service attack.
Inproper initialization of the RTC may disclose information.
Insufficient input sanitising in the load_elf_binary() function may\n lead to privilege escalation.
Incorrect error handling in the binfmt_elf loader may lead to privilege\n escalation.
A buffer overflow in the binfmt_elf loader may lead to privilege\n escalation or denial of service.
The open_exec function may disclose information.
The binfmt code is vulnerable to denial of service through malformed\n a.out binaries.
A denial of service vulnerability in the ELF loader has been found.
A programming error in the unix_dgram_recvmsg() function may lead to\n privilege escalation.
The ELF loader is vulnerable to denial of service through malformed\n binaries.
Crafted ELF binaries may lead to privilege escalation, due to\n insufficient checking of overlapping memory regions.
A race condition in the load_elf_library() and binfmt_aout() functions\n may allow privilege escalation.
An integer overflow in the Moxa driver may lead to privilege escalation.
A remote denial of service vulnerability has been found in the PPP\n driver.
An IA64 specific local denial of service vulnerability has been found\n in the unw_unwind_to_user() function.
The following matrix explains which kernel version for which architecture\nfixes the problems mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.4.17-1woody4 |
| HP Precision architecture | 32.5 |
| Intel IA-64 architecture | 011226.18 |
| IBM S/390 architecture/image | 2.4.17-2.woody.5 |
| IBM S/390 architecture/patch | 0.0.20020816-0.woody.4 |
| PowerPC architecture (apus) | 2.4.17-6 |
| MIPS architecture | 2.4.17-0.020226.2.woody7 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMehdi Oudad and Kevin Fernandez discovered a buffer overflow in the\nktools library which is used in motor, an integrated development\nenvironment for C, C++ and Java, which may lead local attackers to\nexecute arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 3.2.2-2woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.4.0-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.4.0-6.
\nWe recommend that you upgrade your motor package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNiko Tyni discovered a buffer overflow in the processing of network\ndata in typespeed, a game for testing and improving typing speed, which\ncould lead to the execution of arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.4.1-2.4.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.4.4-8sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.4.4-10.
\nWe recommend that you upgrade your typespeed packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in lynx, the popular\ntext-mode WWW browser. The Common Vulnerabilities and Exposures\nProject identifies the following vulnerabilities:
\nMichal Zalewski discovered that lynx is not able to grok invalid\n HTML including a TEXTAREA tag with a large COLS value and a large\n tag name in an element that is not terminated, and loops forever\n trying to render the broken HTML.
Ulf H\u00e4rnhammar discovered a buffer overflow that can be remotely\n exploited. During the handling of Asian characters when connecting\n to an NNTP server lynx can be tricked to write past the boundary\n of a buffer which can lead to the execution of arbitrary code.
For the old stable distribution (woody) these problems have been fixed in\nversion 2.8.5-2.5woody1.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.8.6-9sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your lynx-cur package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe xmcdconfig creates directories world-writeable allowing local\nusers to fill the /usr and /var partition and hence cause a denial of\nservice. This problem has been half-fixed since version 2.3-1.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 2.6-14woody1.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.6-17sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.6-18.
\nWe recommend that you upgrade your xmcd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral encoding problems have been discovered in PostgreSQL, a\npopular SQL database. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nAkio Ishida and Yasuo Ohgaki discovered a weakness in the handling\n of invalidly-encoded multibyte text data which could allow an\n attacker to inject arbitrary SQL commands.
A similar problem exists in client-side encodings (such as SJIS,\n BIG5, GBK, GB18030, and UHC) which contain valid multibyte\n characters that end with the backslash character. An attacker\n could supply a specially crafted byte sequence that is able to\n inject arbitrary SQL commands.
\nThis issue does not affect you if you only use single-byte (like\n SQL_ASCII or the ISO-8859-X family) or unaffected multibyte (like\n UTF-8) encodings.
\npsycopg and python-pgsql use the old encoding for binary data and\n may have to be updated.
The old stable distribution (woody) is affected by these problems but\nwe're unable to correct the package.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 7.4.7-6sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 7.4.13-1.
\nWe recommend that you upgrade your postgresql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMehdi Oudad and Kevin Fernandez discovered a buffer overflow in the\nktools library which is used in centericq, a text-mode multi-protocol\ninstant messenger client, which may lead local or remote attackers to\nexecute arbitrary code.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 4.5.1-1.1woody2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.20.0-1sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.21.0-6.
\nWe recommend that you upgrade your centericq package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in freeradius, a\nhigh-performance and highly configurable RADIUS server. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nSuSE researchers have discovered several off-by-one errors may\n allow remote attackers to cause a denial of service and possibly\n execute arbitrary code.
Due to insufficient input validation it is possible for a remote\n attacker to bypass authentication or cause a denial of service.
The old stable distribution (woody) does not contain this package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.2-4sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.0-1.2.
\nWe recommend that you upgrade your freeradius package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in SpamAssassin, a Perl-based spam\nfilter using text analysis, that can allow remote attackers to execute\narbitrary commands. This problem only affects systems where spamd is\nreachable via the internet and used with vpopmail virtual users, via\nthe \"-v\" / \"--vpopmail\" switch, and with the \"-P\" / \"--paranoid\"\nswitch which is not the default setting on Debian.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.0.3-2sarge1.
\nFor the volatile archive for the stable distribution (sarge) this\nproblem has been fixed in version 3.1.0a-0volatile3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.1.3-1.
\nWe recommend that you upgrade your spamd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in the TIFF library. The Common\nVulnerabilities and Exposures project identifies the following issues:
\nSuSE discovered a buffer overflow in the conversion of TIFF files\n into PDF documents which could be exploited when tiff2pdf is used\n e.g. in a printer filter.
The tiffsplit command from the TIFF library contains a buffer\n overflow in the commandline handling which could be exploited when\n the program is executed automatically on unknown filenames.
For the old stable distribution (woody) this problem has been fixed in\nversion 3.5.5-7woody2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.7.2-5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.8.2-4.
\nWe recommend that you upgrade your tiff packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJosh Berkus and Tom Lane discovered that MySQL 4.1, a popular SQL\ndatabase, incorrectly parses a string escaped with mysql_real_escape()\nwhich could lead to SQL injection. This problem does only exist in\nversions 4.1 and 5.0.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.1.11a-4sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 5.0.21-4.
\nVersion 4.0 in the stable distribution (sarge) is also not affected by\nthis problem.
\nWe recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral format string vulnerabilities have been discovered in xine-ui,\nthe user interface of the xine video player, which may cause a denial\nof service.
\nThe old stable distribution (woody) is not affected by these problems.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.99.3-1sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your xine-ui package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJoxean Koret discovered several cross-site scripting vulnerabilities in\nGforge, an online collaboration suite for software development, which\nallow injection of web script code.
\nThe old stable distribution (woody) does not contain gforge packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.1-31sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.1-31sarge1.
\nWe recommend that you upgrade your gforge package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral problems have been discovered in the FreeType 2 font engine.\nThe Common vulnerabilities and Exposures project identifies the\nfollowing problems:
\nSeveral integer underflows have been discovered which could allow\n remote attackers to cause a denial of service.
Chris Evans discovered several integer overflows that lead to a\n denial of service or could possibly even lead to the execution of\n arbitrary code.
Several more integer overflows have been discovered which could\n possibly lead to the execution of arbitrary code.
A null pointer dereference could cause a denial of service.
For the old stable distribution (woody) these problems have been fixed in\nversion 2.0.9-1woody1.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.1.7-2.5.
\nFor the unstable distribution (sid) these problems will be fixed soon
\nWe recommend that you upgrade your libfreetype packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in webcalendar, a PHP-based\nmulti-user calendar, that allows a remote attacker to execute\narbitrary PHP code when register_globals is turned on.
\nThe old stable distribution (woody) does not contain a webcalendar package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.45-4sarge5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.4-1
\nWe recommend that you upgrade your webcalendar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\n\"Solar Designer\" discovered that arithmetic computations in netfilter's\n do_replace() function can lead to a buffer overflow and the execution of\n arbitrary code. However, the operation requires CAP_NET_ADMIN privileges,\n which is only an issue in virtualization systems or fine grained access\n control systems.
\"Solar Designer\" discovered a race condition in netfilter's\n do_add_counters() function, which allows information disclosure of\n kernel memory by exploiting a race condition. Like CVE-2006-0038,\n it requires CAP_NET_ADMIN privileges.
Intel EM64T systems were discovered to be susceptible to a local\n DoS due to an endless recursive fault related to a bad ELF entry\n address.
Incorrectly declared die_if_kernel() function as \"does never\n return\" which could be exploited by a local attacker resulting in\n a kernel crash.
AMD64 machines (and other 7th and 8th generation AuthenticAMD\n processors) were found to be vulnerable to sensitive information\n leakage, due to how they handle saving and restoring the FOP, FIP,\n and FDP x87 registers in FXSAVE/FXRSTOR when an exception is\n pending. This allows a process to determine portions of the state\n of floating point instructions of other processes.
Marco Ivaldi discovered that there was an unintended information\n disclosure allowing remote attackers to bypass protections against\n Idle Scans (nmap -sI) by abusing the ID field of IP packets and\n bypassing the zero IP ID in DF packet countermeasure. This was a\n result of the ip_push_pending_frames function improperly\n incremented the IP ID field when sending a RST after receiving\n unsolicited TCP SYN-ACK packets.
Pavel Kankovsky reported the existence of a potential information leak\n resulting from the failure to initialize sin.sin_zero in the IPv4 socket\n code.
Shaun Tancheff discovered a buffer overflow (boundary condition\n error) in the USB Gadget RNDIS implementation allowing remote\n attackers to cause a DoS. While creating a reply message, the\n driver allocated memory for the reply data, but not for the reply\n structure. The kernel fails to properly bounds-check user-supplied\n data before copying it to an insufficiently sized memory\n buffer. Attackers could crash the system, or possibly execute\n arbitrary machine code.
Hugh Dickins discovered an issue in the madvise_remove() function wherein\n file and mmap restrictions are not followed, allowing local users to\n bypass IPC permissions and replace portions of readonly tmpfs files with\n zeroes.
Alexandra Kossovsky reported a NULL pointer dereference condition in\n ip_route_input() that can be triggered by a local user by requesting\n a route for a multicast IP address, resulting in a denial of service\n (panic).
Vlad Yasevich reported a data validation issue in the SCTP subsystem\n that may allow a remote user to overflow a buffer using a badly formatted\n HB-ACK chunk, resulting in a denial of service.
Vlad Yasevich reported a bug in the bounds checking code in the SCTP\n subsystem that may allow a remote attacker to trigger a denial of service\n attack when rounded parameter lengths are used to calculate parameter\n lengths instead of the actual values.
Mark Mosely discovered that chroots residing on an SMB share can be\n escaped with specially crafted \"cd\" sequences.
The \"Mu security team\" discovered that carefully crafted ECNE chunks can\n cause a kernel crash by accessing incorrect state stable entries in the\n SCTP networking subsystem, which allows denial of service.
The \"Mu security team\" discovered that fragmented SCTP control\n chunks can trigger kernel panics, which allows for denial of\n service attacks.
It was discovered that SCTP packets with two initial bundled data\n packets can lead to infinite recursion, which allows for denial of\n service attacks.
The following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.4.27-10sarge3 |
| Alpha architecture | 2.4.27-10sarge3 |
| ARM architecture | 2.4.27-2sarge3 |
| Intel IA-32 architecture | 2.4.27-10sarge3 |
| Intel IA-64 architecture | 2.4.27-10sarge3 |
| Motorola 680x0 architecture | 2.4.27-3sarge3 |
| Big endian MIPS | 2.4.27-10.sarge3.040815-1 |
| Little endian MIPS | 2.4.27-10.sarge3.040815-1 |
| PowerPC architecture | 2.4.27-10sarge3 |
| IBM S/390 architecture | 2.4.27-2sarge3 |
| Sun Sparc architecture | 2.4.27-9sarge3 |
The following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| Debian 3.1 (sarge) | |
|---|---|
| fai-kernels | 1.9.1sarge2 |
| kernel-image-2.4.27-speakup | 2.4.27-1.1sarge2 |
| mindi-kernel | 2.4.27-2sarge2 |
| systemimager | 3.2.3-6sarge2 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Marek discovered that the Horde web application framework performs\ninsufficient input sanitising, which might lead to the injection of web\nscript code through cross-site scripting.
\nThe old stable distribution (woody) does not contain horde3 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.0.4-4sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.1.1-3.
\nWe recommend that you upgrade your horde3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Marek discovered that the Horde web application framework performs\ninsufficient input sanitising, which might lead to the injection of web\nscript code through cross-site scripting.
\nThe old stable distribution (woody) does not contain horde2 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.8-1sarge3.
\nThe unstable distribution (sid) does no longer contain horde2 packages.
\nWe recommend that you upgrade your horde2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA boundary checking error has been discovered in wv2, a library for\naccessing Microsoft Word documents, which can lead to an integer\noverflow induced by processing word files.
\nThe old stable distribution (woody) does not contain wv2 packages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.2.2-1sarge1
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your libwv packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA bug has been discovered in the Courier Mail Server that can result\nin a number of processes to consume arbitrary amounts of CPU power.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.37.3-2.9.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.47-4sarge5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.53.2-1.
\nWe recommend that you upgrade your courier packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered that\npinball, a pinball simulator, can be tricked into loading level\nplugins from user-controlled directories without dropping privileges.
\nThe old stable distribution (woody) does not contain this package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.3.1-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.3.1-6.
\nWe recommend that you upgrade your pinball package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nFranz Filz discovered that some socket calls permit causing inconsistent\n reference counts on loadable modules, which allows local users to cause\n a denial of service.
\"Solar Designer\" discovered that arithmetic computations in netfilter's\n do_replace() function can lead to a buffer overflow and the execution of\n arbitrary code. However, the operation requires CAP_NET_ADMIN privileges,\n which is only an issue in virtualization systems or fine grained access\n control systems.
\"Solar Designer\" discovered a race condition in netfilter's\n do_add_counters() function, which allows information disclosure of kernel\n memory by exploiting a race condition. Likewise, it requires CAP_NET_ADMIN\n privileges.
David Howells discovered that the s390 assembly version of the\n strnlen_user() function incorrectly returns some string size values.
It was discovered that the ftruncate() function of XFS can expose\n unallocated blocks, which allows information disclosure of previously deleted\n files.
It was discovered that some NFS file operations on handles mounted with\n O_DIRECT can force the kernel into a crash.
It was discovered that the code to configure memory policies allows\n tricking the kernel into a crash, thus allowing denial of service.
It was discovered by Cliff Wickman that perfmon for the IA64\n architecture allows users to trigger a BUG() assert, which allows\n denial of service.
Intel EM64T systems were discovered to be susceptible to a local\n DoS due to an endless recursive fault related to a bad ELF entry\n address.
Alan and Gareth discovered that the ia64 platform had an\n incorrectly declared die_if_kernel() function as \"does never\n return\" which could be exploited by a local attacker resulting in\n a kernel crash.
The Linux kernel did not properly handle uncanonical return\n addresses on Intel EM64T CPUs, reporting exceptions in the SYSRET\n instead of the next instruction, causing the kernel exception\n handler to run on the user stack with the wrong GS. This may result\n in a DoS due to a local user changing the frames.
AMD64 machines (and other 7th and 8th generation AuthenticAMD\n processors) were found to be vulnerable to sensitive information\n leakage, due to how they handle saving and restoring the FOP, FIP,\n and FDP x87 registers in FXSAVE/FXRSTOR when an exception is\n pending. This allows a process to determine portions of the state\n of floating point instructions of other processes.
Marco Ivaldi discovered that there was an unintended information\n disclosure allowing remote attackers to bypass protections against\n Idle Scans (nmap -sI) by abusing the ID field of IP packets and\n bypassing the zero IP ID in DF packet countermeasure. This was a\n result of the ip_push_pending_frames function improperly\n incremented the IP ID field when sending a RST after receiving\n unsolicited TCP SYN-ACK packets.
Shaun Tancheff discovered a buffer overflow (boundary condition\n error) in the USB Gadget RNDIS implementation allowing remote\n attackers to cause a DoS. While creating a reply message, the\n driver allocated memory for the reply data, but not for the reply\n structure. The kernel fails to properly bounds-check user-supplied\n data before copying it to an insufficiently sized memory\n buffer. Attackers could crash the system, or possibly execute\n arbitrary machine code.
Oleg Nesterov reported an unsafe BUG_ON call in signal.c which was\n introduced by RCU signal handling. The BUG_ON code is protected by\n siglock while the code in switch_exit_pids() uses tasklist_lock. It\n may be possible for local users to exploit this to initiate a denial\n of service attack (DoS).
Hugh Dickins discovered an issue in the madvise_remove() function wherein\n file and mmap restrictions are not followed, allowing local users to\n bypass IPC permissions and replace portions of readonly tmpfs files with\n zeroes.
Alexandra Kossovsky reported a NULL pointer dereference condition in\n ip_route_input() that can be triggered by a local user by requesting\n a route for a multicast IP address, resulting in a denial of service\n (panic).
Vlad Yasevich reported a data validation issue in the SCTP subsystem\n that may allow a remote user to overflow a buffer using a badly formatted\n HB-ACK chunk, resulting in a denial of service.
Vlad Yasevich reported a bug in the bounds checking code in the SCTP\n subsystem that may allow a remote attacker to trigger a denial of service\n attack when rounded parameter lengths are used to calculate parameter\n lengths instead of the actual values.
Mark Mosely discovered that chroots residing on an CIFS share can be\n escaped with specially crafted \"cd\" sequences.
Mark Mosely discovered that chroots residing on an SMB share can be\n escaped with specially crafted \"cd\" sequences.
The \"Mu security team\" discovered that carefully crafted ECNE chunks can\n cause a kernel crash by accessing incorrect state stable entries in the\n SCTP networking subsystem, which allows denial of service.
The \"Mu security team\" discovered that fragmented SCTP control\n chunks can trigger kernel panics, which allows for denial of\n service attacks.
It was discovered that SCTP packets with two initial bundled data\n packets can lead to infinite recursion, which allows for denial of\n service attacks.
The following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.6.8-16sarge3 |
| Alpha architecture | 2.6.8-16sarge3 |
| HP Precision architecture | 2.6.8-6sarge3 |
| Intel IA-32 architecture | 2.6.8-16sarge3 |
| Intel IA-64 architecture | 2.6.8-14sarge3 |
| Motorola 680x0 architecture | 2.6.8-4sarge3 |
| PowerPC architecture | 2.6.8-12sarge3 |
| IBM S/390 architecture | 2.6.8-5sarge3 |
| Sun Sparc architecture | 2.6.8-15sarge3 |
Due to technical problems the built amd64 packages couldn't be processed\nby the archive script. Once this problem is resolved, an updated DSA 1103-2\nwill be sent out with the checksums for amd64.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| Debian 3.1 (sarge) | |
|---|---|
| fai-kernels | 1.9.1sarge2 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLoading malformed XML documents can cause buffer overflows in\nOpenOffice.org, a free office suite, and cause a denial of service or\nexecute arbitrary code. \u00a0It turned out that the correction in DSA\n1104-1 was not sufficient, hence, another update. For completeness\nplease find the original advisory text below:
\n\n\nSeveral vulnerabilities have been discovered in OpenOffice.org, a free\noffice suite. The Common Vulnerabilities and Exposures Project\nidentifies the following problems:
\n\n
\n- CVE-2006-2198\n
\nIt turned out to be possible to embed arbitrary BASIC macros in\n documents in a way that OpenOffice.org does not see them but\n executes them anyway without any user interaction.
- CVE-2006-2199\n
\nIt is possible to evade the Java sandbox with specially crafted\n Java applets.
- CVE-2006-3117\n
Loading malformed XML documents can cause buffer overflows and\n cause a denial of service or execute arbitrary code.
\nThis update has the Mozilla component disabled, so that the\nMozilla/LDAP addressbook feature won't work anymore. It didn't work on\nanything else than i386 on sarge either.
\n
The old stable distribution (woody) does not contain OpenOffice.org\npackages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.1.3-9sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.3-1.
\nWe recommend that you upgrade your OpenOffice.org packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nFederico L. Bossi Bonin discovered a buffer overflow in the HTTP\nPlugin in xine-lib, the xine video/media player library, that could\nallow a remote attacker to cause a denial of service.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 0.9.8-2woody5.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.1-1sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.1-2.
\nWe recommend that you upgrade your libxine packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner discovered that the winbind plugin in pppd does not\ncheck whether a setuid() call has been successful when trying to drop\nprivileges, which may fail with some PAM configurations.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.4.3-20050321+2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.4.4rel-1.
\nWe recommend that you upgrade your ppp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEvgeny Legerov discovered that gnupg, the GNU privacy guard, a free\nPGP replacement contains an integer overflow that can cause a\nsegmentation fault and possibly overwrite memory via a large user ID\nstring.
\nFor the old stable distribution (woody) this problem has been fixed in\nversion 1.0.6-4woody6.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4.1-1.sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4.3-2.
\nWe recommend that you upgrade your gnupg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the mutt mail reader performs insufficient\nvalidation of values returned from an IMAP server, which might overflow\na buffer and potentially lead to the injection of arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.5.9-2sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.5.11+cvs20060403-2.
\nWe recommend that you upgrade your mutt package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRuss Allbery discovered that rssh, a restricted shell, performs\ninsufficient checking of incoming commands, which might lead to a bypass\nof access restrictions.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.3-1.sarge.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3.0-1.1.
\nWe recommend that you upgrade your rssh package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGerald Carter discovered that the smbd daemon from Samba, a free\nimplementation of the SMB/CIFS protocol, imposes insufficient limits\nin the code to handle shared connections, which can be exploited to\nexhaust system memory by sending maliciously crafted requests, leading\nto denial of service.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.0.14a-3sarge2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your samba package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a race condition in the process filesystem can lead\nto privilege escalation.
\nThe following matrix explains which kernel version for which architecture\nfixes the problem mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.6.8-16sarge4 |
| Alpha architecture | 2.6.8-16sarge4 |
| AMD64 architecture | 2.6.8-16sarge4 |
| Intel IA-32 architecture | 2.6.8-16sarge4 |
| Intel IA-64 architecture | 2.6.8-14sarge4 |
| PowerPC architecture | 2.6.8-12sarge4 |
| Sun Sparc architecture | 2.6.8-15sarge4 |
| IBM S/390 | 2.6.8-5sarge4 |
| Motorola 680x0 | 2.6.8-4sarge4 |
| HP Precision | 2.6.8-6sarge3 |
| FAI | 1.9.1sarge3 |
The initial advisory lacked builds for the IBM S/390, Motorola 680x0 and HP\nPrecision architectures, which are now provided. Also, the kernels for the\nFAI installer have been updated.
\nWe recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the MySQL database\nserver, which may lead to denial of service. The Common\nVulnerabilities and Exposures project identifies the following problems:
\n\"Kanatoko\" discovered that the server can be crashed with feeding\n NULL values to the str_to_date() function.
Jean-David Maillefer discovered that the server can be crashed with\n specially crafted date_format() function calls.
For the stable distribution (sarge) these problems have been fixed in\nversion 4.1.11a-4sarge5.
\nFor the unstable distribution (sid) does no longer contain MySQL 4.1\npackages. MySQL 5.0 from sid is not affected.
\nWe recommend that you upgrade your mysql-dfsg-4.1 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Zope web application server allows read access\nto arbitrary pages on the server, if a user has the privilege to edit\n\"restructured text\" pages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.7.5-2sarge2.
\nThe unstable distribution (sid) does no longer contain Zope 2.7 packages.
\nWe recommend that you upgrade your zope2.7 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndreas Seltenreich discovered a buffer overflow in hashcash, a\npostage payment scheme for email that is based on hash calculations,\nwhich could allow attackers to execute arbitrary code via specially\ncrafted entries.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.17-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.21-1.
\nWe recommend that you upgrade your hashcash package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEvgeny Legerov discovered that gnupg, the GNU privacy guard, a free\nPGP replacement contains an integer overflow that can cause a\nsegmentation fault and possibly overwrite memory via a large user ID\nstring.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4.1-1.sarge4 of GnuPG and in version 1.9.15-6sarge1 of GnuPG2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4.3-2 of GnuPG, a fix for GnuPG2 is pending.
\nWe recommend that you upgrade your gnupg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHenning Makholm discovered a buffer overflow in the XCF loading code\nof Gimp, an image editing program. Opening a specially crafted XCF\nimage might cause the application to execute arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.6-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.11-3.1.
\nWe recommend that you upgrade your gimp package.
\nMD5 checksums of the listed files are available in the original advisory.\n
\n\n\nIt was discovered that the GD graphics library performs insufficient checks\nof the validity of GIF images, which might lead to denial of service by\ntricking the application into an infinite loop.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.33-1.1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.33-5.
\nWe recommend that you upgrade your libgd2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing vulnerabilities:
\nEric Foley discovered that a user can be tricked to expose a local\n file to a remote attacker by displaying a local file as image in\n connection with other vulnerabilities. [MFSA-2006-39]
XUL attributes are associated with the wrong URL under certain\n circumstances, which might allow remote attackers to bypass\n restrictions. [MFSA-2006-35]
Paul Nickerson discovered that content-defined setters on an\n object prototype were getting called by privileged user interface\n code, and moz_bug_r_a4
demonstrated that the higher privilege\n level could be passed along to the content-defined attack code.\n [MFSA-2006-37]
A vulnerability allows remote attackers to execute arbitrary code\n and create notifications that are executed in a privileged\n context. [MFSA-2006-43]
Mikolaj Habryn discovered a buffer overflow in the crypto.signText function\n that allows remote attackers to execute arbitrary code via certain\n optional Certificate Authority name arguments. [MFSA-2006-38]
Mozilla team members discovered several crashes during testing of\n the browser engine showing evidence of memory corruption which may\n also lead to the execution of arbitrary code. This problem has\n only partially been corrected. [MFSA-2006-32]
An integer overflow allows remote attackers to cause a denial of\n service and may permit the execution of arbitrary code.\n [MFSA-2006-32]
Masatoshi Kimura discovered a double-free vulnerability that\n allows remote attackers to cause a denial of service and possibly\n execute arbitrary code via a VCard. [MFSA-2006-40]
Chuck McAuley discovered that a text input box can be pre-filled\n with a filename and then turned into a file-upload control,\n allowing a malicious website to steal any local file whose name\n they can guess. [MFSA-2006-41, MFSA-2006-23, CVE-2006-1729]
Masatoshi Kimura discovered that the Unicode Byte-order-Mark (BOM)\n is stripped from UTF-8 pages during the conversion to Unicode\n before the parser sees the web page, which allows remote attackers\n to conduct cross-site scripting (XSS) attacks. [MFSA-2006-42]
Paul Nickerson discovered that the fix for CVE-2005-0752 can be\n bypassed using nested javascript: URLs, allowing the attacker to\n execute privileged code. [MFSA-2005-34, MFSA-2006-36]
Paul Nickerson demonstrated that if an attacker could convince a\n user to right-click on a broken image and choose View Image
from\n the context menu then he could get JavaScript to\n run. [MFSA-2006-34]
Kazuho Oku discovered that Mozilla's lenient handling of HTTP\n header syntax may allow remote attackers to trick the browser to\n interpret certain responses as if they were responses from two\n different sites. [MFSA-2006-33]
The Mozilla researcher moz_bug_r_a4
discovered that JavaScript\n run via EvalInSandbox can escape the sandbox and gain elevated\n privilege. [MFSA-2006-31]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.7.8-1sarge7.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.7.13-0.3.
\nWe recommend that you upgrade your Mozilla packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAkira Tanaka discovered a vulnerability in Hiki Wiki, a Wiki engine\nwritten in Ruby that allows remote attackers to cause a denial of\nservice via high CPU consumption using by performing a diff between\nlarge and specially crafted Wiki pages.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.6.5-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.8.6-1.
\nWe recommend that you upgrade your hiki package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing vulnerabilities:
\nEric Foley discovered that a user can be tricked to expose a local\n file to a remote attacker by displaying a local file as image in\n connection with other vulnerabilities. [MFSA-2006-39]
XUL attributes are associated with the wrong URL under certain\n circumstances, which might allow remote attackers to bypass\n restrictions. [MFSA-2006-35]
Paul Nickerson discovered that content-defined setters on an\n object prototype were getting called by privileged user interface\n code, and \"moz_bug_r_a4\" demonstrated that the higher privilege\n level could be passed along to the content-defined attack code.\n [MFSA-2006-37]
A vulnerability allows remote attackers to execute arbitrary code\n and create notifications that are executed in a privileged\n context. [MFSA-2006-43]
Mikolaj Habryn discovered a buffer overflow in the crypto.signText function\n that allows remote attackers to execute arbitrary code via certain\n optional Certificate Authority name arguments. [MFSA-2006-38]
Mozilla team members discovered several crashes during testing of\n the browser engine showing evidence of memory corruption which may\n also lead to the execution of arbitrary code. This problem has\n only partially been corrected. [MFSA-2006-32]
An integer overflow allows remote attackers to cause a denial of\n service and may permit the execution of arbitrary code.\n [MFSA-2006-32]
Chuck McAuley discovered that a text input box can be pre-filled\n with a filename and then turned into a file-upload control,\n allowing a malicious website to steal any local file whose name\n they can guess. [MFSA-2006-41, MFSA-2006-23, CVE-2006-1729]
Masatoshi Kimura discovered that the Unicode Byte-order-Mark (BOM)\n is stripped from UTF-8 pages during the conversion to Unicode\n before the parser sees the web page, which allows remote attackers\n to conduct cross-site scripting (XSS) attacks. [MFSA-2006-42]
Paul Nickerson discovered that the fix for CVE-2005-0752 can be\n bypassed using nested javascript: URLs, allowing the attacker to\n execute privileged code. [MFSA-2005-34, MFSA-2006-36]
Paul Nickerson demonstrated that if an attacker could convince a\n user to right-click on a broken image and choose \"View Image\" from\n the context menu then he could get JavaScript to\n run. [MFSA-2006-34]
Kazuho Oku discovered that Mozilla's lenient handling of HTTP\n header syntax may allow remote attackers to trick the browser to\n interpret certain responses as if they were responses from two\n different sites. [MFSA-2006-33]
The Mozilla researcher \"moz_bug_r_a4\" discovered that JavaScript\n run via EvalInSandbox can escape the sandbox and gain elevated\n privilege. [MFSA-2006-31]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge9.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.dfsg+1.5.0.4-1.
\nWe recommend that you upgrade your Mozilla Firefox packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter Bieringer discovered that postgrey, a greylisting\nimplementation for Postfix, is vulnerable to a format string attack\nthat allows remote attackers to cause a denial of service to the daemon.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.21-1sarge1.
\nFor the stable distribution (sarge) this problem has also been fixed\nin version 1.21-1volatile4 in the volatile archive.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.22-1.
\nWe recommend that you upgrade your postgrey package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter Bieringer discovered that the \"log\" function in the Net::Server\nPerl module, an extensible, general perl server engine, is not safe\nagainst format string exploits.
\nThe old stable distribution (woody) does not contain this package.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.87-3sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.89-1.
\nWe recommend that you upgrade your libnet-server-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered that DUMB, a tracker music library, performs\ninsufficient sanitising of values parsed from IT music files, which might\nlead to a buffer overflow and execution of arbitrary code if manipulated\nfiles are read.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.2-6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.3-5.
\nWe recommend that you upgrade your libdumb packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nToth Andras discovered that the fbgs framebuffer postscript/PDF viewer\ncontains a typo, which prevents the intended filter against malicious\npostscript commands from working correctly. This might lead to the\ndeletion of user data when displaying a postscript file.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.01-1.2sarge2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your fbi package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe Drupal update in DSA 1125 contained a regression. This update corrects\nthis flaw. For completeness, the original advisory text below:
\nSeveral remote vulnerabilities have been discovered in the Drupal web site\nplatform, which may lead to the execution of arbitrary web script. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nA SQL injection vulnerability has been discovered in the \"count\" and\n \"from\" variables of the database interface.
Multiple file extensions were handled incorrectly if Drupal ran on\n Apache with mod_mime enabled.
A variation of CVE-2006-2743 was addressed as well.
A Cross-Site-Scripting vulnerability in the upload module has been\n discovered.
A Cross-Site-Scripting vulnerability in the taxonomy module has been\n discovered.
For the stable distribution (sarge) these problems have been fixed in\nversion 4.5.3-6.1sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.5.8-1.1.
\nWe recommend that you upgrade your drupal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in the IAX2 channel driver of Asterisk,\nan Open Source Private Branch Exchange and telephony toolkit, which\nmay allow a remote attacker to cause a crash of the Asterisk server.
\nThe old stable distribution (woody) is not affected by this problem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.7.dfsg.1-2sarge3.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your asterisk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Ethereal network\nsniffer, which may lead to the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nIlja van Sprundel discovered that the FW-1 and MQ dissectors are\n vulnerable to format string attacks.
Ilja van Sprundel discovered that the MOUNT dissector is vulnerable\n to denial of service through memory exhaustion.
Ilja van Sprundel discovered off-by-one overflows in the NCP NMAS and\n NDPS dissectors.
Ilja van Sprundel discovered a buffer overflow in the NFS dissector.
Ilja van Sprundel discovered that the SSH dissector is vulnerable\n to denial of service through an infinite loop.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.10.10-2sarge6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.99.2-1 of wireshark, the sniffer formerly known as ethereal.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYan Rong Ge discovered that wrong permissions on a shared memory page\nin heartbeat, the subsystem for High-Availability Linux could be\nexploited by a local attacker to cause a denial of service.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2.3-9sarge5.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your heartbeat packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar and Max Vozeler from the Debian Security Audit Project\nhave found several format string security bugs in osiris, a\nnetwork-wide system integrity monitor control interface. A remote\nattacker could exploit them and cause a denial of service or execute\narbitrary code.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 4.0.6-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.2.0-2.
\nWe recommend that you upgrade your osiris packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA cross-site scripting vulnerability has been discovered in sitebar,\na web based bookmark manager written in PHP, which allows remote\nattackers to inject arbitrary web script or HTML.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.2.6-7.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.3.8-1.1.
\nWe recommend that you upgrade your sitebar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMark Dowd discovered a buffer overflow in the mod_rewrite component of\napache, a versatile high-performance HTTP server. In some situations a\nremote attacker could exploit this to execute arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in version 1.3.33-6sarge2.
\nFor the unstable distribution (sid) this problem will be fixed shortly.
\nWe recommend that you upgrade your apache package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMark Dowd discovered a buffer overflow in the mod_rewrite component of\napache, a versatile high-performance HTTP server. In some situations a\nremote attacker could exploit this to execute arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0.54-5sarge1.
\nFor the unstable distribution (sid) this problem will be fixed shortly.
\nWe recommend that you upgrade your apache2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Mantis bug\ntracking system, which may lead to the execution of arbitrary web script.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nA cross-site scripting vulnerability was discovered in\n config_defaults_inc.php.
Cross-site scripting vulnerabilities were discovered in query_store.php\n and manage_proj_create.php.
Multiple cross-site scripting vulnerabilities were discovered in\n view_all_set.php, manage_user_page.php, view_filters_page.php and\n proj_doc_delete.php.
Multiple cross-site scripting vulnerabilities were discovered in\n view_all_set.php.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.19.2-5sarge4.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.19.4-3.1.
\nWe recommend that you upgrade your mantis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla\nwhich are also present in Mozilla Thunderbird. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nEric Foley discovered that a user can be tricked to expose a local\n file to a remote attacker by displaying a local file as image in\n connection with other vulnerabilities. [MFSA-2006-39]
XUL attributes are associated with the wrong URL under certain\n circumstances, which might allow remote attackers to bypass\n restrictions. [MFSA-2006-35]
Paul Nickerson discovered that content-defined setters on an\n object prototype were getting called by privileged user interface\n code, and \"moz_bug_r_a4\" demonstrated that the higher privilege\n level could be passed along to the content-defined attack code.\n [MFSA-2006-37]
A vulnerability allows remote attackers to execute arbitrary code\n and create notifications that are executed in a privileged\n context. [MFSA-2006-43]
Mikolaj Habryn discovered a buffer overflow in the crypto.signText function\n that allows remote attackers to execute arbitrary code via certain\n optional Certificate Authority name arguments. [MFSA-2006-38]
Mozilla team members discovered several crashes during testing of\n the browser engine showing evidence of memory corruption which may\n also lead to the execution of arbitrary code. This problem has\n only partially been corrected. [MFSA-2006-32]
An integer overflow allows remote attackers to cause a denial of\n service and may permit the execution of arbitrary code.\n [MFSA-2006-32]
Masatoshi Kimura discovered a double-free vulnerability that\n allows remote attackers to cause a denial of service and possibly\n execute arbitrary code via a VCard. [MFSA-2006-40]
Chuck McAuley discovered that a text input box can be pre-filled\n with a filename and then turned into a file-upload control,\n allowing a malicious website to steal any local file whose name\n they can guess. [MFSA-2006-41, MFSA-2006-23, CVE-2006-1729]
Masatoshi Kimura discovered that the Unicode Byte-order-Mark (BOM)\n is stripped from UTF-8 pages during the conversion to Unicode\n before the parser sees the web page, which allows remote attackers\n to conduct cross-site scripting (XSS) attacks. [MFSA-2006-42]
Paul Nickerson discovered that the fix for CVE-2005-0752 can be\n bypassed using nested javascript: URLs, allowing the attacker to\n execute privileged code. [MFSA-2005-34, MFSA-2006-36]
Paul Nickerson demonstrated that if an attacker could convince a\n user to right-click on a broken image and choose \"View Image\" from\n the context menu then he could get JavaScript to\n run. [MFSA-2006-34]
Kazuho Oku discovered that Mozilla's lenient handling of HTTP\n header syntax may allow remote attackers to trick the browser to\n interpret certain responses as if they were responses from two\n different sites. [MFSA-2006-33]
The Mozilla researcher \"moz_bug_r_a4\" discovered that JavaScript\n run via EvalInSandbox can escape the sandbox and gain elevated\n privilege. [MFSA-2006-31]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.2-2.sarge1.0.8a.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.0.4-1 and xulrunner 1.5.0.4-1 for galeon and epiphany.
\nWe recommend that you upgrade your Mozilla Thunderbird packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKevin Kofler discovered several stack-based buffer overflows in the\nLookupTRM::lookup function in libtunepimp, a MusicBrainz tagging\nlibrary, which allows remote attackers to cause a denial of service or\nexecute arbitrary code.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.3.0-3sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.4.2-4.
\nWe recommend that you upgrade your libtunepimp packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\ninfamous41md
and Chris Evans discovered several heap based buffer\noverflows in xpdf, the Portable Document Format (PDF) suite, which are\nalso present in gpdf, the viewer with Gtk bindings, and which can lead\nto a denial of service by crashing the application or possibly to the\nexecution of arbitrary code.
For the stable distribution (sarge) these problems have been fixed in\nversion 2.8.2-1.2sarge5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.10.0-4.
\nWe recommend that you upgrade your gpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy of the Google Security Team discovered several problems\nin the TIFF library. The Common Vulnerabilities and Exposures project\nidentifies the following issues:
\nSeveral stack-buffer overflows have been discovered.
A heap overflow vulnerability in the JPEG decoder may overrun a\n buffer with more data than expected.
A heap overflow vulnerability in the PixarLog decoder may allow an\n attacker to execute arbitrary code.
A heap overflow vulnerability has been discovered in the NeXT RLE\n decoder.
An loop was discovered where a 16bit unsigned short was used to\n iterate over a 32bit unsigned value so that the loop would never\n terminate and continue forever.
Multiple unchecked arithmetic operations were uncovered, including\n a number of the range checking operations designed to ensure the\n offsets specified in TIFF directories are legitimate.
A flaw was also uncovered in libtiffs custom tag support which may\n result in abnormal behaviour, crashes, or potentially arbitrary\n code execution.
For the stable distribution (sarge) these problems have been fixed in\nversion 3.7.2-7.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.8.2-6.
\nWe recommend that you upgrade your libtiff packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nCarlo Contavalli discovered an integer overflow in CFS, a cryptographic\nfilesystem, which allows local users to crash the encryption daemon.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4.1-15sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4.1-17.
\nWe recommend that you upgrade your cfs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the interpreter for the Ruby language does not\nproperly maintain \"safe levels\" for aliasing, directory accesses and\nregular expressions, which might lead to a bypass of security\nrestrictions.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.6.8-12sarge2.
\nThe unstable distribution (sid) does no longer contain ruby1.6 packages.
\nWe recommend that you upgrade your Ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEvgeny Legerov discovered that overly large comments can crash gnupg,\nthe GNU privacy guard - a free PGP replacement.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4.1-1.sarge5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4.5-1.
\nWe recommend that you upgrade your gnupg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEvgeny Legerov discovered that overly large comments can crash gnupg,\nthe GNU privacy guard - a free PGP replacement, which is also present\nin the development branch.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.9.15-6sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.9.20-2.
\nWe recommend that you upgrade your gnupg2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered missing boundary checks in freeciv, a clone\nof the well known Civilisation game, which can be exploited by remote\nattackers to cause a denial of service (crash) and possibly execute\narbitrary code.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.0.1-1sarge2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your freeciv package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJustin Winschief and Andrew Steets discovered a bug in dhcp, the DHCP\nserver for automatic IP address assignment, which causes the server to\nunexpectedly exit.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.0pl5-19.1sarge2.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your dhcp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that one of the utilities shipped with chmlib, a\nlibrary for dealing with Microsoft CHM files, performs insufficient\nsanitising of filenames, which might lead to directory traversal.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.35-6sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.38-1.
\nWe recommend that you upgrade your chmlib-bin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in freeradius, a\nhigh-performance RADIUS server, which may lead to SQL injection or denial\nof service. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nAn SQL injection vulnerability has been discovered in the\n rlm_sqlcounter module.
Multiple buffer overflows have been discovered, allowing denial of\n service.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.2-4sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.5-1.
\nWe recommend that you upgrade your freeradius packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIn certain application programs packaged in the MIT Kerberos 5 source\ndistribution, calls to setuid() and seteuid() are not always checked\nfor success and may fail with some PAM configurations. A local\nuser could exploit one of these vulnerabilities to result in privilege\nescalation. No exploit code is known to exist at this time.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.3.6-2sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.4.3-9.
\nWe recommend that you upgrade your krb5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAyman Hourieh discovered that Drupal, a dynamic website platform,\nperforms insufficient input sanitising in the user module, which\nmight lead to cross-site scripting.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.5.3-6.1sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.5.8-2.
\nWe recommend that you upgrade your drupal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in gallery, a web-based\nphoto album. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nA cross-site scripting vulnerability allows injection of web script\n code through HTML or EXIF information.
A cross-site scripting vulnerability in the user registration allows\n injection of web script code.
Missing input sanitising in the stats modules allows information\n disclosure.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.5-1sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5-2.
\nWe recommend that you upgrade your gallery package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy from the Google Security Team discovered a missing\nboundary check in ncompress, the original Lempel-Ziv compress and\nuncompress programs, which allows a specially crafted datastream to\nunderflow a buffer with attacker controlled data.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.2.4-15sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.2.4-15sarge2.
\nWe recommend that you upgrade your ncompress package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA bug has been discovered in several packages that execute the\nsetuid() system call without checking for success when trying to drop\nprivileges, which may fail with some PAM configurations.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 4.0.3-31sarge8.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.17-2.
\nWe recommend that you upgrade your passwd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nYan Rong Ge discovered out-of-boundary memory access in heartbeat, the\nsubsystem for High-Availability Linux. This could be used by a remote\nattacker to cause a denial of service.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2.3-9sarge6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.4-14 and heartbeat-2 2.0.6-2.
\nWe recommend that you upgrade your heartbeat packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFelix Wiemann discovered that trac, an enhanced Wiki and issue\ntracking system for software development projects, can be used to\ndisclose arbitrary local files. To fix this problem, python-docutils\nneeds to be updated as well.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.8.1-3sarge5 of trac and version 0.3.7-2sarge1 of\npython-docutils.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.6-1.
\nWe recommend that you upgrade your trac and python-docutils packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDamian Put discovered a heap overflow vulnerability in the UPX\nunpacker of the ClamAV anti-virus toolkit which could allow remote\nattackers to execute arbitrary code or cause denial of service.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.84-2.sarge.10.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.88.4-0volatile1 in the volatile archive.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.88.4-2.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJames Bercegay of GulfTech Security Research discovered a vulnerability\nin SquirrelMail where an authenticated user could overwrite random\nvariables in the compose script. This might be exploited to read or\nwrite the preferences or attachment files of other users.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4.4-9.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4.8-1.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt turned out that the sendmail binary depends on libsasl2 (>= 2.1.19.dfsg1)\nwhich is neither available in the stable nor in the security archive.\nThis version is scheduled for the inclusion in the next update of the\nstable release, though.
\nYou'll have to download the referenced file for your architecture from\nbelow and install it with dpkg -i.
\nAs an alternative, temporarily adding the following line to\n/etc/apt/sources.list will mitigate the problem as well:
\n\n deb http://ftp.debian.de/debian stable-proposed-updates main\n\nHere is the original security advisory for completeness:
\n\n\nFrank Sheiness discovered that a MIME conversion routine in sendmail,\na powerful, efficient, and scalable mail transport agent, could be\ntricked by a specially crafted mail to perform an endless recursion.
\n
For the stable distribution (sarge) this problem has been fixed in\nversion 8.13.4-3sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 8.13.7-1.
\nWe recommend that you upgrade your sendmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nLudwig Nussel discovered that kdm, the X display manager for KDE, handles\naccess to the session type configuration file insecurely, which may lead\nto the disclosure of arbitrary files through a symlink attack.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.3.2-1sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.5.2-2.
\nWe recommend that you upgrade your kdm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the interpreter for the\nRuby language, which may lead to the bypass of security restrictions or\ndenial of service. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that the use of blocking sockets can lead to denial\n of service.
It was discovered that Ruby does not properly maintain \"safe levels\"\n for aliasing, directory accesses and regular expressions, which might\n lead to a bypass of security restrictions.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.8.2-7sarge4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.8.4-3.
\nWe recommend that you upgrade your Ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar from the Debian Security Audit Project discovered that\nstreamripper, a utility to record online radio-streams, performs\ninsufficient sanitising of data received from the streaming server,\nwhich might lead to buffer overflows and the execution of arbitrary\ncode.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.61.7-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.61.25-2.
\nWe recommend that you upgrade your streamripper package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe latest security updates of Mozilla Thunderbird introduced a\nregression that led to a dysfunctional attachment panel which warrants\na correction to fix this issue. For reference please find below the\noriginal advisory text:
\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products such as Mozilla Thunderbird. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\n\n
\n- CVE-2006-2779\n
\nMozilla team members discovered several crashes during testing of\n the browser engine showing evidence of memory corruption which may\n also lead to the execution of arbitrary code. The last bit of\n this problem will be corrected with the next update. You can\n prevent any trouble by disabling Javascript. [MFSA-2006-32]
- CVE-2006-3805\n
\nThe Javascript engine might allow remote attackers to execute\n arbitrary code. [MFSA-2006-50]
- CVE-2006-3806\n
\nMultiple integer overflows in the Javascript engine might allow\n remote attackers to execute arbitrary code. [MFSA-2006-50]
- CVE-2006-3807\n
\nSpecially crafted Javascript allows remote attackers to execute\n arbitrary code. [MFSA-2006-51]
- CVE-2006-3808\n
\nRemote Proxy AutoConfig (PAC) servers could execute code with elevated\n privileges via a specially crafted PAC script. [MFSA-2006-52]
- CVE-2006-3809\n
\nScripts with the UniversalBrowserRead privilege could gain\n UniversalXPConnect privileges and possibly execute code or obtain\n sensitive data. [MFSA-2006-53]
- CVE-2006-3810\n
\nA cross-site scripting vulnerability allows remote attackers to\n inject arbitrary web script or HTML. [MFSA-2006-54]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.2-2.sarge1.0.8b.2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.0.5-1.
\nWe recommend that you upgrade your mozilla-thunderbird package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nThe latest security updates of Mozilla introduced a regression that\nled to a dysfunctional attachment panel which warrants a correction to\nfix this issue. For reference please find below the original advisory\ntext:
\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:
\n\n
\n- CVE-2006-2779\n
\nMozilla team members discovered several crashes during testing of\n the browser engine showing evidence of memory corruption which may\n also lead to the execution of arbitrary code. The last bit of\n this problem will be corrected with the next update. You can\n prevent any trouble by disabling Javascript. [MFSA-2006-32]
- CVE-2006-3805\n
\nThe Javascript engine might allow remote attackers to execute\n arbitrary code. [MFSA-2006-50]
- CVE-2006-3806\n
\nMultiple integer overflows in the Javascript engine might allow\n remote attackers to execute arbitrary code. [MFSA-2006-50]
- CVE-2006-3807\n
\nSpecially crafted Javascript allows remote attackers to execute\n arbitrary code. [MFSA-2006-51]
- CVE-2006-3808\n
\nRemote Proxy AutoConfig (PAC) servers could execute code with elevated\n privileges via a specially crafted PAC script. [MFSA-2006-52]
- CVE-2006-3809\n
\nScripts with the UniversalBrowserRead privilege could gain\n UniversalXPConnect privileges and possibly execute code or obtain\n sensitive data. [MFSA-2006-53]
- CVE-2006-3810\n
\nA cross-site scripting vulnerability allows remote attackers to\n inject arbitrary web script or HTML. [MFSA-2006-54]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.7.8-1sarge7.2.2.
\nFor the unstable distribution (sid) these problems won't be fixed\nsince its end of lifetime has been reached and the package will soon\nbe removed.
\nWe recommend that you upgrade your mozilla package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nThe latest security updates of Mozilla Firefox introduced a regression\nthat led to a dysfunctional attachment panel which warrants a\ncorrection to fix this issue. For reference please find below the\noriginal advisory text:
\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products like Mozilla Firefox. The Common Vulnerabilities and\nExposures project identifies the following vulnerabilities:
\n\n
\n- CVE-2006-3805\n
\nThe Javascript engine might allow remote attackers to execute\n arbitrary code. [MFSA-2006-50]
- CVE-2006-3806\n
\nMultiple integer overflows in the Javascript engine might allow\n remote attackers to execute arbitrary code. [MFSA-2006-50]
- CVE-2006-3807\n
\nSpecially crafted Javascript allows remote attackers to execute\n arbitrary code. [MFSA-2006-51]
- CVE-2006-3808\n
\nRemote Proxy AutoConfig (PAC) servers could execute code with elevated\n privileges via a specially crafted PAC script. [MFSA-2006-52]
- CVE-2006-3809\n
\nScripts with the UniversalBrowserRead privilege could gain\n UniversalXPConnect privileges and possibly execute code or obtain\n sensitive data. [MFSA-2006-53]
- CVE-2006-3811\n
\nMultiple vulnerabilities allow remote attackers to cause a denial\n of service (crash) and possibly execute arbitrary code.\n [MFSA-2006-55]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge11.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.dfsg+1.5.0.5-1.
\nWe recommend that you upgrade your mozilla-firefox package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nLuigi Auriemma discovered several buffer overflows in libmusicbrainz,\na CD index library, that allow remote attackers to cause a denial of\nservice or execute arbitrary code.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2.0.2-10sarge1 and 2.1.1-3sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.1.4-1.
\nWe recommend that you upgrade your libmusicbrainz packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Gehring discovered several potential out-of-bounds index\naccesses in gtetrinet, a multiplayer Tetris-like game, which may allow\na remote server to execute arbitrary code.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.7.8-1sarge2.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your gtetrinet package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA programming error has been discovered in sendmail, an alternative\nmail transport agent for Debian, that could allow a remote attacker to\ncrash the sendmail process by sending a specially crafted email\nmessage.
\nPlease note that in order to install this update you also need\nlibsasl2 library from proposed updates as outlined in DSA 1155-2.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 8.13.3-3sarge3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 8.13.8-1.
\nWe recommend that you upgrade your sendmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLionel Elie Mamane discovered a security vulnerability in\ncapi4hylafax, tools for faxing over a CAPI 2.0 device, that allows\nremote attackers to execute arbitrary commands on the fax receiving\nsystem.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 01.02.03-10sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 01.03.00.99.svn.300-3.
\nWe recommend that you upgrade your capi4hylafax package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered a buffer overflow in the loading component\nof cheesetracker, a sound module tracking program, which could allow a\nmaliciously constructed input file to execute arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.9-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.9-6.
\nWe recommend that you upgrade your cheesetracker package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Apache, the\nworlds most popular webserver, which may lead to the execution of arbitrary\nweb script. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nA cross-site scripting (XSS) flaw exists in the mod_imap component of\n the Apache server.
Apache does not sanitize the Expect header from an HTTP request when\n it is reflected back in an error message, which might allow cross-site\n scripting (XSS) style attacks.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.3.33-6sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.34-3.
\nWe recommend that you upgrade your apache package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Imagemagick, a\ncollection of image manipulation tools, which may lead to the execution\nof arbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nEero H\u00e4kkinen discovered that the display tool allocates insufficient\n memory for globbing patterns, which might lead to a buffer overflow.
Tavis Ormandy from the Google Security Team discovered that the Sun\n bitmap decoder performs insufficient input sanitising, which might\n lead to buffer overflows and the execution of arbitrary code.
Tavis Ormandy from the Google Security Team discovered that the XCF\n image decoder performs insufficient input sanitising, which might\n lead to buffer overflows and the execution of arbitrary code.
For the stable distribution (sarge) these problems have been fixed in\nversion 6:6.0.6.2-2.7.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your imagemagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the MySQL\ndatabase server. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nMichal Prokopiuk discovered that remote authenticated users are\n permitted to create and access a database if the lowercase\n spelling is the same as one they have been granted access to.
Beat Vontobel discovered that certain queries replicated to a\n slave could crash the client and thus terminate the replication.
For the stable distribution (sarge) these problems have been fixed in\nversion 4.1.11a-4sarge7. Version 4.0 is not affected by these\nproblems.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 5.0.24-3. The replication problem only exists in version 4.1.
\nWe recommend that you upgrade your mysql-server-4.1 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJ\u00fcrgen Weigert discovered that upon unpacking JAR archives fastjar\nfrom the GNU Compiler Collection does not check the path for included\nfiles and allows to create or overwrite files in upper directories.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.4.3-13sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.1.1-11.
\nWe recommend that you upgrade your fastjar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Ethereal network\nscanner, which may lead to the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nIt was discovered that the Q.2391 dissector is vulnerable to denial\n of service caused by memory exhaustion.
It was discovered that the FC-FCS, RSVP and ISIS-LSP dissectors are\n vulnerable to denial of service caused by memory exhaustion.
It was discovered that the IrDA and SMB dissectors are vulnerable to\n denial of service caused by memory corruption.
It was discovered that the SLIMP3 and AgentX dissectors are vulnerable\n to code injection caused by buffer overflows.
It was discovered that the BER dissector is vulnerable to denial of\n service caused by an infinite loop.
It was discovered that the NCP and RTnet dissectors are vulnerable to\n denial of service caused by a null pointer dereference.
It was discovered that the X11 dissector is vulnerable to denial of service\n caused by a division through zero.
This update also fixes a 64 bit-specific regression in the ASN.1 decoder, which\nwas introduced in a previous DSA.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.10.10-2sarge8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.99.2-5.1 of wireshark, the network sniffer formerly known as\nethereal.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in BIND9, the Berkeley\nInternet Name Domain server. The first relates to SIG query\nprocessing and the second relates to a condition that can trigger an\nINSIST failure, both lead to a denial of service.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 9.2.4-1sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 9.3.2-P1-1.
\nWe recommend that you upgrade your bind9 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDaniel Bleichenbacher discovered a flaw in the OpenSSL cryptographic package\nthat could allow an attacker to generate a forged signature that OpenSSL\nwill accept as valid.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.7e-3sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.9.8b-3.
\nWe recommend that you upgrade your openssl packages. Note that services\nlinking against the openssl shared libraries will need to be restarted.\nCommon examples of such services include most Mail Transport Agents, SSH\nservers, and web servers.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDaniel Bleichenbacher discovered a flaw in the OpenSSL cryptographic package\nthat could allow an attacker to generate a forged signature that OpenSSL\nwill accept as valid.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.6m-1sarge2.
\nThis package exists only for compatibility with older software, and is\nnot present in the unstable or testing branches of Debian.
\nWe recommend that you upgrade your openssl packages. Note that services\nlinking against the openssl shared libraries will need to be restarted.\nCommon examples of such services include most Mail Transport Agents, SSH\nservers, and web servers.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA flaw has been found in isakmpd, OpenBSD's implementation of the\nInternet Key Exchange protocol, that caused Security Associations to be\ncreated with a replay window of 0 when isakmpd was acting as the\nresponder during SA negotiation. This could allow an attacker to\nre-inject sniffed IPsec packets, which would not be checked against the\nreplay counter.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 20041012-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 20041012-4.
\nWe recommend that you upgrade your isakmpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Zope web application server does not disable\nthe csv_table directive in web pages containing ReST markup, allowing\nthe exposure of files readable by the Zope server.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.7.5-2sarge2.
\nThe unstable distribution (sid) doesn't contain zope2.7 any longer, for\nzope2.8 this problem has been fixed in version 2.8.8-2.
\nWe recommend that you upgrade your Zope package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHendrik Weimer discovered that it is possible for a normal user to\ndisable the login shell of the root account via usermin, a web-based\nadministration tool.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.110-3.1.
\nIn the upstream distribution this problem is fixed in version 1.220.
\nWe recommend that you upgrade your usermin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in freetype's PCF font code\nmay lead to denial of service and potential execution of arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.1.7-6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.1-5.
\nWe recommend that you upgrade your freetype package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered several buffer overflows in alsaplayer, a\nPCM player designed for ALSA, that can lead to a crash of the\napplication and maybe worse outcome.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.99.76-0.3sarge1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your alsaplayer package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered two security related bugs in bomberclone, a\nfree Bomberman clone. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nThe program copies remotely provided data unchecked which could\n lead to a denial of service via an application crash.
Bomberclone uses remotely provided data as length argument which\n can lead to the disclosure of private information.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.11.5-1sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.11.7-0.1.
\nWe recommend that you upgrade your bomberclone package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy from the Google Security Team discovered several\nvulnerabilities in gzip, the GNU compression utility. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nA null pointer dereference may lead to denial of service if gzip is\n used in an automated manner.
Missing boundary checks may lead to stack modification, allowing\n execution of arbitrary code.
A buffer underflow in the pack support code may lead to execution of\n arbitrary code.
A buffer underflow in the LZH support code may lead to execution of\n arbitrary code.
An infinite loop may lead to denial of service if gzip is used in\n an automated manner.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.3.5-10sarge2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.5-15.
\nWe recommend that you upgrade your gzip package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDaniel Bleichenbacher discovered a flaw in GNU TLS cryptographic package\nthat could allow an attacker to generate a forged signature that GNU TLS\nwill accept as valid.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.16-13.2sarge2.
\nThe unstable distribution (sid) does no longer contain gnutls11, for\ngnutls13 this problem has been fixed in version 1.4.4-1.
\nWe recommend that you upgrade your GNU TLS package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in the Linux\nkernel which may lead to a denial of service or even the execution of\narbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nA buffer overflow in NFS readlink handling allows a malicious\n remote server to cause a denial of service.
Diego Calleja Garcia discovered a buffer overflow in the DVD\n handling code that could be exploited by a specially crafted DVD\n USB storage device to execute arbitrary code.
A bug in the SCSI driver allows a local user to cause a denial of\n service.
Patrick McHardy discovered a bug in the SNMP NAT helper that\n allows remote attackers to cause a denial of service.
A race condition in the socket buffer handling allows remote\n attackers to cause a denial of service.
Wei Wang discovered a bug in the SCTP implementation that allows\n local users to cause a denial of service and possibly gain root\n privileges.
David Miller reported a problem with the fix for CVE-2006-3745\n that allows local users to crash the system via an SCTP\n socket with a certain SO_LINGER value.
The following matrix explains which kernel version for which\narchitecture fixes the problem mentioned above:
\n| \u00a0 | \nstable (sarge) | \n
|---|---|
| Source | \n2.4.27-10sarge4 | \n
| Alpha architecture | \n2.4.27-10sarge4 | \n
| ARM architecture | \n2.4.27-2sarge4 | \n
| Intel IA-32 architecture | \n2.4.27-10sarge4 | \n
| Intel IA-64 architecture | \n2.4.27-10sarge4 | \n
| Motorola 680x0 architecture | \n2.4.27-3sarge4 | \n
| MIPS architectures | \n2.4.27-10.sarge4.040815-1 | \n
| PowerPC architecture | \n2.4.27-10sarge4 | \n
| IBM S/390 | \n2.4.27-2sarge4 | \n
| Sun Sparc architecture | \n2.4.27-9sarge4 | \n
| FAI | \n1.9.1sarge4 | \n
| mindi-kernel | \n2.4.27-2sarge3 | \n
| kernel-image-speakup-i386 | \n2.4.27-1.1sarge3 | \n
| systemimager | \n3.2.3-6sarge3 | \n
For the unstable distribution (sid) these problems won't be fixed\nanymore in the 2.4 kernel series.
\nWe recommend that you upgrade your kernel package and reboot the\nmachine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis advisory covers the S/390 components of the recent security\nupdate for the Linux 2.6.8 kernel that were missing due to technical\nproblems. For reference, please see the text of the original advisory.
\n\n\nSeveral security related problems have been discovered in the Linux\nkernel which may lead to a denial of service or even the execution of\narbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\n\n
\n- CVE-2004-2660\n
\nToshihiro Iwamoto discovered a memory leak in the handling of\n direct I/O writes that allows local users to cause a denial of\n service.
- CVE-2005-4798\n
\nA buffer overflow in NFS readlink handling allows a malicious\n remote server to cause a denial of service.
- CVE-2006-1052\n
\nStephen Smalley discovered a bug in the SELinux ptrace handling\n that allows local users with ptrace permissions to change the\n tracer SID to the SID of another process.
- CVE-2006-1343\n
\nPavel Kankovsky discovered an information leak in the getsockopt\n system call which can be exploited by a local program to leak\n potentially sensitive memory to userspace.
- CVE-2006-1528\n
\nDouglas Gilbert reported a bug in the sg driver that allows local\n users to cause a denial of service by performing direct I/O\n transfers from the sg driver to memory mapped I/O space.
- CVE-2006-1855\n
\nMattia Belletti noticed that certain debugging code left in the\n process management code could be exploited by a local attacker to\n cause a denial of service.
- CVE-2006-1856\n
\nKostik Belousov discovered a missing LSM file_permission check in\n the readv and writev functions which might allow attackers to\n bypass intended access restrictions.
- CVE-2006-2444\n
\nPatrick McHardy discovered a bug in the SNMP NAT helper that\n allows remote attackers to cause a denial of service.
- CVE-2006-2446\n
\nA race condition in the socket buffer handling allows remote\n attackers to cause a denial of service.
- CVE-2006-2935\n
\nDiego Calleja Garcia discovered a buffer overflow in the DVD\n handling code that could be exploited by a specially crafted DVD\n USB storage device to execute arbitrary code.
- CVE-2006-2936\n
\nA bug in the serial USB driver has been discovered that could be\n exploited by a custom made USB serial adapter to consume arbitrary\n amounts of memory.
- CVE-2006-3468\n
\nJames McKenzie discovered a denial of service vulnerability in the\n NFS driver. When exporting an ext3 file system over NFS, a remote\n attacker could exploit this to trigger a file system panic by\n sending a specially crafted UDP packet.
- CVE-2006-3745\n
\nWei Wang discovered a bug in the SCTP implementation that allows\n local users to cause a denial of service and possibly gain root\n privileges.
- CVE-2006-4093\n
\nOlof Johansson discovered that the kernel does not disable the HID0\n bit on PowerPC 970 processors which could be exploited by a local\n attacker to cause a denial of service.
- CVE-2006-4145\n
\nA bug in the Universal Disk Format (UDF) filesystem driver could\n be exploited by a local user to cause a denial of service.
- CVE-2006-4535\n
\nDavid Miller reported a problem with the fix for CVE-2006-3745\n that allows local users to crash the system via an SCTP\n socket with a certain SO_LINGER value.
The following matrix explains which kernel version for which\narchitecture fixes the problem mentioned above:
\n| \u00a0 | \nstable (sarge) | \n
|---|---|
| Source | \n2.6.8-16sarge5 | \n
| Alpha architecture | \n2.6.8-16sarge5 | \n
| AMD64 architecture | \n2.6.8-16sarge5 | \n
| HP Precision architecture | \n2.6.8-6sarge5 | \n
| Intel IA-32 architecture | \n2.6.8-16sarge5 | \n
| Intel IA-64 architecture | \n2.6.8-14sarge5 | \n
| Motorola 680x0 architecture | \n2.6.8-4sarge5 | \n
| PowerPC architecture | \n2.6.8-12sarge5 | \n
| IBM S/390 | \n2.6.8-5sarge5 | \n
| Sun Sparc architecture | \n2.6.8-15sarge5 | \n
| FAI | \n1.9.1sarge4 | \n
For the unstable distribution (sid) these problems have been fixed in\nversion 2.6.18-1.
\nWe recommend that you upgrade your kernel package and reboot the\nmachine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nThe fix used to correct CVE-2006-2940 introduced code that could lead to\nthe use of uninitialized memory. Such use is likely to cause the\napplication using the openssl library to crash, and has the potential to\nallow an attacker to cause the execution of arbitrary code.\nFor reference please find below the original advisory text:
\n\n\nMultiple vulnerabilities have been discovered in the OpenSSL\ncryptographic software package that could allow an attacker to launch\na denial of service attack by exhausting system resources or crashing\nprocesses on a victim's computer.
\n\n
\n- CVE-2006-2937\n
\nDr S N Henson of the OpenSSL core team and Open Network\n\tSecurity recently developed an ASN1 test suite for NISCC\n\t(www.niscc.gov.uk). When the test suite was run against\n\tOpenSSL two denial of service vulnerabilities were discovered.
\nDuring the parsing of certain invalid ASN1 structures an error\n\tcondition is mishandled. This can result in an infinite loop\n\twhich consumes system memory.
\nAny code which uses OpenSSL to parse ASN1 data from untrusted\n\tsources is affected. This includes SSL servers which enable\n\tclient authentication and S/MIME applications.
- CVE-2006-3738\n
\nTavis Ormandy and Will Drewry of the Google Security Team\n\tdiscovered a buffer overflow in SSL_get_shared_ciphers utility\n\tfunction, used by some applications such as exim and mysql. An\n\tattacker could send a list of ciphers that would overrun a\n\tbuffer.
- CVE-2006-4343\n
\nTavis Ormandy and Will Drewry of the Google Security Team\n\tdiscovered a possible DoS in the sslv2 client code. Where a\n\tclient application uses OpenSSL to make a SSLv2 connection to\n\ta malicious server that server could cause the client to\n\tcrash.
- CVE-2006-2940\n
\nDr S N Henson of the OpenSSL core team and Open Network\n\tSecurity recently developed an ASN1 test suite for NISCC\n\t(www.niscc.gov.uk). When the test suite was run against\n\tOpenSSL a DoS was discovered.
\nCertain types of public key can take disproportionate amounts\n\tof time to process. This could be used by an attacker in a\n\tdenial of service attack.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.9.7e-3sarge4.
\nFor the unstable and testing distributions (sid and etch,\nrespectively), these problems will be fixed in version 0.9.7k-3 of the\nopenssl097 compatibility libraries, and version 0.9.8c-3 of the\nopenssl package.
\nWe recommend that you upgrade your openssl package. Note that\nservices linking against the openssl shared libraries will need to be\nrestarted. Common examples of such services include most Mail\nTransport Agents, SSH servers, and web servers.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nWill Drewry of the Google Security Team discovered several buffer overflows\nin cscope, a source browsing tool, which might lead to the execution of\narbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 15.5-1.1sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 15.5+cvs20060902-1.
\nWe recommend that you upgrade your cscope package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJason Hoover discovered that migrationtools, a collection of scripts\nto migrate user data to LDAP creates several temporary files insecurely,\nwhich might lead to denial of service through a symlink attack.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 46-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 46-2.1.
\nWe recommend that you upgrade your migrationtools package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in mailman, the\nweb-based GNU mailing list manager. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMoritz Naumann discovered several cross-site scripting problems\n that could allow remote attackers to inject arbitrary web script code\n or HTML.
Moritz Naumann discovered that a remote attacker can inject\n arbitrary strings into the logfile.
For the stable distribution (sarge) these problems have been fixed in\nversion 2.1.5-8sarge5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.1.8-3.
\nWe recommend that you upgrade your mailman package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in OpenSSH, a free\nimplementation of the Secure Shell protocol, which may lead to denial of\nservice and potentially the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nTavis Ormandy of the Google Security Team discovered a denial of\n service vulnerability in the mitigation code against complexity\n attacks, which might lead to increased CPU consumption until a\n timeout is triggered. This is only exploitable if support for\n SSH protocol version 1 is enabled.
Mark Dowd discovered that insecure signal handler usage could\n potentially lead to execution of arbitrary code through a double\n free. The Debian Security Team doesn't believe the general openssh\n package without Kerberos support to be exploitable by this issue.\n However, due to the complexity of the underlying code we will\n issue an update to rule out all eventualities.
For the stable distribution (sarge) these problems have been fixed in\nversion 3.8.1p1-7sarge1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.3p2-4 of openssh. openssh-krb5 will soon be converted towards\na transitional package against openssh.
\nWe recommend that you upgrade your openssh-krb5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nOliver Karow discovered that the WebDBM frontend of the MaxDB database\nperforms insufficient sanitising of requests passed to it, which might\nlead to the execution of arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 7.5.00.24-4.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your maxdb-7.5.00 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products such as Mozilla Thunderbird. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nFernando Ribeiro discovered that a vulnerability in the getRawDER\n function allows remote attackers to cause a denial of service\n (hang) and possibly execute arbitrary code.
Daniel Bleichenbacher recently described an implementation error\n in RSA signature verification that cause the application to\n incorrectly trust SSL certificates.
Priit Laes reported that a JavaScript regular expression can\n trigger a heap-based buffer overflow which allows remote attackers\n to cause a denial of service and possibly execute arbitrary code.
A vulnerability has been discovered that allows remote attackers\n to bypass the security model and inject content into the sub-frame\n of another site.
Georgi Guninski demonstrated that even with JavaScript disabled in\n mail (the default) an attacker can still execute JavaScript when a\n mail message is viewed, replied to, or forwarded.
Multiple unspecified vulnerabilities in Firefox, Thunderbird and\n SeaMonkey allow remote attackers to cause a denial of service,\n corrupt memory, and possibly execute arbitrary code.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.2-2.sarge1.0.8c.1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.0.7-1.
\nWe recommend that you upgrade your Mozilla Thunderbird packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products such as Mozilla Thunderbird. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nFernando Ribeiro discovered that a vulnerability in the getRawDER\n function allows remote attackers to cause a denial of service\n (hang) and possibly execute arbitrary code.
Daniel Bleichenbacher recently described an implementation error\n in RSA signature verification that cause the application to\n incorrectly trust SSL certificates.
Priit Laes reported that a JavaScript regular expression can\n trigger a heap-based buffer overflow which allows remote attackers\n to cause a denial of service and possibly execute arbitrary code.
A vulnerability has been discovered that allows remote attackers\n to bypass the security model and inject content into the sub-frame\n of another site.
Georgi Guninski demonstrated that even with JavaScript disabled in\n mail (the default) an attacker can still execute JavaScript when a\n mail message is viewed, replied to, or forwarded.
Multiple unspecified vulnerabilities in Firefox, Thunderbird and\n SeaMonkey allow remote attackers to cause a denial of service,\n corrupt memory, and possibly execute arbitrary code.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.7.8-1sarge7.3.1.
\nWe recommend that you upgrade your Mozilla packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the X Window System,\nwhich may lead to the execution of arbitrary code or denial of service.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nChris Evan discovered an integer overflow in the code to handle\n PCF fonts, which might lead to denial of service if a malformed\n font is opened.
It was discovered that an integer overflow in the code to handle\n Adobe Font Metrics might lead to the execution of arbitrary code.
It was discovered that an integer overflow in the code to handle\n CMap and CIDFont font data might lead to the execution of arbitrary\n code.
The XFree86 initialization code performs insufficient checking of\n the return value of setuid() when dropping privileges, which might\n lead to local privilege escalation.
For the stable distribution (sarge) these problems have been fixed in\nversion 4.3.0.dfsg.1-14sarge2. This release lacks builds for the\nMotorola 680x0 architecture, which failed due to diskspace constraints\non the build host. They will be released once this problem has been\nresolved.
\nFor the unstable distribution (sid) these problems have been fixed\nin version 1:1.2.2-1 of libxfont and version 1:1.0.2-9 of xorg-server.
\nWe recommend that you upgrade your XFree86 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in libwmf, the library to read\nWindows Metafile Format files, can be exploited to execute arbitrary code\nif a crafted WMF file is parsed.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.2.8.3-2sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.2.8.4-2.
\nWe recommend that you upgrade your libwmf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities have been discovered in the OpenSSL\ncryptographic software package that could allow an attacker to launch\na denial of service attack by exhausting system resources or crashing\nprocesses on a victim's computer.
\nTavis Ormandy and Will Drewry of the Google Security Team\n discovered a buffer overflow in SSL_get_shared_ciphers utility\n function, used by some applications such as exim and mysql. An\n attacker could send a list of ciphers that would overrun a\n buffer.
Tavis Ormandy and Will Drewry of the Google Security Team\n discovered a possible DoS in the sslv2 client code. Where a\n client application uses OpenSSL to make a SSLv2 connection to\n a malicious server that server could cause the client to\n crash.
Dr S N Henson of the OpenSSL core team and Open Network\n Security recently developed an ASN1 test suite for NISCC\n (www.niscc.gov.uk). When the test suite was run against\n OpenSSL a DoS was discovered.
\nCertain types of public key can take disproportionate amounts\n of time to process. This could be used by an attacker in a\n denial of service attack.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.9.6m-1sarge4.
\nThis package exists only for compatibility with older software, and is\nnot present in the unstable or testing branches of Debian.
\nWe recommend that you upgrade your openssl096 package. Note that\nservices linking against the openssl shared libraries will need to be\nrestarted. Common examples of such services include most Mail\nTransport Agents, SSH servers, and web servers.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the ClamAV malware\nscan engine, which may lead to the execution of arbitrary code. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nDamian Put discovered a heap overflow error in the script to rebuild\n PE files, which could lead to the execution of arbitrary code.
Damian Put discovered that missing input sanitising in the CHM\n handling code might lead to denial of service.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.11. Due to technical problems with the build host\nthis update lacks a build for the Sparc architecture. It will be\nprovided soon.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.88.5-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBenjamin C. Wiley Sittler discovered that the repr() of the Python\ninterpreter allocates insufficient memory when parsing UCS-4 Unicode\nstrings, which might lead to execution of arbitrary code through\na buffer overflow.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.4.1-2sarge1. Due to build problems this update lacks fixed\npackages for the m68k architecture. Once they are sorted out, binaries\nfor m68k will be released.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.4.4-1.
\nWe recommend that you upgrade your Python 2.4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBenjamin C. Wiley Sittler discovered that the repr() of the Python\ninterpreter allocates insufficient memory when parsing UCS-4 Unicode\nstrings, which might lead to execution of arbitrary code through\na buffer overflow.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.3.5-3sarge2. Due to build problems this update lacks fixed\npackages for the Alpha and Sparc architectures. Once they are sorted\nout, fixed binaries will be released.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3.5-16.
\nWe recommend that you upgrade your Python 2.3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been identified in webmin, a web-based\nadministration toolkit. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:
\nA format string vulnerability in miniserv.pl could allow an\n\tattacker to cause a denial of service by crashing the\n\tapplication or exhausting system resources, and could\n\tpotentially allow arbitrary code execution.
Improper input sanitization in miniserv.pl could allow an\n\tattacker to read arbitrary files on the webmin host by providing\n\ta specially crafted URL path to the miniserv http server.
Improper handling of null characters in URLs in miniserv.pl\n\tcould allow an attacker to conduct cross-site scripting attacks,\n\tread CGI program source code, list local directories, and\n\tpotentially execute arbitrary code.
Stable updates are available for alpha, amd64, arm, hppa, i386, ia64,\nm68k, mips, mipsel, powerpc, s390 and sparc.
\nFor the stable distribution (sarge), these problems have been fixed in\nversion 1.180-3sarge1.
\nWebmin is not included in unstable (sid) or testing (etch), so these\nproblems are not present.
\nWe recommend that you upgrade your webmin (1.180-3sarge1) package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn integer overflow has been found in the pixmap handling routines in\nthe Qt GUI libraries. This could allow an attacker to cause a denial of\nservice and possibly execute arbitrary code by providing a specially\ncrafted image file and inducing the victim to view it in an application\nbased on Qt.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 3:3.3.4-3sarge1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversions 3:3.3.7-1 and 4.2.1-1.
\nWe recommend that you upgrade your qt-x11-free packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Ethereal network\nscanner. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered that the MIME multipart dissector is vulnerable to\n denial of service caused by an off-by-one overflow.
It was discovered that the XOT dissector is vulnerable to denial\n of service caused by memory corruption.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.10.10-2sarge9. Due to technical problems with the security\nbuildd infrastructure this update lacks builds for the hppa and sparc\narchitecture. They will be released as soon as the problems are resolved.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\ncstone
and Rich Felker discovered that specially crafted UTF-8 sequences\nmay lead an out of bands memory write when displayed inside the screen\nterminal multiplexer, allowing denial of service and potentially the\nexecution of arbitrary code.
For the stable distribution (sarge) this problem has been fixed in\nversion 4.0.2-4.1sarge1. Due to technical problems with the security\nbuildd infrastructure this update lacks a build for the Sun Sparc\narchitecture. It will be released as soon as the problems are resolved.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.0.3-0.1.
\nWe recommend that you upgrade your screen package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Rigler discovered that the PAM module for authentication against\nLDAP servers processes PasswordPolicyReponse control messages incorrectly,\nwhich might lead to an attacker being able to login into a suspended\nsystem account.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 178-1sarge3. Due to technical problems with the security\nbuildd infrastructure this update lacks a build for the Sun Sparc\narchitecture. It will be released as soon as the problems are resolved.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 180-1.2.
\nWe recommend that you upgrade your libpam-ldap package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Ingo email filter rules manager performs\ninsufficient escaping of user-provided data in created procmail rules\nfiles, which allows the execution of arbitrary shell commands.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 1.0.1-1sarge1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.2-1.
\nWe recommend that you upgrade your ingo1 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe original advisory for this issue didn't contain fixed packages for all\nsupported architectures which are corrected in this update. For reference\nplease find below the original advisory text:
\n\n\nMarco d'Itri discovered that thttpd, a small, fast and secure webserver,\nmakes use of insecure temporary files when its logfiles are rotated,\nwhich might lead to a denial of service through a symlink attack.
\n
For the stable distribution (sarge) this problem has been fixed in\nversion 2.23beta1-3sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.23beta1-5.
\nWe recommend that you upgrade your thttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in PHP, a\nserver-side, HTML-embedded scripting language, which may lead to the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nTim Starling discovered that missing input sanitising in the EXIF\n module could lead to denial of service.
Stefan Esser discovered a security-critical programming error in the\n hashtable implementation of the internal Zend engine.
It was discovered that str_repeat() and wordwrap() functions perform\n insufficient checks for buffer boundaries on 64 bit systems, which\n might lead to the execution of arbitrary code.
Stefan Esser discovered a buffer overflow in the htmlspecialchars()\n and htmlentities(), which might lead to the execution of arbitrary\n code.
For the stable distribution (sarge) these problems have been fixed in\nversion 4:4.3.10-18. Builds for hppa and m68k will be provided later\nonce they are available.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4:4.4.4-4 of php4 and version 5.1.6-6 of php5.
\nWe recommend that you upgrade your php4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe phpmyadmin update in DSA 1207 introduced a regression. This update\ncorrects this flaw. For completeness, please find below the original\nadvisory text:
\n\n\nSeveral remote vulnerabilities have been discovered in phpMyAdmin, a\nprogram to administrate MySQL over the web. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\n\n
\n- CVE-2005-3621\n
\nCRLF injection vulnerability allows remote attackers to conduct\n HTTP response splitting attacks.
- CVE-2005-3665\n
\nMultiple cross-site scripting (XSS) vulnerabilities allow remote\n attackers to inject arbitrary web script or HTML via the (1) HTTP_HOST\n variable and (2) various scripts in the libraries directory that\n handle header generation.
- CVE-2006-1678\n
\nMultiple cross-site scripting (XSS) vulnerabilities allow remote\n attackers to inject arbitrary web script or HTML via scripts in the\n themes directory.
- CVE-2006-2418\n
\nA cross-site scripting (XSS) vulnerability allows remote attackers\n to inject arbitrary web script or HTML via the db parameter of\n footer.inc.php.
- CVE-2006-5116\n
\nA remote attacker could overwrite internal variables through the\n _FILES global variable.
For the stable distribution (sarge) these problems have been fixed in\nversion 2.6.2-3sarge3.
\nFor the upcoming stable release (etch) and unstable distribution (sid)\nthese problems have been fixed in version 2.9.0.3-1.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Bugzilla\nbug tracking system, which may lead to the execution of arbitrary code.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nJavier Fern\u00e1ndez-Sanguino Pe\u00f1a discovered that insecure temporary\n file usage may lead to denial of service through a symlink attack.
Several cross-site scripting vulnerabilities may lead to injection\n of arbitrary web script code.
For the stable distribution (sarge) these problems have been fixed in\nversion 2.16.7-7sarge2.
\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 2.22.1-1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.22.1-1.
\nWe recommend that you upgrade your bugzilla packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Trac, a wiki and issue tracking system for\nsoftware development projects, performs insufficient validation against\ncross-site request forgery, which might lead to an attacker being able\nto perform manipulation of a Trac site with the privileges of the\nattacked Trac user.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.8.1-3sarge7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.10.1-1.
\nWe recommend that you upgrade your trac package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products such as Mozilla Firefox. The Common\nVulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nFernando Ribeiro discovered that a vulnerability in the getRawDER\n function allows remote attackers to cause a denial of service\n (hang) and possibly execute arbitrary code.
Daniel Bleichenbacher recently described an implementation error\n in RSA signature verification that cause the application to\n incorrectly trust SSL certificates.
Priit Laes reported that a JavaScript regular expression can\n trigger a heap-based buffer overflow which allows remote attackers\n to cause a denial of service and possibly execute arbitrary code.
A vulnerability has been discovered that allows remote attackers\n to bypass the security model and inject content into the sub-frame\n of another site.
Multiple unspecified vulnerabilities in Firefox, Thunderbird and\n SeaMonkey allow remote attackers to cause a denial of service,\n corrupt memory, and possibly execute arbitrary code.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge12.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.5.dfsg+1.5.0.7-1 of firefox.
\nWe recommend that you upgrade your Mozilla Firefox packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that malformed TCP packets may lead to denial of service\nand possibly the execution of arbitrary code if the PowerDNS nameserver\nacts as a recursive nameserver.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.9.17-13sarge3.
\nFor the upcoming stable distribution (etch) this problem has been fixed\nin version 3.1.4-1 of pdns-recursor.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.1.4-1 of pdns-recursor.
\nWe recommend that you upgrade your PowerDNS packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo denial of service problems have been found in the OpenSSH\nserver. The Common Vulnerabilities and Exposures project identifies the\nfollowing vulnerabilities:
\nThe sshd support for ssh protocol version 1 does not properly\n handle duplicate incoming blocks. This could allow a remote\n attacker to cause sshd to consume significant CPU resources\n leading to a denial of service.
A signal handler race condition could potentially allow a remote\n attacker to crash sshd and could theoretically lead to the\n ability to execute arbitrary code.
For the stable distribution (sarge), these problems have been fixed in\nversion 1:3.8.1p1-8.sarge.6.
\nFor the unstable and testing distributions, these problems have been\nfixed in version 1:4.3p2-4.
\nWe recommend that you upgrade your openssh package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Imagemagick,\na collection of image manipulation programs, which may lead to the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nDaniel Kobras discovered that Imagemagick is vulnerable to format\n string attacks in the filename parsing code.
Damian Put discovered that Imagemagick is vulnerable to buffer\n overflows in the module for SGI images.
M Joonas Pihlaja discovered that Imagemagick is vulnerable to buffer\n overflows in the module for DCM and PALM images.
Daniel Kobras discovered that Imagemagick is vulnerable to buffer\n overflows in the module for SGI images.
This update also addresses regressions in the XCF codec, which were\nintroduced in the previous security update.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 6:6.0.6.2-2.8.
\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 7:6.2.4.5.dfsg1-0.11.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 7:6.2.4.5.dfsg1-0.11.
\nWe recommend that you upgrade your imagemagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe original update provided in DSA 1214-1 was insufficient; this update\ncorrects this. For reference please find the original advisory text below:\n
\n\n\nRenaud Lifchitz discovered that gv, the PostScript and PDF viewer for X,\nperforms insufficient boundary checks in the Postscript parsing code,\nwhich allows the execution of arbitrary code through a buffer overflow.
\n
For the stable distribution (sarge) this problem has been fixed in\nversion 3.6.1-10sarge2.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 3.6.2-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.6.2-2.
\nWe recommend that you upgrade your gv package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Xine multimedia\nlibrary, which may lead to the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nThe XFocus Security Team discovered that insufficient validation of\n AVI headers may lead to the execution of arbitrary code.
Michael Niedermayer discovered that a buffer overflow in the 4XM\n codec may lead to the execution of arbitrary code.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.1-1sarge4.
\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 1.1.2-1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.1.2-1.
\nWe recommend that you upgrade your xine-lib packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nEric Romang discovered that the flexbackup backup tool creates temporary\nfiles in an insecure manner, which allows denial of service through a\nsymlink attack.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2.1-2sarge1.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 1.2.1-3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.1-3.
\nWe recommend that you upgrade your flexbackup package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Szabo discovered that the netkit ftp server switches the user id too\nlate, which may lead to the bypass of access restrictions when running\non NFS. This update also adds return value checks to setuid() calls, which\nmay fail in some PAM configurations.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.17-20sarge2.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 0.17-22.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.17-22.
\nWe recommend that you upgrade your ftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the proftpd FTP daemon performs insufficient\nvalidation of FTP command buffer size limits, which may lead to denial of\nservice.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2.10-15sarge2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.0-13 of the proftpd-dfsg package.
\nWe recommend that you upgrade your proftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities have been found in the GNU texinfo package, a\ndocumentation system for on-line information and printed output.
\nHandling of temporary files is performed in an insecure manner, allowing\n an attacker to overwrite any file writable by the victim.
A buffer overflow in util/texindex.c could allow an attacker to execute\n arbitrary code with the victim's access rights by inducing the victim to\n run texindex or tex2dvi on a specially crafted texinfo file.
For the stable distribution (sarge), these problems have been fixed in\nversion 4.7-2.2sarge2. Note that binary packages for the mipsel\narchitecture are not currently available due to technical problems with\nthe build host. These packages will be made available as soon as\npossible.
\nFor unstable (sid) and the upcoming stable release (etch), these\nproblems have been fixed in version 4.8.dfsg.1-4.
\nWe recommend that you upgrade your texinfo package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBrian May discovered that pstotext, a utility to extract plain text from\nPostscript and PDF files, performs insufficient quoting of file names,\nwhich allows execution of arbitrary shell commands.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.9-1sarge2. The build for the mipsel architecture is not yet\navailable due to technical problems with the build host.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 1.9-4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.9-4.
\nWe recommend that you upgrade your pstotext package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\ninfamous41md
discovered a heap buffer overflow vulnerability in\nlibgsf, a GNOME library for reading and writing structured file\nformats, which could lead to the execution of arbitrary code.
For the stable distribution (sarge) this problem has been fixed in\nversion 1.11.1-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.14.2-1.
\nWe recommend that you upgrade your libgsf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDue to technical problems yesterday's proftpd update lacked a build for\nthe amd64 architecture, which is now available. For reference please find\nbelow the original advisory text:
\n\n\nSeveral remote vulnerabilities have been discovered in the proftpd FTP\ndaemon, which may lead to the execution of arbitrary code or denial\nof service. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\n\n
\n- CVE-2006-5815\n
\nIt was discovered that a buffer overflow in the
sreplace()function\n may lead to denial of service and possibly the execution of arbitrary\n code.- CVE-2006-6170\n
\nIt was discovered that a buffer overflow in the mod_tls addon module\n may lead to the execution of arbitrary code.
- CVE-2006-6171\n
\nIt was discovered that insufficient validation of FTP command buffer\n size limits may lead to denial of service. Due to unclear information\n this issue was already fixed in DSA-1218 as CVE-2006-5815.
For the stable distribution (sarge) these problems have been fixed in version\n1.2.10-15sarge3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.0-16 of the proftpd-dfsg package.
\nWe recommend that you upgrade your proftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nTeemu Salmela discovered a vulnerability in GNU tar that could allow a\nmalicious user to overwrite arbitrary files by inducing the victim to\nattempt to extract a specially crafted tar file containing a\nGNUTYPE_NAMES record with a symbolic link.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 1.14-2.3.
\nFor the unstable distribution (sid) and the forthcoming stable release\n(etch), this problem will be fixed in version 1.16-2.
\nWe recommend that you upgrade your tar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:
\nTomas Kempinsky discovered that malformed FTP server responses\n could lead to denial of service.
Ulrich K\u00fchn discovered that the correction for a cryptographic\n flaw in the handling of PKCS-1 certificates was incomplete, which\n allows the forgery of certificates.
shutdown
discovered that modification of JavaScript objects\n during execution could lead to the execution of arbitrary\n JavaScript bytecode.
Jesse Ruderman and Martijn Wargers discovered several crashes in\n the layout engine, which might also allow execution of arbitrary\n code.
Igor Bukanov and Jesse Ruderman discovered several crashes in the\n JavaScript engine, which might allow execution of arbitrary code.
\nThis update also addresses several crashes, which could be triggered by\nmalicious websites and fixes a regression introduced in the previous\nMozilla update.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.7.8-1sarge8.
\nWe recommend that you upgrade your mozilla package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis update covers packages for the little endian MIPS architecture\nmissing in the original advisory. For reference please find below the\noriginal advisory text:
\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products such as Mozilla Firefox. The Common Vulnerabilities\nand Exposures project identifies the following vulnerabilities:
\n\n
\n- CVE-2006-4310\n
\nTomas Kempinsky discovered that malformed FTP server responses\n could lead to denial of service.
- CVE-2006-5462\n
\nUlrich K\u00fchn discovered that the correction for a cryptographic\n flaw in the handling of PKCS-1 certificates was incomplete, which\n allows the forgery of certificates.
- CVE-2006-5463\n
\n
shutdowndiscovered that modification of JavaScript objects\n during execution could lead to the execution of arbitrary\n JavaScript bytecode.- CVE-2006-5464\n
\nJesse Ruderman and Martijn Wargers discovered several crashes in\n the layout engine, which might also allow execution of arbitrary\n code.
- CVE-2006-5748\n
\nIgor Bukanov and Jesse Ruderman discovered several crashes in the\n JavaScript engine, which might allow execution of arbitrary code.
\nThis update also addresses several crashes, which could be triggered by\nmalicious websites and fixes a regression introduced in the previous\nMozilla update.
\n
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge13.
\nFor the unstable distribution (sid) these problems have been fixed in\nthe current iceweasel package 2.0+dfsg-1.
\nWe recommend that you upgrade your mozilla-firefox package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nTeemu Salmela discovered that the links character mode web browser\nperforms insufficient sanitising of smb:// URIs, which might lead to the\nexecution of arbitrary shell commands.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.99+1.00pre12-1sarge1.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 0.99+1.00pre12-1.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.99+1.00pre12-1.1.
\nWe recommend that you upgrade your links package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products such as Mozilla Thunderbird. The Common Vulnerabilities\nand Exposures project identifies the following vulnerabilities:
\nTomas Kempinsky discovered that malformed FTP server responses\n could lead to denial of service.
Ulrich K\u00fchn discovered that the correction for a cryptographic\n flaw in the handling of PKCS-1 certificates was incomplete, which\n allows the forgery of certificates.
shutdown
discovered that modification of JavaScript objects\n during execution could lead to the execution of arbitrary\n JavaScript bytecode.
Jesse Ruderman and Martijn Wargers discovered several crashes in\n the layout engine, which might also allow execution of arbitrary\n code.
Igor Bukanov and Jesse Ruderman discovered several crashes in the\n JavaScript engine, which might allow execution of arbitrary code.
\nThis update also addresses several crashes, which could be triggered by\nmalicious websites and fixes a regression introduced in the previous\nMozilla update.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge13.
\nFor the unstable distribution (sid) these problems have been fixed in\nthe current icedove package 1.5.0.8.
\nWe recommend that you upgrade your mozilla-thunderbird package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTeemu Salmela discovered that the elinks character mode web browser\nperforms insufficient sanitising of smb:// URIs, which might lead to the\nexecution of arbitrary shell commands.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.10.4-7.1.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 0.11.1-1.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.11.1-1.2.
\nWe recommend that you upgrade your elinks package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAdam Boileau discovered an integer overflow in the Skinny channel\ndriver in Asterisk, an Open Source Private Branch Exchange or\ntelephone system, as used by Cisco SCCP phones, which allows remote\nattackers to execute arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.7.dfsg.1-2sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.13~dfsg-1.
\nWe recommend that you upgrade your asterisk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRhys Kidd discovered a vulnerability in l2tpns, a layer 2 tunnelling\nprotocol network server, which could be triggered by a remote user to\nexecute arbitrary code.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 2.0.14-1sarge1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.1.21-1.
\nWe recommend that you upgrade your l2tpns package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the GNU privacy guard,\na free PGP replacement, which may lead to the execution of arbitrary code.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nWerner Koch discovered that a buffer overflow in a sanitising function\n may lead to execution of arbitrary code when running gnupg\n interactively.
Tavis Ormandy discovered that parsing a carefully crafted OpenPGP\n packet may lead to the execution of arbitrary code, as a function\n pointer of an internal structure may be controlled through the\n decryption routines.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.4.1-1.sarge6.
\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 1.4.6-1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.4.6-1.
\nWe recommend that you upgrade your gnupg packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStephen Gran discovered that malformed base64-encoded MIME attachments\ncan lead to denial of service through a null pointer dereference.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.84-2.sarge.12.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 0.86-1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.86-1.
\nWe recommend that you upgrade your clamav package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nStephane Eranian discovered a local DoS (Denial of Service) vulnerability\n on the ia64 architecture. A local user could exhaust the available file\n descriptors by exploiting a counting error in the permonctl() system call.
Kirill Korotaev reported a local DoS (Denial of Service) vulnerability\n on the ia64 and sparc architectures. A user could cause the system to\n crash by executing a malformed ELF binary due to insufficient verification\n of the memory layout.
Dmitriy Monakhov reported a potential memory leak in the\n __block_prepare_write function. __block_prepare_write does not properly\n sanitize kernel buffers during error recovery, which could be exploited\n by local users to gain access to sensitive kernel memory.
ADLab Venustech Info Ltd reported a potential remote DoS (Denial of\n Service) vulnerability in the IP over ATM subsystem. A remote system\n could cause the system to crash by sending specially crafted packets\n that would trigger an attempt to free an already-freed pointer\n resulting in a system crash.
Martin Schwidefsky reported a potential leak of sensitive information\n on s390 systems. The copy_from_user function did not clear the remaining\n bytes of the kernel buffer after receiving a fault on the userspace\n address, resulting in a leak of uninitialized kernel memory. A local user\n could exploit this by appending to a file from a bad address.
James Morris reported a potential local DoS (Denial of Service)\n vulnerability that could be used to hang or oops a system. The seqfile\n handling for /proc/net/ip6_flowlabel has a flaw that can be exploited to\n cause an infinite loop by reading this file after creating a flowlabel.
Fabio Massimo Di Nitto reported a potential remote DoS (Denial of Service)\n vulnerability on powerpc systems. The alignment exception only\n checked the exception table for -EFAULT, not for other errors. This can\n be exploited by a local user to cause a system crash (panic).
Eugene Teo reported a vulnerability in the get_fdb_entries function that\n could potentially be exploited to allow arbitrary code execution with\n escalated privileges.
Bill Allombert reported that various mount options are ignored by smbfs\n when UNIX extensions are enabled. This includes the uid, gid and mode\n options. Client systems would silently use the server-provided settings\n instead of honoring these options, changing the security model. This\n update includes a fix from Haroldo Gamal that forces the kernel to honor\n these mount options. Note that, since the current versions of smbmount\n always pass values for these options to the kernel, it is not currently\n possible to activate unix extensions by omitting mount options. However,\n this behavior is currently consistent with the current behavior of the\n next Debian release, 'etch'.
The following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.6.8-16sarge6 |
| Alpha architecture | 2.6.8-16sarge6 |
| AMD64 architecture | 2.6.8-16sarge6 |
| HP Precision architecture | 2.6.8-6sarge6 |
| Intel IA-32 architecture | 2.6.8-16sarge6 |
| Intel IA-64 architecture | 2.6.8-14sarge6 |
| Motorola 680x0 architecture | 2.6.8-4sarge6 |
| PowerPC architecture | 2.6.8-12sarge6 |
| IBM S/390 architecture | 2.6.8-5sarge6 |
| Sun Sparc architecture | 2.6.8-15sarge6 |
The following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| Debian 3.1 (sarge) | |
|---|---|
| fai-kernels | 1.9.1sarge5 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA denial of service vulnerability has been discovered in the CGI library\nincluded with Ruby, the interpreted scripting language for quick and easy\nobject-oriented programming.
\nFor the stable distribution (sarge), this problem has been fixed in version\n1.6.8-12sarge3.
\nWe recommend that you upgrade your ruby1.6 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA denial of service vulnerability has been discovered in the CGI library\nincluded with Ruby, the interpreted scripting language for quick and easy\nobject-oriented programming.
\nFor the stable distribution (sarge), this problem has been fixed in version\n1.8.2-7sarge5.
\nWe recommend that you upgrade your ruby1.8 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAntti-Juhani Kaijanaho discovered that enemies-of-carlotta, a simple\nmanager for mailing lists, does not properly sanitise email addresses\nbefore passing them through to the system shell.
\nFor the stable distribution (sarge), this problem has been fixed in version\n1.0.3-1sarge1.
\nWe recommend that you upgrade your enemies-of-carlotta package.
\nMD5 checksums of the listed files are available in the original advisory.\n
Several local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nOlof Johansson reported a local DoS (Denial of Service) vulnerability\n on the PPC970 platform. Unprivileged users can hang the system by\n executing the attn
instruction, which was not being disabled at boot.
Kirill Korotaev reported a local DoS (Denial of Service) vulnerability\n on the ia64 and sparc architectures. A user could cause the system to\n crash by executing a malformed ELF binary due to insufficient verification\n of the memory layout.
ADLab Venustech Info Ltd reported a potential remote DoS (Denial of\n Service) vulnerability in the IP over ATM subsystem. A remote system\n could cause the system to crash by sending specially crafted packets\n that would trigger an attempt to free an already-freed pointer\n resulting in a system crash.
Martin Schwidefsky reported a potential leak of sensitive information\n on s390 systems. The copy_from_user function did not clear the remaining\n bytes of the kernel buffer after receiving a fault on the userspace\n address, resulting in a leak of uninitialized kernel memory. A local user\n could exploit this by appending to a file from a bad address.
Fabio Massimo Di Nitto reported a potential remote DoS (Denial of Service)\n vulnerability on powerpc systems. The alignment exception only\n checked the exception table for -EFAULT, not for other errors. This can\n be exploited by a local user to cause a system crash (panic).
Bill Allombert reported that various mount options are ignored by smbfs\n when UNIX extensions are enabled. This includes the uid, gid and mode\n options. Client systems would silently use the server-provided settings\n instead of honoring these options, changing the security model. This\n update includes a fix from Haroldo Gamal that forces the kernel to honor\n these mount options. Note that, since the current versions of smbmount\n always pass values for these options to the kernel, it is not currently\n possible to activate unix extensions by omitting mount options. However,\n this behavior is currently consistent with the current behavior of the\n next Debian release, 'etch'.
The following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.4.27-10sarge5 |
| Alpha architecture | 2.4.27-10sarge5 |
| ARM architecture | 2.4.27-2sarge5 |
| Intel IA-32 architecture | 2.4.27-10sarge5 |
| Intel IA-64 architecture | 2.4.27-10sarge5 |
| Motorola 680x0 architecture | 2.4.27-3sarge5 |
| Big endian MIPS | 2.4.27-10.sarge4.040815-2 |
| Little endian MIPS | 2.4.27-10.sarge4.040815-2 |
| PowerPC architecture | 2.4.27-10sarge5 |
| IBM S/390 architecture | 2.4.27-2sarge5 |
| Sun Sparc architecture | 2.4.27-9sarge5 |
The following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| Debian 3.1 (sarge) | |
|---|---|
| fai-kernels | 1.9.1sarge5 |
| kernel-image-2.4.27-speakup | 2.4.27-1.1sarge4 |
| mindi-kernel | 2.4.27-2sarge4 |
| systemimager | 3.2.3-6sarge4 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Clam anti-virus\ntoolkit. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nHendrik Weimer discovered that invalid characters in base64 encoded\n data may lead to bypass of scanning mechanisms.
Hendrik Weimer discovered that deeply nested multipart/mime MIME\n data may lead to denial of service.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.13.
\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 0.88.7-1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.88.7-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in SQL Ledger, a web\nbased double-entry accounting program, which may lead to the execution\nof arbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nChris Travers discovered that the session management can be tricked\n into hijacking existing sessions.
Chris Travers discovered that directory traversal vulnerabilities\n can be exploited to execute arbitrary Perl code.
It was discovered that missing input sanitising allows execution of\n arbitrary Perl code.
For the stable distribution (sarge) these problems have been fixed in\nversion 2.4.7-2sarge1.
\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 2.6.21-1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.6.21-1.
\nWe recommend that you upgrade your sql-ledger packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTeemu Salmela discovered that the links2 character mode web browser\nperforms insufficient sanitising of smb:// URIs, which might lead to the\nexecution of arbitrary shell commands.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.1pre16-1sarge1.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 2.1pre26-1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.1pre26-1.
\nWe recommend that you upgrade your links2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMartijn Brinkers discovered cross-site scripting vulnerabilities in\nthe mailto parameter of webmail.php, the session and delete_draft\nparameters of compose.php and through a shortcoming in the magicHTML\nfilter. An attacker could abuse these to execute malicious JavaScript in\nthe user's webmail session.
\nAlso, a workaround was made for Internet Explorer <= 5: IE will attempt\nto guess the MIME type of attachments based on content, not the MIME\nheader sent. Attachments could fake to be a 'harmless' JPEG, while they\nwere in fact HTML that Internet Explorer would render.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2:1.4.4-10.
\nFor the upcoming stable distribution (etch) these problems have been fixed\nin version 2:1.4.9a-1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2:1.4.9a-1.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in elog, a web-based\nelectronic logbook, which may lead to the execution of arbitrary code.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nTilman Koschnick discovered that log entry editing in HTML is vulnerable\n to cross-site scripting. This update disables the vulnerable code.
Ulf H\u00e4rnhammar of the Debian Security Audit Project discovered several\n format string vulnerabilities in elog, which may lead to execution of\n arbitrary code.
Ulf H\u00e4rnhammar of the Debian Security Audit Project discovered\n cross-site scripting vulnerabilities in the creation of new logbook\n entries.
Jayesh KS and Arun Kethipelly of OS2A discovered that elog performs\n insufficient error handling in config file parsing, which may lead to\n denial of service through a NULL pointer dereference.
For the stable distribution (sarge) these problems have been fixed in\nversion 2.5.7+r1558-4+sarge3.
\nThe upcoming stable distribution (etch) will no longer include elog.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.6.2+r1754-1.
\nWe recommend that you upgrade your elog package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRenaud Lifchitz discovered that gv, the PostScript and PDF viewer for X,\nperforms insufficient boundary checks in the Postscript parsing code,\nwhich allows the execution of arbitrary code through a buffer overflow.\nEvince embeds a copy of gv and needs an update as well.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.1.5-2sarge1.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 0.4.0-3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.4.0-3.
\nWe recommend that you upgrade your evince package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Xine multimedia library performs insufficient\nsanitising of Real streams, which might lead to the execution of arbitrary\ncode through a buffer overflow.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.0.1-1sarge5.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 1.1.2+dfsg-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.1.2+dfsg-2.
\nWe recommend that you upgrade your xine-lib packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMartin Loewer discovered that the proftpd FTP daemon is vulnerable to\ndenial of service if the addon module for Radius authentication is enabled.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.2.10-15sarge4.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 1.2.10+1.3.0rc5-1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.10+1.3.0rc5-1.
\nWe recommend that you upgrade your proftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJohn Heasman from Next Generation Security Software discovered a heap\noverflow in the handling of Windows Metafiles in OpenOffice.org, the\nfree office suite, which could lead to a denial of service and\npotentially execution of arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.1.3-9sarge4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.4-1.
\nWe recommend that you upgrade your openoffice.org package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn off-by-one error leading to a heap-based buffer overflow has been\nidentified in libapache-mod-auth-kerb, an Apache module for Kerberos\nauthentication. The error could allow an attacker to trigger an\napplication crash or potentially execute arbitrary code by sending a\nspecially crafted kerberos message.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 4.996-5.0-rc6-1sarge1.
\nFor the unstable distribution (sid) and the forthcoming stable distribution\n(etch), this problem has been fixed in version 5.3-1.
\nWe recommend that you upgrade your libapache-mod-auth-kerb package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRoland Lezuo and Josselin Mouette discovered that the libsoup HTTP\nlibrary performs insufficient sanitising when parsing HTTP headers,\nwhich might lead to denial of service.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.2.3-2sarge1.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 2.2.98-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.98-2.
\nWe recommend that you upgrade your libsoup package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the X Window System,\nwhich may lead to privilege escalation or denial of service.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nSean Larsson discovered an integer overflow in the Render extension,\n which might lead to denial of service or local privilege escalation.
Sean Larsson discovered an integer overflow in the DBE extension,\n which might lead to denial of service or local privilege escalation.
Sean Larsson discovered an integer overflow in the DBE extension,\n which might lead to denial of service or local privilege escalation.
For the stable distribution (sarge) these problems have been fixed in\nversion 4.3.0.dfsg.1-14sarge3. This update lacks builds for the\nMotorola 680x0 architecture, which had build problems. Packages will be\nreleased once this problem has been resolved.
\nFor the upcoming stable distribution (etch) these problems have been fixed\nin version 2:1.1.1-15 of xorg-server.
\nFor the unstable distribution (sid) these problems have been fixed\nin version 2:1.1.1-15 of xorg-server.
\nWe recommend that you upgrade your XFree86 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that cacti, a frontend to rrdtool, performs insufficient\nvalidation of data passed to the cmd
script, which allows SQL\ninjection and the execution of arbitrary shell commands.
For the stable distribution (sarge) this problem has been fixed in\nversion 0.8.6c-7sarge4.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 0.8.6i-3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.8.6i-3.
\nWe recommend that you upgrade your cacti package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that netrik, a text mode WWW browser with vi like\nkeybindings, doesn't properly sanitize temporary filenames when editing\ntextareas which could allow attackers to execute arbitrary commands via\nshell metacharacters.
\nFor the stable distribution (sarge), this problem has been fixed in version\n1.15.4-1sarge1.
\nFor the upcoming stable distribution (etch) this problem has been fixed in\nversion 1.15.3-1.1.
\nFor the unstable distribution (sid) this problem has been fixed in version\n1.15.3-1.1.
\nWe recommend that you upgrade your netrik package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKevin Finisterre discovered several format string problems in vlc, a\nmultimedia player and streamer, that could lead to the execution of\narbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.8.1.svn20050314-1sarge2.
\nFor the testing distribution (etch) this problem has been fixed in\nversion 0.8.6-svn20061012.debian-3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.8.6.a.debian-1.
\nWe recommend that you upgrade your vlc packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products such as Mozilla Firefox. The Common Vulnerabilities\nand Exposures project identifies the following vulnerabilities:
\nSeveral vulnerabilities in the layout engine allow remote\n attackers to cause a denial of service and possibly permit them to\n execute arbitrary code. [MFSA 2006-68]
Several vulnerabilities in the JavaScript engine allow remote\n attackers to cause a denial of service and possibly permit them to\n execute arbitrary code. [MFSA 2006-68]
A bug in the js_dtoa function allows remote attackers to cause a\n denial of service. [MFSA 2006-68]
\"shutdown\" discovered a vulnerability that allows remote attackers\n to gain privileges and install malicious code via the watch\n JavaScript function. [MFSA 2006-70]
Steven Michaud discovered a programming bug that allows remote\n attackers to cause a denial of service. [MFSA 2006-71]
\"moz_bug_r_a4\" reported that the src attribute of an IMG element\n could be used to inject JavaScript code. [MFSA 2006-72]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge15.
\nFor the testing (etch) and unstable (sid) distribution these problems\nhave been fixed in version 2.0.0.1+dfsg-2 of iceweasel.
\nWe recommend that you upgrade your firefox and iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Bind name server daemon is vulnerable to denial\nof service by triggering an assertion through a crafted DNS query. This\nonly affects installations which use the DNSSEC extentions.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 9.2.4-1sarge2.
\nFor the upcoming stable distribution (etch) this problem will be fixed\nsoon.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 9.3.4-1.
\nWe recommend that you upgrade your bind9 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLiu Qishuai discovered that the GNOME gtop library performs insufficient\nsanitising when parsing the system's /proc table, which may lead to\nthe execution of arbitrary code.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.6.0-4sarge1.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 2.14.4-3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.14.4-3.
\nWe recommend that you upgrade your libgtop2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the image loading code in the GTK+ graphical user\ninterface library performs insufficient error handling when loading\nmalformed images, which may lead to denial of service.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 2.6.4-3.2. This update lacks builds for the Motorola 680x0\narchitecture, which had build problems. Packages will be released once\nthis problem has been resolved.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 2.8.20-5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.8.20-5.
\nWe recommend that you upgrade your GTK packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in samba, a free\nimplementation of the SMB/CIFS protocol, which may lead to the execution\nof arbitrary code or denial of service. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nIt was discovered that incorrect handling of deferred file open calls\n may lead to an infinite loop, which results in denial of service.
\"zybadawg333\" discovered that the AFS ACL mapping VFS plugin performs\n insecure format string handling, which may lead to the execution of\n arbitrary code.
For the stable distribution (sarge) these problems have been fixed in\nversion 3.0.14a-3sarge4.
\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 3.0.23d-5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.0.23d-5.
\nWe recommend that you upgrade your samba package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products such as Mozilla Firefox. The Common Vulnerabilities\nand Exposures project identifies the following vulnerabilities:
\nSeveral vulnerabilities in the layout engine allow remote\n attackers to cause a denial of service and possibly permit them to\n execute arbitrary code. [MFSA 2006-68]
Several vulnerabilities in the JavaScript engine allow remote\n attackers to cause a denial of service and possibly permit them to\n execute arbitrary code. [MFSA 2006-68]
A bug in the js_dtoa function allows remote attackers to cause a\n denial of service. [MFSA 2006-68]
\"shutdown\" discovered a vulnerability that allows remote attackers\n to gain privileges and install malicious code via the watch\n JavaScript function. [MFSA 2006-70]
Steven Michaud discovered a programming bug that allows remote\n attackers to cause a denial of service. [MFSA 2006-71]
\"moz_bug_r_a4\" reported that the src attribute of an IMG element\n could be used to inject JavaScript code. [MFSA 2006-72]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.2-2.sarge1.0.8e.2.
\nFor the testing (etch) and unstable (sid) distribution these problems\nhave been fixed in version 1.5.0.9.dfsg1-1 of icedove.
\nWe recommend that you upgrade your Mozilla Thunderbird and Icedove packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIsaac Wilcox discovered that fetchmail, a popular mail retrieval and\nforwarding utility, insufficiently enforces encryption of connections,\nwhich might lead to information disclosure.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6.2.5-12sarge5.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 6.3.6-1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 6.3.6-1.
\nWe recommend that you upgrade your fetchmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nVladimir Nadvornik discovered that the fix for a vulnerability in the\nPALM decoder of Imagemagick, a collection of image manipulation programs,\nwas ineffective. To avoid confusion a new CVE ID has been assigned;\nthe original issue was tracked as CVE-2006-5456.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 6:6.0.6.2-2.9.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 7:6.2.4.5.dfsg1-0.14.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 7:6.2.4.5.dfsg1-0.14.
\nWe recommend that you upgrade your imagemagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the PostgreSQL database performs insufficient type\nchecking for SQL function arguments, which might lead to denial of service\nor information disclosure.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 7.4.7-6sarge4.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 8.1.7-1 of the postgresql-8.1 package.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 8.1.7-1 of the postgresql-8.1 package.
\nWe recommend that you upgrade your PostgreSQL packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMu Security
discovered that a format string vulnerability in\nthe VoIP solution GnomeMeeting allows the execution of arbitrary code.
For the stable distribution (sarge) this problem has been fixed in\nversion 1.2.1-1sarge1.
\nFor the upcoming stable distribution (etch) this problem has been\nfixed in version 2.0.3-2.1 of the ekiga package.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.3-2.1 of the ekiga package.
\nWe recommend that you upgrade your gnomemeeting package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Clam\nanti-virus toolkit, which may lead to denial of service. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nIt was discovered that malformed CAB archives may exhaust file\n descriptors, which allows denial of service.
It was discovered that a directory traversal vulnerability in the MIME\n header parser may lead to denial of service.
For the stable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.15.
\nFor the upcoming stable distribution (etch) these problems have been fixed\nin version 0.88.7-2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.90-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in PHP, a server-side,\nHTML-embedded scripting language, which may lead to the execution of\narbitrary code. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nIt was discovered that an integer overflow in the str_replace()\n function could lead to the execution of arbitrary code.
It was discovered that a buffer underflow in the sapi_header_op()\n function could crash the PHP interpreter.
Stefan Esser discovered that a programming error in the wddx\n extension allows information disclosure.
It was discovered that a format string vulnerability in the\n odbc_result_all() functions allows the execution of arbitrary code.
It was discovered that super-global variables could be overwritten\n with session data.
Stefan Esser discovered that the zend_hash_init() function could\n be tricked into an endless loop, allowing denial of service through\n resource consumption until a timeout is triggered.
For the stable distribution (sarge) these problems have been fixed in\nversion 4:4.3.10-19.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 6:4.4.4-9 of php4 and version 5.2.0-9 of php5.
\nWe recommend that you upgrade your php4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in Mozilla and\nderived products. The Common Vulnerabilities and Exposures project\nidentifies the following vulnerabilities:
\nSeveral vulnerabilities in the layout engine allow remote\n attackers to cause a denial of service and possibly permit them to\n execute arbitrary code. [MFSA 2006-68]
Several vulnerabilities in the JavaScript engine allow remote\n attackers to cause a denial of service and possibly permit them to\n execute arbitrary code. [MFSA 2006-68]
A bug in the js_dtoa function allows remote attackers to cause a\n denial of service. [MFSA 2006-68]
shutdown
discovered a vulnerability that allows remote attackers\n to gain privileges and install malicious code via the watch\n JavaScript function. [MFSA 2006-70]
Steven Michaud discovered a programming bug that allows remote\n attackers to cause a denial of service. [MFSA 2006-71]
moz_bug_r_a4
reported that the src attribute of an IMG element\n could be used to inject JavaScript code. [MFSA 2006-72]
Georgi Guninski discovered several heap-based buffer overflows\n that allow remote attackers to execute arbitrary code. [MFSA 2006-74]
For the stable distribution (sarge) these problems have been fixed in\nversion 1.7.8-1sarge10.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.0.7-1 of iceape.
\nWe recommend that you upgrade your Mozilla and Iceape packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGerardo Richarte discovered that GnuPG, a free PGP replacement, provides\ninsufficient user feedback if an OpenPGP message contains both unsigned\nand signed portions. Inserting text segments into an otherwise signed\nmessage could be exploited to forge the content of signed messages.\nThis update prevents such attacks; the old behaviour can still be\nactivated by passing the --allow-multiple-messages option.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.4.1-1.sarge7.
\nFor the upcoming stable distribution (etch) these problems have been\nfixed in version 1.4.6-2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.4.6-2.
\nWe recommend that you upgrade your gnupg packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that WebCalendar, a PHP-based calendar application,\ninsufficiently protects an internal variable, which allows remote file\ninclusion.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 0.9.45-4sarge6.
\nThe upcoming stable distribution (etch) no longer contains webcalendar\npackages.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your webcalendar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\niDefense reported several integer overflow bugs in libwpd, a library\nfor handling WordPerfect documents. Attackers were able to exploit\nthese with carefully crafted Word Perfect files that could cause an\napplication linked with libwpd to crash or possibly execute arbitrary code.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 0.8.1-1sarge1.
\nFor the testing distribution (etch) these problems have been fixed in\nversion 0.8.7-6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.8.7-6.
\nWe recommend that you upgrade your libwpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTatsuya Kinoshita discovered that Lookup, a search interface to\nelectronic dictionaries on emacsen, creates a temporary file in an\ninsecure fashion when the ndeb-binary feature is used, which allows a\nlocal attacker to craft a symlink attack to overwrite arbitrary files.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 1.4-3sarge1.
\nFor the testing distribution (etch) this problem has been fixed in\nversion 1.4-5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.4-5.
\nWe recommend that you upgrade your lookup-el package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in\nOpenOffice.org, the free office suite. The Common Vulnerabilities and\nExposures project identifies the following problems:
\niDefense reported several integer overflow bugs in libwpd, a\n library for handling WordPerfect documents that is included in\n OpenOffice.org. Attackers are able to exploit these with\n carefully crafted WordPerfect files that could cause an\n application linked with libwpd to crash or possibly execute\n arbitrary code.
Next Generation Security discovered that the StarCalc parser in\n OpenOffice.org contains an easily exploitable stack overflow that\n could be used by a specially crafted document to execute\n arbitrary code.
It has been reported that OpenOffice.org does not escape shell\n meta characters and is hence vulnerable to execute arbitrary shell\n commands via a specially crafted document after the user clicked\n to a prepared link.
This updated advisory only provides packages for the upcoming etch\nrelease alias Debian GNU/Linux 4.0.
\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.1.3-9sarge6.
\nFor the testing distribution (etch) these problems have been fixed in\nversion 2.0.4.dfsg.2-5etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.4.dfsg.2-6.
\nWe recommend that you upgrade your OpenOffice.org packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA design error has been identified in the OpenAFS, a cross-platform\ndistributed filesystem included with Debian.
\nOpenAFS historically has enabled setuid filesystem support for the local\ncell. However, with its existing protocol, OpenAFS can only use\nencryption, and therefore integrity protection, if the user is\nauthenticated. Unauthenticated access doesn't do integrity protection.\nThe practical result is that it's possible for an attacker with\nknowledge of AFS to forge an AFS FetchStatus call and make an arbitrary\nbinary file appear to an AFS client host to be setuid. If they can then\narrange for that binary to be executed, they will be able to achieve\nprivilege escalation.
\nOpenAFS 1.3.81-3sarge2 changes the default behavior to disable setuid\nfiles globally, including the local cell. It is important to note that\nthis change will not take effect until the AFS kernel module, built from\nthe openafs-modules-source package, is rebuilt and loaded into your\nkernel. As a temporary workaround until the kernel module can be\nreloaded, setuid support can be manually disabled for the local cell by\nrunning the following command as root
\nfs setcell -cell <localcell> -nosuid
\nFollowing the application of this update, if you are certain there is\nno security risk of an attacker forging AFS fileserver responses, you\ncan re-enable setuid status selectively with the following command,\nhowever this should not be done on sites that are visible to the\nInternet
\nfs setcell -cell <localcell> -suid
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 1.3.81-3sarge2.
\nFor the unstable distribution (sid) and the upcoming stable\ndistribution (etch), this problem will be fixed in version 1.4.2-6.
\nWe recommend that you upgrade your openafs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMoritz Jodeit discovered an off-by-one buffer overflow in tcpdump, a\npowerful tool for network monitoring and data acquisition, which allows\ndenial of service.
\nFor the stable distribution (sarge) this problem has been fixed in\nversion 3.8.3-5sarge2.
\nFor the upcoming stable distribution (etch) this problem has been fixed\nin version 3.9.5-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.9.5-2.
\nWe recommend that you upgrade your tcpdump package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in nas, the Network Audio\nSystem.
\nA stack-based buffer overflow in the accept_att_local function in\nserver/os/connection.c in nas allows remote attackers to execute\narbitrary code via a long path slave name in a USL socket connection.
An integer overflow in the ProcAuWriteElement function in\nserver/dia/audispatch.c allows remote attackers to cause a denial of\nservice (crash) and possibly execute arbitrary code via a large\nmax_samples value.
The AddResource function in server/dia/resource.c allows remote\nattackers to cause a denial of service (server crash) via a\nnonexistent client ID.
An array index error allows remote attackers to cause a denial of service\n(crash) via (1) large num_action values in the ProcAuSetElements\nfunction in server/dia/audispatch.c or (2) a large inputNum parameter\nto the compileInputs function in server/dia/auutil.c.
The ReadRequestFromClient function in server/os/io.c allows remote\nattackers to cause a denial of service (crash) via multiple\nsimultaneous connections, which triggers a NULL pointer dereference.
For the stable distribution (sarge), these problems have been fixed in\nversion 1.7-2sarge1.
\nFor the upcoming stable distribution (etch) and the unstable\ndistribution (sid) these problems have been fixed in version 1.8-4.
\nWe recommend that you upgrade your nas package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn integer underflow bug has been found in the file_printf function in\nfile, a tool to determine file types based analysis of file content.\nThe bug could allow an attacker to execute arbitrary code by inducing a\nlocal user to examine a specially crafted file that triggers a buffer\noverflow.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 4.12-1sarge1.
\nFor the upcoming stable distribution (etch), this problem has been fixed in\nversion 4.17-5etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\n4.20-1.
\nWe recommend that you upgrade your file package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA cross-site scripting vulnerability in zope, a web application\nserver, could allow an attacker to inject arbitrary HTML and/or\nJavaScript into the victim's web browser. This code would run within\nthe security context of the web browser, potentially allowing the\nattacker to access private data such as authentication cookies, or to\naffect the rendering or behavior of zope web pages.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 2.7.5-2sarge4.
\nThe upcoming stable distribution (etch) and the unstable distribution\n(sid) include zope2.9, and this vulnerability is fixed in version\n2.9.6-4etch1 for etch and 2.9.7-1 for sid.
\nWe recommend that you upgrade your zope2.7 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the MIT reference\nimplementation of the Kerberos network authentication protocol suite,\nwhich may lead to the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nIt was discovered that the krb5 telnet daemon performs insufficient\n validation of usernames, which might allow unauthorized logins or\n privilege escalation.
iDefense discovered that a buffer overflow in the logging code of the\n KDC and the administration daemon might lead to arbitrary code\n execution.
It was discovered that a double free in the RPCSEC_GSS part of the\n GSS library code might lead to arbitrary code execution.
For the stable distribution (sarge) these problems have been fixed in\nversion 1.3.6-2sarge4.
\nFor the upcoming stable distribution (etch) these problems have been fixed\nin version 1.4.4-7etch1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your Kerberos packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple errors have been found in the skin handling routines in xmms,\nthe X Multimedia System. These vulnerabilities could allow an\nattacker to run arbitrary code as the user running xmms by inducing\nthe victim to load specially crafted interface skin files.
\nFor the stable distribution (sarge), these problems have been fixed in\nversion 1.2.10+cvs20050209-2sarge1.
\nFor the upcoming stable distribution (etch) and the unstable\ndistribution (sid), these problems have been fixed in versions\n1:1.2.10+20061101-1etch1 and 1:1.2.10+20070401-1, respectively.
\nWe recommend that you upgrade your xmms packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the man command that could\nallow an attacker to execute code as the man user by providing\nspecially crafted arguments to the -H flag. This is likely to be an\nissue only on machines with the man and mandb programs installed\nsetuid.
\nFor the stable distribution (sarge), this problem has been fixed in\nversion 2.4.2-21sarge1.
\nFor the upcoming stable distribution (etch) and the unstable\ndistribution (sid), this problem has been fixed in version 2.4.3-5.
\nWe recommend that you upgrade your man-db package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that WebCalendar, a PHP-based calendar application,\nperforms insufficient sanitising in the exports handler, which allows\ninjection of web script.
\nFor the old stable distribution (sarge) this problem has been fixed in\nversion 0.9.45-4sarge7.
\nThe stable distribution (etch) no longer contains WebCalendar packages.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.5-2.
\nWe recommend that you upgrade your webcalendar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that aircrack-ng, a WEP/WPA security analysis tool,\nperforms insufficient validation of 802.11 authentication packets, which\nallows the execution of arbitrary code.
\nThe oldstable distribution (sarge) doesn't contain aircrack-ng packages.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.6.2-7etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.7-3.
\nWe recommend that you upgrade your aircrack-ng packages. Packages for\nthe arm, sparc, mips and mipsel architectures are not yet available. They\nwill be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Clam\nanti-virus toolkit. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that a file descriptor leak in the CHM handler may\n lead to denial of service.
It was discovered that a buffer overflow in the CAB handler may lead\n to the execution of arbitrary code.
It was discovered that a file descriptor leak in the PDF handler may\n lead to denial of service.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.16.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 0.90.1-3etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.90.2-1.
\nWe recommend that you upgrade your clamav packages. Packages for\nthe arm, sparc, m68k, mips and mipsel architectures are not yet available.\nThey will be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in PHP, a\nserver-side, HTML-embedded scripting language, which may lead to the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nStefan Esser discovered an overflow in the object reference handling\n code of the unserialize() function, which allows the execution of\n arbitrary code if malformed input is passed from an application.
Stefan Esser discovered that the session handler performs\n insufficient validation of variable name length values, which allows\n information disclosure through a heap information leak.
Stefan Esser discovered a double free vulnerability in the\n session_regenerate_id() function, which allows the execution of\n arbitrary code.
Stefan Esser discovered a double free vulnerability in the session\n management code, which allows the execution of arbitrary code.
Stefan Esser discovered that the mail() function performs\n insufficient validation of folded mail headers, which allows mail\n header injection.
Stefan Esser discovered that the extension to handle ZIP archives\n performs insufficient length checks, which allows the execution of\n arbitrary code.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 4.3.10-20.
\nFor the stable distribution (etch) these problems have been fixed\nin version 4.4.4-8+etch2.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.4.6-1. php4 will be removed from sid; thus you are strongly\nadvised to migrate to php5 if you prefer to follow the unstable\ndistribution.
\nWe recommend that you upgrade your PHP packages. Packages for the arm,\nm68k, mips and mipsel architectures are not yet available. They will be\nprovided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in PHP, a\nserver-side, HTML-embedded scripting language, which may lead to the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nStefan Esser discovered an overflow in the object reference handling\n code of the unserialize() function, which allows the execution of\n arbitrary code if malformed input is passed from an application.
Stefan Esser discovered that an integer overflow in the substr_compare()\n function allows information disclosure of heap memory.
Stefan Esser discovered that insufficient validation of shared memory\n functions allows the disclosure of heap memory.
Stefan Esser discovered that the session handler performs\n insufficient validation of variable name length values, which allows\n information disclosure through a heap information leak.
Stefan Esser discovered that the filtering framework performs insufficient\n input validation, which allows the execution of arbitrary code through a\n buffer underflow.
Stefan Esser discovered that the filtering framework can be bypassed\n with a special whitespace character.
Stefan Esser discovered a double free vulnerability in the\n session_regenerate_id() function, which allows the execution of\n arbitrary code.
Stefan Esser discovered that a programming error in the mb_parse_str()\n function allows the activation of register_globals
.
Stefan Esser discovered that the session extension incorrectly maintains\n the reference count of session variables, which allows the execution of\n arbitrary code.
Stefan Esser discovered a double free vulnerability in the session\n management code, which allows the execution of arbitrary code.
Stefan Esser discovered that the mail() function performs\n insufficient validation of folded mail headers, which allows mail\n header injection.
Stefan Esser discovered that the extension to handle ZIP archives\n performs insufficient length checks, which allows the execution of\n arbitrary code.
Stefan Esser discovered an off-by-one error in the filtering framework, which\n allows the execution of arbitrary code.
Stefan Esser discovered that a buffer overflow in the sqlite extension\n allows the execution of arbitrary code.
Stefan Esser discovered that the PHP memory manager performs an\n incorrect type cast, which allows the execution of arbitrary code\n through buffer overflows.
Stefan Esser discovered that incorrect validation in the email filter\n extension allows the injection of mail headers.
The oldstable distribution (sarge) doesn't include php5.
\nFor the stable distribution (etch) these problems have been fixed\nin version 5.2.0-8+etch3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 5.2.0-11.
\nWe recommend that you upgrade your PHP packages. Packages for the arm,\nhppa, mips and mipsel architectures are not yet available. They will be\nprovided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the QEMU processor\nemulator, which may lead to the execution of arbitrary code or denial of\nservice. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nTavis Ormandy discovered that a memory management routine of the Cirrus\n video driver performs insufficient bounds checking, which might\n allow the execution of arbitrary code through a heap overflow.
Tavis Ormandy discovered that the NE2000 network driver and the socket\n code perform insufficient input validation, which might allow the\n execution of arbitrary code through a heap overflow.
Tavis Ormandy discovered that the icebp
instruction can be abused to\n terminate the emulation, resulting in denial of service.
Tavis Ormandy discovered that the NE2000 network driver and the socket\n code perform insufficient input validation, which might allow the\n execution of arbitrary code through a heap overflow.
Tavis Ormandy discovered that the aam
instruction can be abused to\n crash qemu through a division by zero, resulting in denial of\n service.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 0.6.1+20050407-1sarge1.
\nFor the stable distribution (etch) these problems have been fixed\nin version 0.8.2-4etch1.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your qemu packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nCross-site scripting (XSS) vulnerability in wp-admin/vars.php in\n WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series,\n allows remote authenticated users with theme privileges to inject\n arbitrary web script or HTML via the PATH_INFO in the administration\n interface, related to loose regular expression processing of PHP_SELF.
WordPress 2.1.2, and probably earlier, allows remote authenticated\n users with the contributor role to bypass intended access restrictions\n and invoke the publish_posts functionality, which can be used to\n publish a previously saved post.
Cross-site scripting (XSS) vulnerability in\n wp-includes/general-template.php in WordPress before 20070309 allows\n remote attackers to inject arbitrary web script or HTML via the year\n parameter in the wp_title function.
SQL injection vulnerability in xmlrpc.php in WordPress 2.1.2, and\n probably earlier, allows remote authenticated users to execute\n arbitrary SQL commands via a string parameter value in an XML RPC\n mt.setPostCategories method call, related to the post_id variable.
For the stable distribution (etch) these issues have been fixed in\nversion 2.0.10-1.
\nFor the testing and unstable distributions (lenny and sid,\nrespectively), these issues have been fixed in version 2.1.3-1.
\nWe recommend that you upgrade your wordpress package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nDaniel Roethlisberger discovered two buffer overflows in the cm4040\n driver for the Omnikey CardMan 4040 device. A local user or malicious\n device could exploit this to execute arbitrary code in kernel space.
Santosh Eraniose reported a vulnerability that allows local users to read\n otherwise unreadable files by triggering a core dump while using PT_INTERP.\n This is related to CVE-2004-1073.
Jean Delvare reported a vulnerability in the appletalk subsystem.\n Systems with the appletalk module loaded can be triggered to crash\n by other systems on the local network via a malformed frame.
Masayuki Nakagawa discovered that flow labels were inadvertently\n being shared between listening sockets and child sockets. This defect\n can be exploited by local users to cause a DoS (Oops).
This problem has been fixed in the stable distribution in version\n2.6.18.dfsg.1-12etch1.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| Debian 4.0 (etch) | |
|---|---|
| fai-kernels | 1.17etch1 |
| user-mode-linux | 2.6.18-1um-2etch1 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nUpdated packages for the mips and mipsel architectures are not yet available.\nThey will be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been identified in the version of\nldap-account-manager shipped with Debian 3.1 (sarge).
\nAn untrusted PATH vulnerability could allow a local attacker to execute\n arbitrary code with elevated privileges by providing a malicious rm\n executable and specifying a PATH environment variable referencing this\n executable.
Improper escaping of HTML content could allow an attacker to execute a\n cross-site scripting attack (XSS) and execute arbitrary code in the\n victim's browser in the security context of the affected web site.
For the old stable distribution (sarge), this problem has been fixed in\nversion 0.4.9-2sarge1. Newer versions of Debian (etch, lenny, and sid),\nare not affected.
\nWe recommend that you upgrade your ldap-account-manager package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the PoPToP Point to Point Tunneling Server\ncontains a programming error, which allows the tear-down of a PPTP\nconnection through a malformed GRE packet, resulting in denial of\nservice.
\nThe oldstable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.3.0-2etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.4-1.
\nWe recommend that you upgrade your pptpd packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nMichal Miroslaw reported a DoS vulnerability (crash) in netfilter.\n A remote attacker can cause a NULL pointer dereference in the\n nfnetlink_log function.
Patrick McHardy reported an vulnerability in netfilter that may\n allow attackers to bypass certain firewall rules. The nfctinfo\n value of reassembled IPv6 packet fragments were incorrectly initialized\n to 0 which allowed these packets to become tracked as ESTABLISHED.
Jaco Kroon reported a bug in which NETLINK_FIB_LOOKUP packages were\n incorrectly routed back to the kernel resulting in an infinite\n recursion condition. Local users can exploit this behavior\n to cause a DoS (crash).
For the stable distribution (etch) these problems have been fixed in version\n2.6.18.dfsg.1-12etch2.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| Debian 4.0 (etch) | |
|---|---|
| fai-kernels | 1.17+etch2 |
| user-mode-linux | 2.6.18-1um-2etch2 |
| kernel-patch-openvz | 028.18.1etch1 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the webmail package Squirrelmail performs\ninsufficient sanitising inside the HTML filter, which allows the\ninjection of arbitrary web script code during the display of HTML\nemail messages.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 2:1.4.4-11.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2:1.4.9a-2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2:1.4.10a-1.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral issues have been identified in Samba, the SMB/CIFS\nfile- and print-server implementation for GNU/Linux.
\nWhen translating SIDs to/from names using Samba local list of user and\n group accounts, a logic error in the smbd daemon's internal security\n stack may result in a transition to the root user id rather than the\n non-root user. The user is then able to temporarily issue SMB/CIFS\n protocol operations as the root user. This window of opportunity may\n allow the attacker to establish addition means of gaining root access to\n the server.
Various bugs in Samba's NDR parsing can allow a user to send specially\n crafted MS-RPC requests that will overwrite the heap space with user\n defined data.
Unescaped user input parameters are passed as arguments to /bin/sh\n allowing for remote command execution.
For the stable distribution (etch), these problems have been fixed in\nversion 3.0.24-6etch1.
\nFor the testing and unstable distributions (lenny and sid,\nrespectively), these problems have been fixed in version 3.0.25-1.
\nWe recommend that you upgrade your samba package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndreas Nolden discovered a bug in the UTF8 decoding routines in\nqt4-x11, a C++ GUI library framework, that could allow remote\nattackers to conduct cross-site scripting (XSS) and directory\ntraversal attacks via long sequences that decode to dangerous\nmetacharacters.
\nFor the stable distribution (etch), this problem has been fixed in version\n4.2.1-2etch1.
\nFor the testing and unstable distribution (lenny and sid, respectively),\nthis problem has been fixed in version 4.2.2-2.
\nWe recommend that you upgrade your qt4-x11 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Jakma discovered that specially crafted UPDATE messages can\ntrigger an out of boundary read that can result in a system crash of\nquagga, the BGP/OSPF/RIP routing daemon.
\nFor the old stable distribution (sarge) this problem has been fixed in\nversion 0.98.3-7.4.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.99.5-5etch2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.99.6-5.
\nWe recommend that you upgrade your quagga package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the X Window System,\nwhich may lead to privilege escalation. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nSean Larsson discovered an integer overflow in the XC-MISC extension,\n which might lead to denial of service or local privilege escalation.
Greg MacManus discovered an integer overflow in the font handling,\n which might lead to denial of service or local privilege escalation.
Greg MacManus discovered an integer overflow in the font handling,\n which might lead to denial of service or local privilege escalation.
Sami Leides discovered an integer overflow in the libx11 library\n which might lead to the execution of arbitrary code.\n This update introduces tighter sanity checking of input passed to\n XCreateImage(). To cope with this an updated rdesktop package is\n delivered along with this security update. Another application\n reported to break is the proprietary Opera browser, which isn't\n part of Debian. The vendor has released updated packages, though.
For the old stable distribution (sarge) these problems have been fixed in\nversion 4.3.0.dfsg.1-14sarge4. This update lacks builds for the Sparc\narchitecture, due to problems on the build host. Packages will be released\nonce this problem has been resolved.
\nThe stable distribution (etch) isn't affected by these problems, as the\nvulnerabilities have already been fixed during the Etch preparation\nfreeze phase.
\nWe recommend that you upgrade your XFree86 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in PHP, a\nserver-side, HTML-embedded scripting language, which may lead to the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nIt was discovered that missing input sanitising inside the ftp\n extension permits an attacker to execute arbitrary FTP commands.\n This requires the attacker to already have access to the FTP\n server.
It was discovered that a buffer overflow in the SOAP extension permits\n the execution of arbitrary code.
The oldstable distribution (sarge) doesn't include php5.
\nFor the stable distribution (etch) these problems have been fixed\nin version 5.2.0-8+etch4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 5.2.2-1.
\nWe recommend that you upgrade your PHP packages. Packages for the Sparc\narchitectures are not yet available, due to problems on the build host. They\nwill be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the ftp extension of PHP, a server-side,\nHTML-embedded scripting language performs insufficient input sanitising,\nwhich permits an attacker to execute arbitrary FTP commands. This\nrequires the attacker to already have access to the FTP server.
\nFor the oldstable distribution (sarge) this problem has been fixed\nin version 4.3.10-21.
\nFor the stable distribution (etch) this problem has been fixed\nin version 4.4.4-8+etch3.
\nFor the unstable distribution (sid) this problem won't be fixed, as php4\nwill be removed from sid; thus you are strongly advised to migrate to\nphp5 if you prefer to follow the unstable distribution.
\nWe recommend that you upgrade your PHP packages. Packages for the Sparc\narchitectures are not yet available, due to problems on the build host. They\nwill be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBernhard R. Link discovered that the CVS browsing interface of Gforge, a\ncollaborative development tool, performs insufficient escaping of URLs,\nwhich allows the execution of arbitrary shell commands with the privileges\nof the www-data user.
\nThe oldstable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 4.5.14-5etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.5.14-6.
\nWe recommend that you upgrade your gforge-plugin-scmcvs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Open Ticket Request System performs\ninsufficient input sanitising for the Subaction parameter, which allows\nthe injection of arbitrary web script code.
\nThe oldstable distribution (sarge) doesn't include otrs2.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2.0.4p01-18.
\nThe unstable distribution (sid) isn't affected by this problem.
\nWe recommend that you upgrade your otrs2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a specially-crafted packet sent to the racoon\nipsec key exchange server could cause a tunnel to crash, resulting in\na denial of service.
\nThe oldstable distribution (sarge) isn't affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1:0.6.6-3.1.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your racoon package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceape internet\nsuite, an unbranded version of the Seamonkey Internet Suite. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nNicolas Derouet discovered that Iceape performs insufficient\n validation of cookies, which could lead to denial of service.
Gatan Leurent discovered a cryptographical weakness in APOP\n authentication, which reduces the required efforts for an MITM attack\n to intercept a password. The update enforces stricter validation, which\n prevents this attack.
Boris Zbarsky, Eli Friedman, Georgi Guninski, Jesse Ruderman, Martijn\n Wargers and Olli Pettay discovered crashes in the layout engine, which\n might allow the execution of arbitrary code.
Brendan Eich, Igor Bukanov, Jesse Ruderman, moz_bug_r_a4
and Wladimir Palant\n discovered crashes in the javascript engine, which might allow the execution of\n arbitrary code.
moz_bug_r_a4
discovered that adding an event listener through the\n addEventListener() function allows cross-site scripting.
Chris Thomas discovered that XUL popups can be abused for spoofing or\n phishing attacks.
Fixes for the oldstable distribution (sarge) are not available. While there\nwill be another round of security updates for Mozilla products, Debian doesn't\nhave the resources to backport further security fixes to the old Mozilla\nproducts. You're strongly encouraged to upgrade to stable as soon as possible.
\nFor the stable distribution (etch) these problems have been fixed in version\n1.0.9-0etch1. A build for the arm architecture is not yet available, it will\nbe provided later.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your iceape packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been identified in Gimp's SUNRAS plugin in\nversions prior to 2.2.15. This bug could allow an attacker to execute\narbitrary code on the victim's computer by inducing the victim to open a\nspecially crafted RAS file.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.2.13-1etch1.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 2.2.6-1sarge2.
\nFor the unstable and testing distributions (sid and lenny,\nrespectively), this problem has been fixed in version 2.2.14-2.
\nWe recommend that you upgrade your gimp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem was discovered in freetype, a FreeType2 font engine, which\ncould allow the execution of arbitrary code via an integer overflow in\nspecially crafted TTF files.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.2.1-5+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.2.1-6.
\nWe recommend that you upgrade your freetype package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo problems were discovered with lighttpd, a fast webserver with\nminimal memory footprint, which could allow denial of service.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nRemote attackers could cause denial of service by disconnecting\n partway through making a request.
A NULL pointer dereference could cause a crash when serving files\n with a mtime of 0.
For the stable distribution (etch) these problems have been fixed in\nversion 1.4.13-4etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.4.14-1.
\nWe recommend that you upgrade your lighttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nCVE-2006-6060 CVE-2006-6106 CVE-2006-6535 CVE-2007-0958\nCVE-2007-1357 CVE-2007-1592
\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode.
\nThis update also fixes a regression in the smbfs subsystem which was introduced\nin DSA-1233\nwhich caused symlinks to be interpreted as regular files.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nDavid Gibson reported an issue in the hugepage code which could permit\n a local DoS (system crash) on appropriately configured systems.
Doug Chapman discovered a potential local DoS (deadlock) in the mincore\n function caused by improper lock handling.
Ang Way Chuang reported a remote DoS (crash) in the dvb driver which\n can be triggered by a ULE package with an SNDU length of 0.
Eric Sandeen provided a fix for a local memory corruption vulnerability\n resulting from a misinterpretation of return values when operating on\n inodes which have been marked bad.
Darrick Wong discovered a local DoS (crash) vulnerability resulting from\n the incorrect initialization of nr_pages
in aio_setup_ring().
LMH reported a potential local DoS which could be exploited by a malicious\n user with the privileges to mount and read a corrupted iso9660 filesystem.
LMH reported a potential local DoS which could be exploited by a malicious\n user with the privileges to mount and read a corrupted ext3 filesystem.
LMH reported a potential local DoS which could be exploited by a malicious\n user with the privileges to mount and read a corrupted hfs filesystem on\n systems with SELinux hooks enabled (Debian does not enable SELinux by\n default).
LMH reported a potential local DoS (infinite loop) which could be exploited\n by a malicious user with the privileges to mount and read a corrupted NTFS\n filesystem.
Marcel Holtman discovered multiple buffer overflows in the Bluetooth\n subsystem which can be used to trigger a remote DoS (crash) and potentially\n execute arbitrary code.
Kostantin Khorenko discovered an invalid error path in dev_queue_xmit()\n which could be exploited by a local user to cause data corruption.
Santosh Eraniose reported a vulnerability that allows local users to read\n otherwise unreadable files by triggering a core dump while using PT_INTERP.\n This is related to CVE-2004-1073.
Jean Delvare reported a vulnerability in the appletalk subsystem.\n Systems with the appletalk module loaded can be triggered to crash\n by other systems on the local network via a malformed frame.
Masayuki Nakagawa discovered that flow labels were inadvertently\n being shared between listening sockets and child sockets. This defect\n can be exploited by local users to cause a DoS (Oops).
The following matrix explains which kernel version for which architecture\nfix the problems mentioned above:
\n| Debian 3.1 (sarge) | |
|---|---|
| Source | 2.6.8-16sarge7 |
| Alpha architecture | 2.6.8-16sarge7 |
| AMD64 architecture | 2.6.8-16sarge7 |
| HP Precision architecture | 2.6.8-6sarge7 |
| Intel IA-32 architecture | 2.6.8-16sarge7 |
| Intel IA-64 architecture | 2.6.8-14sarge7 |
| Motorola 680x0 architecture | 2.6.8-4sarge7 |
| PowerPC architecture | 2.6.8-12sarge7 |
| IBM S/390 architecture | 2.6.8-5sarge7 |
| Sun Sparc architecture | 2.6.8-15sarge7 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Icedove mail client,\nan unbranded version of the Thunderbird client. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nGatan Leurent discovered a cryptographical weakness in APOP\n authentication, which reduces the required efforts for an MITM attack\n to intercept a password. The update enforces stricter validation, which\n prevents this attack.
Boris Zbarsky, Eli Friedman, Georgi Guninski, Jesse Ruderman, Martijn\n Wargers and Olli Pettay discovered crashes in the layout engine, which\n might allow the execution of arbitrary code.
Brendan Eich, Igor Bukanov, Jesse Ruderman, moz_bug_r_a4
and Wladimir Palant\n discovered crashes in the Javascript engine, which might allow the execution of\n arbitrary code. Generally, enabling Javascript in Icedove is not recommended.
Fixes for the oldstable distribution (sarge) are not available. While there\nwill be another round of security updates for Mozilla products, Debian doesn't\nhave the resources to backport further security fixes to the old Mozilla\nproducts. You're strongly encouraged to upgrade to stable as soon as possible.
\nFor the stable distribution (etch) these problems have been fixed in version\n1.5.0.12.dfsg1-0etch1.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your icedove packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nNicolas Derouet discovered that Xulrunner performs insufficient\n validation of cookies, which could lead to denial of service.
Boris Zbarsky, Eli Friedman, Georgi Guninski, Jesse Ruderman, Martijn\n Wargers and Olli Pettay discovered crashes in the layout engine, which\n might allow the execution of arbitrary code.
Brendan Eich, Igor Bukanov, Jesse Ruderman, moz_bug_r_a4
and Wladimir\n Palant discovered crashes in the Javascript engine, which might allow\n the execution of arbitrary code.
Marcel
discovered that malicious web sites can cause massive\n resource consumption through the auto completion feature, resulting\n in denial of service.
moz_bug_r_a4
discovered that adding an event listener through the\n addEventListener() function allows cross-site scripting.
Chris Thomas discovered that XUL popups can be abused for spoofing\n or phishing attacks.
The oldstable distribution (sarge) doesn't include xulrunner.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 1.8.0.12-0etch1.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJohn Heasman discovered a heap overflow in the routines of OpenOffice.org\nthat parse RTF files. A specially crafted RTF file could cause the\nfilter to overwrite data on the heap, which may lead to the execution\nof arbitrary code.
\nFor the old stable distribution (sarge) this problem has been fixed in\nversion 1.1.3-9sarge7.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2.0.4.dfsg.2-7etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.1~rc1-1.
\nWe recommend that you upgrade your openoffice.org packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel web\nbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nNicolas Derouet discovered that Iceweasel performs insufficient\n validation of cookies, which could lead to denial of service.
Boris Zbarsky, Eli Friedman, Georgi Guninski, Jesse Ruderman, Martijn\n Wargers and Olli Pettay discovered crashes in the layout engine, which\n might allow the execution of arbitrary code.
Brendan Eich, Igor Bukanov, Jesse Ruderman, moz_bug_r_a4
and Wladimir Palant\n discovered crashes in the javascript engine, which might allow the execution of\n arbitrary code.
Marcel
discovered that malicious web sites can cause massive\n resource consumption through the auto completion feature, resulting\n in denial of service.
moz_bug_r_a4
discovered that adding an event listener through the\n addEventListener() function allows cross-site scripting.
Chris Thomas discovered that XUL popups can be abused for spoofing or\n phishing attacks.
Fixes for the oldstable distribution (sarge) are not available. While there\nwill be another round of security updates for Mozilla products, Debian doesn't\nhave the resources to backport further security fixes to the old Mozilla\nproducts. You're strongly encouraged to upgrade to stable as soon as possible.
\nFor the stable distribution (etch) these problems have been fixed in version\n2.0.0.4-0etch1. A build for the Alpha architecture is not yet available, it will\nbe provided later.
\nFor the unstable distribution (sid) these problems have been fixed in version\n2.0.0.4-1.
\nWe recommend that you upgrade your iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the PostgreSQL database performs insufficient\nvalidation of variables passed to privileged SQL statements, so called\nsecurity definers
, which could lead to SQL privilege escalation.
The oldstable distribution (sarge) doesn't contain PostgreSQL 8.1.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 8.1.9-0etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 8.1.9-1.
\nWe recommend that you upgrade your PostgreSQL packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in libexif, a library to parse EXIF\nfiles, which allows denial of service and possible execution of arbitrary\ncode via malformed EXIF data.
\nFor the old-stable distribution (sarge), this problem has been fixed\nin version 0.6.9-6sarge1.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.6.13-5etch1.
\nWe recommend that you upgrade your libexif package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the PostgreSQL database performs insufficient\nvalidation of variables passed to privileged SQL statement called\nsecurity definers
, which could lead to SQL privilege escalation.
For the oldstable distribution (sarge) this problem has been fixed in\nversion 7.4.7-6sarge5. A powerpc build is not yet available due to\nproblems with the build host. It will be provided later.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 7.4.17-0etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 7.4.17-1.
\nWe recommend that you upgrade your PostgreSQL packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Apache 1.3 connector for the Tomcat Java\nservlet engine decoded request URLs multiple times, which can lead\nto information disclosure.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 1.2.5-2sarge1. An updated package for powerpc is not yet\navailable due to problems with the build host. It will be provided\nlater.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.2.18-3etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.23-1.
\nWe recommend that you upgrade your libapache-mod-jk package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Cornelius and Reimar Doeffinger discovered that the MPlayer movie\nplayer performs insufficient boundary checks when accessing CDDB data,\nwhich might lead to the execution of arbitrary code.
\nThe oldstable distribution (sarge) doesn't include MPlayer packages.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.0~rc1-12etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0~rc1-14.
\nWe recommend that you upgrade your mplayer package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in\nopen-iscsi, a transport-independent iSCSI implementation. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nOlaf Kirch discovered that due to a programming error access to the\n management interface socket was insufficiently protected, which allows\n denial of service.
Olaf Kirch discovered that access to a semaphore used in the logging\n code was insufficiently protected, allowing denial of service.
The oldstable distribution (sarge) doesn't include open-iscsi.
\nFor the stable distribution (etch) these problems have been fixed\nin version 2.0.730-1etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.865-1.
\nWe recommend that you upgrade your open-iscsi packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThor Larholm discovered that libphp-phpmailer, an email transfer class\nfor PHP, performs insufficient input validition if configured to use\nSendmail. This allows the execution of arbitrary shell commands.
\nThe oldstable distribution (sarge) doesn't include libphp-phpmailer.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.73-2etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.73-4.
\nWe recommend that you upgrade your libphp-phpmailer package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that emacs, the GNU Emacs editor, will crash when\nprocessing certain types of images.
\nFor the stable distribution (etch), this problem has been fixed in version 21.4a+1-3etch1.
\nWe recommend that you upgrade your emacs21 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nduskwave discovered that tinymux, a text-based multi-user virtual world server,\nperforms insufficient boundary checks when working with user-supplied data,\nwhich might lead to the execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.4.3.31-1etch1.
\nWe recommend that you upgrade your tinymux package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in ekg, a console\nGadu Gadu client. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that memory alignment errors may allow remote\n attackers to cause a denial of service on certain architectures\n such as sparc. This only affects Debian Sarge.
It was discovered that several endianess errors may allow remote\n attackers to cause a denial of service. This only affects\n Debian Sarge.
It was discovered that a memory leak in handling image messages may\n lead to denial of service. This only affects Debian Etch.
It was discovered that a null pointer deference in the token OCR code\n may lead to denial of service. This only affects Debian Etch.
It was discovered that a memory leak in the token OCR code may lead\n to denial of service. This only affects Debian Etch.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 1.5+20050411-7. This updates lacks updated packages for the m68k\narchitecture. They will be provided later.
\nFor the stable distribution (etch) these problems have been fixed\nin version 1:1.7~rc2-1etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1:1.7~rc2-2.
\nWe recommend that you upgrade your ekg packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in MaraDNS, a simple\nsecurity-aware Domain Name Service server. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nIt was discovered that malformed DNS requests can trigger memory\n leaks, allowing denial of service.
It was discovered that malformed DNS requests can trigger memory\n leaks, allowing denial of service.
It was discovered that malformed DNS requests can trigger memory\n leaks, allowing denial of service.
The oldstable distribution (sarge) is not affected by these problems.
\nFor the stable distribution (etch) these problems have been fixed\nin version 1.2.12.04-1etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.2.12.06-1.
\nWe recommend that you upgrade your maradns packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Clam anti-virus\ntoolkit. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered that the OLE2 parser can be tricked into an infinite\n loop and memory exhaustion.
It was discovered that the NsPack decompression code performed\n insufficient sanitising on an internal length variable, resulting in\n a potential buffer overflow.
It was discovered that temporary files were created with insecure\n permissions, resulting in information disclosure.
It was discovered that the decompression code for RAR archives allows\n bypassing a scan of a RAR archive due to insufficient validity checks.
It was discovered that the decompression code for RAR archives performs\n insufficient validation of header values, resulting in a buffer overflow.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 0.84-2.sarge.17. Please note that the fix for CVE-2007-3024 hasn't\nbeen backported to oldstable.
\nFor the stable distribution (etch) these problems have been fixed\nin version 0.90.1-3etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.90.2-1.
\nWe recommend that you upgrade your clamav packages. An updated package\nfor oldstable/powerpc is not yet available. It will be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the IMAP code in the Evolution Data Server\nperforms insufficient sanitising of a value later used an array index,\nwhich can lead to the execution of arbitrary code.
\nFor the oldstable distribution (sarge) a different source package\nis affected and will be fixed separately.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.6.3-5etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.10.2-2.
\nWe recommend that you upgrade your evolution-data-server packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Wireshark\nnetwork traffic analyzer, which may lead to denial of service. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nOff-by-one overflows were discovered in the iSeries dissector.
The MMS and SSL dissectors could be forced into an infinite loop.
An off-by-one overflow was discovered in the DHCP/BOOTP dissector.
The oldstable distribution (sarge) is not affected by these problems.\n(In Sarge Wireshark used to be called Ethereal).
\nFor the stable distribution (etch) these problems have been fixed\nin version 0.99.4-5.etch.0. Packages for the big endian MIPS architecture\nare not yet available. They will be provided later.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.99.6pre1-1.
\nWe recommend that you upgrade your Wireshark packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the MIT reference\nimplementation of the Kerberos network authentication protocol suite,\nwhich may lead to the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nWei Wang discovered that the free of an uninitialised pointer in the\n Kerberos RPC library may lead to the execution of arbitrary code.
Wei Wang discovered that insufficient input sanitising in the\n Kerberos RPC library may lead to the execution of arbitrary code.
It was discovered that a buffer overflow in the Kerberos\n administration daemon may lead to the execution of arbitrary code.
For the old stable distribution (sarge) these problems have been fixed in\nversion 1.3.6-2sarge5. Packages for hppa, mips and powerpc are not yet\navailable. They will be provided later.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 1.4.4-7etch2. Packages for hppa and mips are not yet available.\nThey will be provided later.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.6.dfsg.1-5.
\nWe recommend that you upgrade your Kerberos packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKazuhiro Nishiyama found a vulnerability in hiki, a Wiki engine written\nin Ruby, which could allow a remote attacker to delete arbitrary files\nwhich are writable to the Hiki user, via a specially crafted session\nparameter.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.8.6-1etch1.
\nFor the unstable distribution (sid) this problem has been fixed in version\n0.8.7-1.
\nWe recommend that you upgrade your hiki package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Evolution, a\ngroupware suite with mail client and organizer. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nUlf H\u00e4rnhammar discovered that a format string vulnerability in\n the handling of shared calendars may allow the execution of arbitrary\n code.
It was discovered that the IMAP code in the Evolution Data Server\n performs insufficient sanitising of a value later used an array index,\n which can lead to the execution of arbitrary code.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 2.0.4-2sarge2. Packages for hppa, mips and powerpc are not yet\navailable. They will be provided later.
\nFor the stable distribution (etch) these problems have been fixed\nin version 2.6.3-6etch1. Packages for mips are not yet available. They\nwill be provided later.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your evolution packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered that\nfireflier-server, an interactive firewall rule creation tool, uses temporary\nfiles in an unsafe manner which may be exploited to remove arbitrary files from\nthe local system.
\nFor the old stable distribution (sarge) this problem has been fixed in\nversion 1.1.5-1sarge1.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.1.6-3etch1.
\nFor the unstable distribution (sid) this problem will be fixed shortly.
\nWe recommend that you upgrade your fireflier-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered that gsambad,\na GTK+ configuration tool for samba, uses temporary files in an unsafe\nmanner which may be exploited to truncate arbitrary files from the local system.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.1.4-2etch1.
\nFor the unstable distribution (sid) this problem will be fixed shortly.
\nWe recommend that you upgrade your gsambad package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered that\nunicon-imc2, a Chinese input method library, makes unsafe use of\nan environmental variable, which may be exploited to execute arbitrary\ncode.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 3.0.4-11etch1.
\nFor the unstable distribution (sid) this problem will be fixed shortly.
\nWe recommend that you upgrade your unicon-imc2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered that\ngfax, a GNOME frontend for fax programs, uses temporary files in an\nunsafe manner which may be exploited to execute arbitrary commands\nwith the privileges of the root user.
\nFor the old stable distribution (sarge) this problem has been fixed\nin version 0.4.2-11sarge1.
\nThe stable distribution (etch) is not affected by this problem.
\nThe unstable distribution (sid) is not affected by this problem.
\nWe recommend that you upgrade your gfax package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in PHP, a\nserver-side, HTML-embedded scripting language, which may lead to the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nStefan Esser discovered that a buffer overflow in the zip extension\n allows the execution of arbitrary code.
It was discovered that a buffer overflow in the xmlrpc extension\n allows the execution of arbitrary code.
The oldstable distribution (sarge) doesn't include php5.
\nFor the stable distribution (etch) these problems have been fixed\nin version 5.2.0-8+etch7.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 5.2.2-1.
\nWe recommend that you upgrade your PHP packages. Packages for the littleendian Mips architecture are not yet available, due to problems on the\nbuild host. They will be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in PHP, a\nserver-side, HTML-embedded scripting language, which may lead to the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nStefan Esser discovered HTTP response splitting vulnerabilities\n in the session extension. This only affects Debian 3.1 (Sarge).
Stefan Esser discovered that an integer overflow in memory allocation\n routines allows the bypass of memory limit restrictions. This only\n affects Debian 3.1 (Sarge) on 64 bit architectures.
It was discovered that a buffer overflow in the xmlrpc extension\n allows the execution of arbitrary code.
For the oldstable distribution (sarge) these problems have been fixed\nin version 4.3.10-22.
\nFor the stable distribution (etch) these problems have been fixed\nin version 4.4.4-8+etch4.
\nThe unstable distribution (sid) no longer contains php4.
\nWe recommend that you upgrade your PHP packages. Sarge packages for\nhppa, mips and powerpc are not yet available, due to problems on the\nbuild hosts. They will be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the VideoLan\nmultimedia player and streamer, which may lead to the execution of\narbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nDavid Thiel discovered that several format string vulnerabilities may\n lead to the execution of arbitrary code.
David Thiel discovered an integer overflow in the WAV processing code.
This update also fixes several crashes, which can be triggered through\nmalformed media files.
\nFor the oldstable distribution (sarge) these problems have been fixed in\nversion 0.8.1.svn20050314-1sarge3. Packages for the powerpc architecture\nare not yet available. They will be provided later.
\nFor the stable distribution (etch) these problems have been fixed\nin version 0.8.6-svn20061012.debian-5etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.8.6.c-1.
\nWe recommend that you upgrade your vlc packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that the GnuTLS certificate verification methods\nimplemented in libcurl-gnutls, a solid, usable, and portable multi-protocol\nfile transfer library, did not check for expired or invalid dates.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 7.15.5-1etch1.
\nWe recommend that you upgrade your libcurl3-gnutls package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nA problem was discovered with freetype, a FreeType2 font engine, which\ncould allow the execution of arbitrary code via an integer overflow in\nspecially crafted TTF files.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 2.1.7-8.
\nWe recommend that you upgrade your freetype package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Gimp, the GNU Image\nManipulation Program, which might lead to the execution of arbitrary code.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nSean Larsson discovered several integer overflows in the processing\n code for DICOM, PNM, PSD, RAS, XBM and XWD images, which might lead\n to the execution of arbitrary code if a user is tricked into opening\n such a malformed media file.
Stefan Cornelius discovered an integer overflow in the processing\n code for PSD images, which might lead to the execution of arbitrary\n code if a user is tricked into opening such a malformed media file.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 2.2.6-1sarge4. Packages for mips and mipsel are not yet\navailable.
\nFor the stable distribution (etch) these problems have been fixed\nin version 2.2.13-1etch4. Packages for mips are not yet available.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.2.17-1.
\nWe recommend that you upgrade your gimp packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Mozilla Firefox.
\nThis will be the last security update of Mozilla-based products for\nthe oldstable (sarge) distribution of Debian. We recommend to upgrade\nto stable (etch) as soon as possible.
\nThe Common Vulnerabilities and Exposures project identifies the following\nvulnerabilities:
\nIt was discovered that an integer overflow in text/enhanced message\n parsing allows the execution of arbitrary code.
It was discovered that a regression in the Javascript engine allows\n the execution of Javascript with elevated privileges.
It was discovered that incorrect parsing of invalid HTML characters\n allows the bypass of content filters.
It was discovered that insecure child frame handling allows cross-site\n scripting.
It was discovered that Firefox handles URI with a null byte in the\n hostname insecurely.
It was discovered that a buffer overflow in the NSS code allows the\n execution of arbitrary code.
It was discovered that a buffer overflow in the NSS code allows the\n execution of arbitrary code.
It was discovered that multiple programming errors in the layout engine\n allow the execution of arbitrary code.
It was discovered that the page cache calculates hashes in an insecure\n manner.
It was discovered that the password manager allows the disclosure of\n passwords.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 1.0.4-2sarge17. You should upgrade to etch as soon as possible.
\nThe stable distribution (etch) isn't affected. These vulnerabilities have\nbeen fixed prior to the release of Debian etch.
\nThe unstable distribution (sid) no longer contains mozilla-firefox. Iceweasel\nis already fixed.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nRonen Zilberman and Michal Zalewski discovered that a timing race\n allows the injection of content into about:blank frames.
Michal Zalewski discovered that same-origin policies for wyciwyg://\n documents are insufficiently enforced.
Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,\n Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli Pettay, Paul\n Nickerson and Vladimir Sukhoy discovered crashes in the layout engine,\n which might allow the execution of arbitrary code.
Asaf Romano, Jesse Ruderman and Igor Bukanov discovered crashes in the\n javascript engine, which might allow the execution of arbitrary code.
moz_bug_r_a4
discovered that the addEventListener() and setTimeout()\n functions allow cross-site scripting.
moz_bug_r_a4
discovered that a programming error in event handling\n allows privilege escalation.
shutdown
and moz_bug_r_a4
discovered that the XPCNativeWrapper allows\n the execution of arbitrary code.
The oldstable distribution (sarge) doesn't include xulrunner.
\nFor the stable distribution (etch) these problems have been fixed in version\n1.8.0.13~pre070720-0etch1. A build for the mips architecture is not yet\navailable, it will be provided later.
\nFor the unstable distribution (sid) these problems have been fixed in version\n1.8.1.5-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel web\nbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nRonen Zilberman and Michal Zalewski discovered that a timing race\n allows the injection of content into about:blank frames.
Michal Zalewski discovered that same-origin policies for wyciwyg://\n documents are insufficiently enforced.
Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,\n Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli Pettay, Paul\n Nickerson and Vladimir Sukhoy discovered crashes in the layout engine,\n which might allow the execution of arbitrary code.
Asaf Romano, Jesse Ruderman and Igor Bukanov discovered crashes in the\n javascript engine, which might allow the execution of arbitrary code.
moz_bug_r_a4
discovered that the addEventListener() and setTimeout()\n functions allow cross-site scripting.
moz_bug_r_a4
discovered that a programming error in event handling\n allows privilege escalation.
shutdown
and moz_bug_r_a4
discovered that the XPCNativeWrapper allows\n the execution of arbitrary code.
The Mozilla products in the oldstable distribution (sarge) are no longer\nsupported with security updates. You're strongly encouraged to upgrade to\nstable as soon as possible.
\nFor the stable distribution (etch) these problems have been fixed in version\n2.0.0.5-0etch1. Builds for alpha and mips are not yet available, they will\nbe provided later.
\nFor the unstable distribution (sid) these problems have been fixed in version\n2.0.0.5-1.
\nWe recommend that you upgrade your iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceape internet\nsuite, an unbranded version of the Seamonkey Internet Suite. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nRonen Zilberman and Michal Zalewski discovered that a timing race\n allows the injection of content into about:blank frames.
Michal Zalewski discovered that same-origin policies for wyciwyg://\n documents are insufficiently enforced.
Bernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,\n Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli Pettay, Paul\n Nickerson and Vladimir Sukhoy discovered crashes in the layout engine,\n which might allow the execution of arbitrary code.
Asaf Romano, Jesse Ruderman and Igor Bukanov discovered crashes in the\n javascript engine, which might allow the execution of arbitrary code.
moz_bug_r_a4
discovered that the addEventListener() and setTimeout()\n functions allow cross-site scripting.
moz_bug_r_a4
discovered that a programming error in event handling\n allows privilege escalation.
shutdown
and moz_bug_r_a4
discovered that the XPCNativeWrapper allows\n the execution of arbitrary code.
The Mozilla products in the oldstable distribution (sarge) are no longer\nsupported with security updates. You're strongly encouraged to upgrade to\nstable as soon as possible.
\nFor the stable distribution (etch) these problems have been fixed in version\n1.0.10~pre070720-0etch1. A build for the mips architecture is not yet available,\nit will be provided later.
\nFor the unstable distribution (sid) these problems have been fixed in version\n1.1.3-1.
\nWe recommend that you upgrade your iceape packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA NULL pointer dereference has been discovered in the RAR VM of Clam\nAntivirus (ClamAV) which allows user-assisted remote attackers to\ncause a denial of service via a specially crafted RAR archives.
\nWe are currently unable to provide fixed packages for the MIPS\narchitectures. Those packages will be installed in the security\narchive when they become available.
\nThe old stable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.90.1-3etch4.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.91-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis update provides fixed packages for the oldstable distribution (sarge).\nFor reference the original advisory text:
\n\n\nAmit Klein discovered that the BIND name server generates predictable\nDNS query IDs, which may lead to cache poisoning attacks.
\n
For the oldstable distribution (sarge) this problem has been fixed in\nversion 9.2.4-1sarge3. An update for mips, powerpc and hppa is not yet\navailable, they will be released soon.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 9.3.4-2etch1. An update for mips is not yet available, it will\nbe released soon.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your BIND packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a race condition in the init.d script of the X Font\nServer allows the modification of file permissions of arbitrary files if\nthe local administrator can be tricked into restarting the X font server.
\nFor the oldstable distribution (sarge) xfs is present as part of the\nmonolithic xfree86 package. A fix will be provided along with a future\nsecurity update.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.0.1-6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.4-2.
\nWe recommend that you upgrade your xfs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nColin Percival discovered an integer overflow in file, a file type\nclassification tool, which may lead to the execution of arbitrary code.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 4.12-1sarge2.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 4.17-5etch2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.21-1.
\nWe recommend that you upgrade your file package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel web\nbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nmoz_bug_r_a4
discovered that a regression in the handling of\n about:blank
windows used by addons may lead to an attacker being\n able to modify the content of web sites.
Jesper Johansson discovered that missing sanitising of double-quotes\n and spaces in URIs passed to external programs may allow an attacker\n to pass arbitrary arguments to the helper program if the user is\n tricked into opening a malformed web page.
The Mozilla products in the oldstable distribution (sarge) are no longer\nsupported with security updates.
\nFor the stable distribution (etch) these problems have been fixed in version\n2.0.0.6-0etch1.
\nFor the unstable distribution (sid) these problems have been fixed in version\n2.0.0.6-1.
\nWe recommend that you upgrade your iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nmoz_bug_r_a4
discovered that a regression in the handling of\n about:blank
windows used by addons may lead to an attacker being\n able to modify the content of web sites.
Jesper Johansson discovered that missing sanitising of double-quotes\n and spaces in URIs passed to external programs may allow an attacker\n to pass arbitrary arguments to the helper program if the user is\n tricked into opening a malformed web page.
The oldstable distribution (sarge) doesn't include xulrunner.
\nFor the stable distribution (etch) these problems have been fixed in version\n1.8.0.13~pre070720-0etch3.
\nFor the unstable distribution (sid) these problems have been fixed in version\n1.8.1.6-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceape internet\nsuite, an unbranded version of the Seamonkey Internet Suite. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nmoz_bug_r_a4
discovered that a regression in the handling of\n about:blank
windows used by addons may lead to an attacker being\n able to modify the content of web sites.
Jesper Johansson discovered that missing sanitising of double-quotes\n and spaces in URIs passed to external programs may allow an attacker\n to pass arbitrary arguments to the helper program if the user is\n tricked into opening a malformed web page.
The Mozilla products in the oldstable distribution (sarge) are no longer\nsupported with security updates.
\nFor the stable distribution (etch) these problems have been fixed in version\n1.0.10~pre070720-0etch3.
\nFor the unstable distribution (sid) these problems have been fixed in version\n1.1.3-2.
\nWe recommend that you upgrade your iceape packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the xpdf PDF viewer may lead\nto the execution of arbitrary code if a malformed PDF file is opened.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 3.00-13.7.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 3.01-9etch1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your xpdf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the xpdf PDF viewer may lead\nto the execution of arbitrary code if a malformed PDF file is opened.
\npoppler includes a copy of the xpdf code and required an update as well.
\nThe oldstable distribution (sarge) doesn't include poppler.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.4.5-5.1etch1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your poppler packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the xpdf PDF viewer may lead\nto the execution of arbitrary code if a malformed PDF file is opened.
\nlibextractor includes a copy of the xpdf code and required an update\nas well.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 0.4.2-2sarge6.
\nThe stable distribution (etch) isn't affected by this problem.
\nThe unstable distribution (sid) isn't affected by this problem.
\nWe recommend that you upgrade your libextractor packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the xpdf PDF viewer may lead\nto the execution of arbitrary code if a malformed PDF file is opened.
\ntetex-bin includes a copy of the xpdf code and required an update as\nwell.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 2.0.2-30sarge5.
\nThe package from the stable distribution (etch) links dynamically\nagainst libpoppler and doesn't require a separate update.
\nThe package from the unstable distribution (sid) links dynamically\nagainst libpoppler and doesn't require a separate update.
\nWe recommend that you upgrade your tetex-bin packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy discovered that bochs, a highly portable IA-32 PC emulator,\nis vulnerable to a buffer overflow in the emulated NE2000 network device\ndriver, which may lead to privilege escalation.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 2.1.1+20041109-3sarge1.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2.3-2etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3+20070705-1.
\nWe recommend that you upgrade your bochs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the xpdf PDF viewer may lead\nto the execution of arbitrary code if a malformed PDF file is opened.
\npdfkit.framework includes a copy of the xpdf code and required an update\nas well.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 0.8-2sarge4.
\nThe package from the stable distribution (etch) links dynamically\nagainst libpoppler and doesn't require a separate update.
\nThe package from the unstable distribution (sid) links dynamically\nagainst libpoppler and doesn't require a separate update.
\nWe recommend that you upgrade your pdfkit.framework packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the BGP dissector of tcpdump,\na powerful tool for network monitoring and data acquisition, may lead to\nthe execution of arbitrary code.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 3.8.3-5sarge3.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 3.9.5-2etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.9.5-3.
\nWe recommend that you upgrade your tcpdump package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in xpdf PDF viewer may lead\nto the execution of arbitrary code if a malformed PDF file is opened.
\ngpdf includes a copy of the xpdf code and requires an update as well.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 2.8.2-1.2sarge6.
\nThe stable distribution (etch) no longer contains gpdf.
\nThe unstable distribution (sid) no longer contains gpdf.
\nWe recommend that you upgrade your gpdf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the xpdf PDF viewer may lead\nto the execution of arbitrary code if a malformed PDF file is opened.
\nkpdf includes a copy of the xpdf code and required an update as well.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 3.3.2-2sarge5.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 3.5.5-3etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.5.7-3.
\nWe recommend that you upgrade your kpdf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIlja van Sprundel discovered that kernel memory could be leaked via the\n Bluetooth setsockopt call due to an uninitialized stack buffer. This\n could be used by local attackers to read the contents of sensitive kernel\n memory.
Thomas Graf reported a typo in the DECnet protocol handler that could\n be used by a local attacker to overrun an array via crafted packets,\n potentially resulting in a Denial of Service (system crash).\n A similar issue exists in the IPV4 protocol handler and will be fixed\n in a subsequent update.
A couple of issues with random number generation were discovered.\n Slightly less random numbers resulted from hashing a subset of the\n available entropy. Zero-entropy systems were seeded with the same\n inputs at boot time, resulting in repeatable series of random numbers.
Florian Zumbiehl discovered a memory leak in the PPPOE subsystem caused\n by releasing a socket before PPPIOCGCHAN is called upon it. This could\n be used by a local user to DoS a system by consuming all available memory.
Vilmos Nebehaj discovered a NULL pointer dereference condition in the\n netfilter subsystem. This allows remote systems which communicate using\n the SCTP protocol to crash a system by creating a connection with an\n unknown chunk type.
Oliver Neukum reported an issue in the usblcd driver which, by not\n limiting the size of write buffers, permits local users with write access\n to trigger a DoS by consuming all available memory.
Zhongling Wen reported an issue in nf_conntrack_h323 where the lack of\n range checking may lead to NULL pointer dereferences. Remote attackers\n could exploit this to create a DoS condition (system crash).
Wojciech Purczynski discovered that pdeath_signal was not being reset\n properly under certain conditions which may allow local users to gain\n privileges by sending arbitrary signals to suid binaries.
Dave Airlie reported that Intel 965 and above chipsets have relocated\n their batch buffer security bits. Local X server users may exploit this\n to write user data to arbitrary physical memory addresses.
These problems have been fixed in the stable distribution in version\n2.6.18.dfsg.1-13etch1.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch4 |
| user-mode-linux | 2.6.18-1um-2etch3 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the xpdf PDF viewer may lead\nto the execution of arbitrary code if a malformed PDF file is opened.
\nkoffice includes a copy of the xpdf code and required an update as well.
\nThe oldstable distribution (sarge) will be fixed later.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.6.1-2etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.6.3-2.
\nWe recommend that you upgrade your koffice packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Asterisk, a free\nsoftware PBX and telephony toolkit. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nMu Security
discovered that a NULL pointer dereference in the SIP\n implementation could lead to denial of service.
Inria Lorraine discovered that a programming error in the SIP\n implementation could lead to denial of service.
It was discovered that a NULL pointer dereference in the manager\n interface could lead to denial of service.
It was discovered that a programming error in the SIP implementation\n could lead to denial of service.
Tim Panton and Birgit Arkestein discovered that a programming error\n in the IAX2 implementation could lead to information disclosure.
Russell Bryant discovered that a buffer overflow in the IAX\n implementation could lead to the execution of arbitrary code.
Chris Clark and Zane Lackey discovered that several NULL pointer\n dereferences in the IAX2 implementation could lead to denial of\n service.
Will Drewry discovered that a programming error in the Skinny\n implementation could lead to denial of service.
For the oldstable distribution (sarge) these problems have been fixed in\nversion 1.0.7.dfsg.1-2sarge5.
\nFor the stable distribution (etch) these problems have been fixed\nin version 1:1.2.13~dfsg-2etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1:1.4.11~dfsg-1.
\nWe recommend that you upgrade your Asterisk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that dovecot, a secure mail server that supports mbox\nand maildir mailboxes, when configured to use non-system-user spools\nand compressed folders, may allow directory traversal in mailbox names.
\nFor the old stable distribution (sarge), this problem was not present.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.0.rc15-2etch1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your dovecot package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSebastian Krahmer discovered that rsync, a fast remote file copy program,\ncontains an off-by-one error which might allow remote attackers to execute\narbitrary code via long directory names.
\nFor the old stable distribution (sarge), this problem is not present.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.6.9-2etch1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your rsync package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that postfix-policyd, an anti-spam plugin for postfix,\ndidn't correctly test lengths of incoming SMTP commands potentially allowing\nthe remote execution of arbitrary code.
\nFor the old stable distribution (sarge), this package was not present.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.80-2.1etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n1.80-2.2.
\nWe recommend that you upgrade your postfix-policyd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities were discovered in lighttpd, a fast webserver with\nminimal memory footprint, which could allow the execution of arbitrary code via\nthe overflow of CGI variables when mod_fcgi was enabled. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nThe use of mod_auth could leave to a denial of service attack crashing\n the webserver.
The improper handling of repeated HTTP headers could cause a denial\n of service attack crashing the webserver.
A bug in mod_access potentially allows remote users to bypass\n access restrictions via trailing slash characters.
On 32-bit platforms users may be able to create denial of service\n attacks, crashing the webserver, via mod_webdav, mod_fastcgi, or\n mod_scgi.
For the stable distribution (etch), these problems have been fixed in version\n1.4.13-4etch4.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.4.16-1.
\nWe recommend that you upgrade your lighttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nThomas Graf reported a typo in the IPv4 protocol handler that could\n be used by a local attacker to overrun an array via crafted packets,\n potentially resulting in a Denial of Service (system crash).\n The DECnet counterpart of this issue was already fixed in DSA-1356.
iDefense reported a potential integer underflow in the cpuset filesystem\n which may permit local attackers to gain access to sensitive kernel\n memory. This vulnerability is only exploitable if the cpuset filesystem\n is mounted.
The PaX Team discovered a potential buffer overflow in the random number\n generator which may permit local users to cause a denial of service or\n gain additional privileges. This issue is not believed to effect default\n Debian installations where only root has sufficient privileges to exploit\n it.
A coding error in the CIFS subsystem permits the use of unsigned messages\n even if the client has configured the system to enforce\n signing by passing the sec=ntlmv2i mount option. This may allow remote\n attackers to spoof CIFS network traffic.
Alan Cox reported an issue in the aacraid driver that allows unprivileged\n local users to make ioctl calls which should be restricted to admin\n privileges.
These problems have been fixed in the stable distribution in version\n2.6.18.dfsg.1-13etch2.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch5 |
| user-mode-linux | 2.6.18-1um-2etch4 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the vim editor. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nUlf H\u00e4rnhammar discovered that a format string flaw in helptags_one() from\n src/ex_cmds.c (triggered through the helptags
command) can lead to the\n execution of arbitrary code.
Editors often provide a way to embed editor configuration commands (aka\n modelines) which are executed once a file is opened. Harmful commands\n are filtered by a sandbox mechanism. It was discovered that function\n calls to writefile(), feedkeys() and system() were not filtered, allowing\n shell command execution with a carefully crafted file opened in vim.
This updated advisory repairs issues with missing files in the packages\nfor the oldstable distribution (sarge) for the alpha, mips, and mipsel\narchitectures.
\nFor the oldstable distribution (sarge) these problems have been fixed in\nversion 6.3-071+1sarge2. Sarge is not affected by CVE-2007-2438.
\nFor the stable distribution (etch) these problems have been fixed\nin version 7.0-122+1etch3.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 7.1-056+1.
\nWe recommend that you upgrade your vim packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNikolaus Schulz discovered that a programming error in id3lib, an ID3 Tag\nLibrary, may lead to denial of service through symlink attacks.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 3.8.3-4.1sarge1.
\nDue to a technical limitation in the archive management scripts the fix\nfor the stable distribution (etch) can only be released in a few days.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 3.8.3-7.
\nWe recommend that you upgrade your id3lib3.8.3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Clam anti-virus\ntoolkit. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered that the RTF and RFC2397 parsers can be tricked\n into dereferencing a NULL pointer, resulting in denial of service.
It was discovered that clamav-milter performs insufficient input\n sanitising, resulting in the execution of arbitrary shell commands.
The oldstable distribution (sarge) is only affected by a subset of\nthe problems. An update will be provided later.
\nFor the stable distribution (etch) these problems have been fixed\nin version 0.90.1-3etch7.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.91.2-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a buffer overflow of the RPC library of the MIT\nKerberos reference implementation allows the execution of arbitrary code.
\nThe oldstable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.4.4-7etch3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.6.dfsg.1-7.
\nWe recommend that you upgrade your Kerberos packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a buffer overflow of the library for secure RPC\ncommunication over the rpcsec_gss protocol allows the execution of\narbitrary code.
\nThe oldstable distribution (sarge) doesn't contain librpcsecgss.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.14-2etch1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your librpcsecgss packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSumit I. Siddharth discovered that Gforge, a collaborative development\ntool performs insufficient input sanitising, which allows SQL injection.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 3.1-31sarge2.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 4.5.14-22etch1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your gforge package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in phpMyAdmin, a\nprogram to administrate MySQL over the web. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nThe PMA_ArrayWalkRecursive function in libraries/common.lib.php\n does not limit recursion on arrays provided by users, which allows\n context-dependent attackers to cause a denial of service (web\n server crash) via an array with many dimensions.
\nThis issue affects only the stable distribution (Etch).
Incomplete blacklist vulnerability in index.php allows remote\n attackers to conduct cross-site scripting (XSS) attacks by\n injecting arbitrary JavaScript or HTML in a (1) db or (2) table\n parameter value followed by an uppercase </SCRIPT> end tag,\n which bypasses the protection against lowercase </script>.
\nThis issue affects only the stable distribution (Etch).
Multiple cross-site scripting (XSS) vulnerabilities allow remote\n attackers to inject arbitrary web script or HTML via (1) the\n fieldkey parameter to browse_foreigners.php or (2) certain input\n to the PMA_sanitize function.
Multiple cross-site scripting (XSS) vulnerabilities allow remote\n attackers to inject arbitrary HTML or web script via (1) a comment\n for a table name, as exploited through (a) db_operations.php,\n (2) the db parameter to (b) db_create.php, (3) the newname parameter\n to db_operations.php, the (4) query_history_latest,\n (5) query_history_latest_db, and (6) querydisplay_tab parameters to\n (c) querywindow.php, and (7) the pos parameter to (d) sql.php.
\nThis issue affects only the oldstable distribution (Sarge).
phpMyAdmin allows remote attackers to bypass Allow/Deny access rules\n that use IP addresses via false headers.
\nThis issue affects only the oldstable distribution (Sarge).
For the old stable distribution (sarge) these problems have been fixed in\nversion 2.6.2-3sarge5.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 2.9.1.1-4.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.10.1-1.
\nWe recommend that you upgrade your phpmyadmin packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral vulnerabilities have been discovered in phpWiki, a wiki engine\nwritten in PHP. The Common Vulnerabilities and Exposures project\nidentifies the following problems:\n
\n\n It was discovered that phpWiki performs insufficient file name\n validation, which allows unrestricted file uploads.\n
\n It was discovered that phpWiki performs insufficient file name\n validation, which allows unrestricted file uploads.\n
\n If the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM,\n phpWiki might allow remote attackers to bypass authentication via\n an empty password, which causes ldap_bind to return true when used\n with certain LDAP implementations.\n
\nThe old stable distribution (sarge) does not contain phpwiki packages.\n
\n\nFor the stable distribution (etch) these problems have been fixed in\nversion 1.3.12p3-5etch1.\n
\n\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.3.12p3-6.1.\n
\n\nWe recommend that you upgrade your phpwiki package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAaron Plattner discovered a buffer overflow in the Composite extension\nof the X.org X server, which can lead to local privilege escalation.
\nThe oldstable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.1.1-21etch1.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your xorg-server packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that ktorrent, a BitTorrent client for KDE, was vulnerable\nto a directory traversal bug which potentially allowed remote users to\noverwrite arbitrary files.
\nFor the old stable distribution (sarge), this package was not present.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.0.3+dfsg1-2.2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n2.2.1.dfsg.1-1.
\nWe recommend that you upgrade your ktorrent package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in jffnms, a web-based\nNetwork Management System for IP networks. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\n\n Cross-site scripting (XSS) vulnerability in auth.php, which allows\n a remote attacker to inject arbitrary web script or HTML via the\n user
parameter.\n
\n Multiple SQL injection vulnerabilities in auth.php, which allow\n remote attackers to execute arbitrary SQL commands via the\n user
and pass
parameters.\n
\n Direct requests to URLs make it possible for remote attackers to\n access configuration information, bypassing login restrictions.\n
\n\nFor the stable distribution (etch), these problems have been fixed in version\n0.8.3dfsg.1-2.1etch1.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.8.3dfsg.1-4.\n
\n\nWe recommend that you upgrade your jffnms package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\nA heap overflow vulnerability has been discovered in the TIFF parsing\ncode of the OpenOffice.org suite. The parser uses untrusted values\nfrom the TIFF file to calculate the number of bytes of memory to\nallocate. A specially crafted TIFF image could trigger an integer\noverflow and subsequently a buffer overflow that could cause the\nexecution of arbitrary code.
\nFor the old stable distribution (sarge) this problem has been fixed in\nversion 1.1.3-9sarge8.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2.0.4.dfsg.2-7etch2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.1-9.
\nFor the experimental distribution this problem has been fixed in\nversion 2.3.0~src680m224-1.
\nWe recommend that you upgrade your openoffice.org packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\niKees Huijgen discovered that under certain circumstances KDM, an X\nsession manager for KDE, could be tricked into\nallowing user logins without a password.
\nFor the old stable distribution (sarge), this problem was not present.
\nFor the stable distribution (etch), this problem has been fixed in version\n4:3.5.5a.dfsg.1-6etch1.
\nWe recommend that you upgrade your kdebase package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMatthias Andree discovered that fetchmail, an SSL enabled POP3, APOP\nand IMAP mail gatherer/forwarder, can under certain circumstances\nattempt to dereference a NULL pointer and crash.
\nFor the old stable distribution (sarge), this problem was not present.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.3.6-1etch1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your fetchmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nEvan Teran discovered a potential local denial of service (oops) in\n the handling of PTRACE_SETREGS and PTRACE_SINGLESTEP requests.
Adam Litke reported a potential local denial of service (oops) on\n powerpc platforms resulting from unchecked VMA expansion into address\n space reserved for hugetlb pages.
Matt Keenan reported that CIFS filesystems with CAP_UNIX enabled\n were not honoring a process' umask which may lead to unintentionally\n relaxed permissions.
Wojciech Purczynski discovered a vulnerability that can be exploited\n by a local user to obtain superuser privileges on x86_64 systems.\n This resulted from improper clearing of the high bits of registers\n during ia32 system call emulation. This vulnerability is relevant\n to the Debian amd64 port as well as users of the i386 port who run\n the amd64 linux-image flavour.
Michael Stone reported an issue with the JFFS2 filesystem. Legacy\n modes for inodes that were created with POSIX ACL support enabled\n were not being written out to the medium, resulting in incorrect\n permissions upon remount.
These problems have been fixed in the stable distribution in version\n2.6.18.dfsg.1-13etch3.
\nThis advisory has been updated to include a build for the arm\narchitecture, which was not yet available at the time of DSA-1378-1.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch.13etch3 |
| user-mode-linux | 2.6.18-1um-2etch.13etch3 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn off-by-one error has been identified in the SSL_get_shared_ciphers()\nroutine in the libssl library from OpenSSL, an implementation of Secure\nSocket Layer cryptographic libraries and utilities. This error could\nallow an attacker to crash an application making use of OpenSSL's libssl\nlibrary, or potentially execute arbitrary code in the security context\nof the user running such an application.
\n\nFor the old stable distribution (sarge), this problem has been fixed in version\n0.9.7e-3sarge5.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.9.8c-4etch1.\n
\n\nFor the unstable and testing distributions (sid and lenny, respectively),\nthis problem has been fixed in version 0.9.8e-9.\n
\nWe recommend that you upgrade your openssl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKalle Olavi Niemitalo discovered that elinks, an advanced text-mode WWW\nbrowser, sent HTTP POST data in cleartext when using an HTTPS proxy server\npotentially allowing private information to be disclosed.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.11.1-1.2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n0.11.1-1.5.
\nWe recommend that you upgrade your elinks package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the Linux kernel\nthat may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\n The NT bit maybe leaked into the next task which can make it possible for local attackers\n to cause a Denial of Service (crash) on systems which run the amd64\n flavour kernel. The stable distribution (etch
) was not believed to\n be vulnerable to this issue at the time of release, however Bastian\n Blank discovered that this issue still applied to the xen-amd64 and\n xen-vserver-amd64 flavours, and is resolved by this DSA.
Hugh Dickins discovered a potential local DoS (panic) in hugetlbfs.\n A misconversion of hugetlb_vmtruncate_list to prio_tree may allow\n local users to trigger a BUG_ON() call in exit_mmap.
Wojciech Purczynski discovered a vulnerability that can be exploited\n by a local user to obtain superuser privileges on x86_64 systems.\n This resulted from improper clearing of the high bits of registers\n during ia32 system call emulation. This vulnerability is relevant\n to the Debian amd64 port as well as users of the i386 port who run\n the amd64 linux-image flavour.\n
\nDSA-1378 resolved this problem for the amd64 flavour kernels, but\n Tim Wickberg and Ralf Hemmenst\u00e4dt reported an outstanding issue with\n the xen-amd64 and xen-vserver-amd64 flavours that is resolved by\n this DSA.
Alex Smith discovered an issue with the pwc driver for certain webcam\n devices. If the device is removed while a userspace application has it\n open, the driver will wait for userspace to close the device, resulting\n in a blocked USB subsystem. This issue is of low security impact as\n it requires the attacker to either have physical access to the system\n or to convince users with local access to remove the device on their\n behalf.\n
\nThese problems have been fixed in the stable distribution in version\n2.6.18.dfsg.1-13etch4.
\nThis is an update to DSA-1381-1 which included only amd64 binaries for\nlinux-2.6. Builds for all other architectures are now available, as well as\nrebuilds of ancillary packages that make use of the included linux source.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch.13etch4 |
| kernel-patch-openvz | 028.18.1etch5 |
| user-mode-linux | 2.6.18-1um-2etch.13etch4 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nIt was discovered that BGP peers can trigger a NULL pointer dereference\nin the BGP daemon if debug logging is enabled, causing the BGP daemon to\ncrash.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 0.98.3-7.5.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.99.5-5etch3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.99.9-1.
\nWe recommend that you upgrade your quagga packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a cross site scripting vulnerability in GForge,\na collaborative development tool, allows remote attackers to inject\narbitrary web script or HTML in the context of a logged in user's session.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 3.1-31sarge3.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 4.5.14-22etch2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.6.99+svn6094-1.
\nWe recommend that you upgrade your gforge package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the Xen hypervisor\npackages which may lead to the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nBy use of a specially crafted grub configuration file a domU user\n may be able to execute arbitrary code upon the dom0 when pygrub is\n being used.
Multiple heap-based buffer overflows in the Cirrus VGA extension,\n provided by QEMU, may allow local users to execute arbitrary code\n via bitblt
heap overflow.
For the stable distribution (etch), these problems have been fixed in version\n3.0.3-0-3.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your xen-utils package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSean Larsson discovered that two code paths inside the X Font Server\nhandle integer values insecurely, which may lead to the execution of\narbitrary code.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 4.3.0.dfsg.1-14sarge5 of xfree86. Packages for m68k are not\nyet available. They will be provided later.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.0.1-7.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.5-1.
\nWe recommend that you upgrade your xfs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA problem has been discovered in the processing of chat messages.\nOverly long messages are truncated by the server to a fixed length,\nwithout paying attention to the multibyte characters. This leads to\ninvalid UTF-8 on clients and causes an uncaught exception. Note that\nboth wesnoth and the wesnoth server are affected.
\nFor the old stable distribution (sarge) this problem has been fixed in\nversion 0.9.0-6 and in version 1.2.7-1~bpo31+1 of sarge-backports.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.2-2 and in version 1.2.7-1~bpo40+1 of etch-backports.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.7-1.
\nPackages for the oldstable mips architecture will be added to the\narchive later.
\nWe recommend that you upgrade your wesnoth packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nIt has been discovered that the original patch for a buffer overflow in\nsvc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5\n(CVE-2007-3999,\nDSA-1368-1) was insufficient to protect from arbitrary\ncode execution in some environments.
\nThe old stable distribution (sarge) does not contain a librpcsecgss\npackage.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.14-2etch3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.14-4.
\nWe recommend that you upgrade your librpcsecgss package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe patch used to correct the DHCP server buffer overflow in DSA-1388-1\nwas incomplete and did not adequately resolve the problem. This update\nto the previous advisory makes updated packages based on a\nnewer version of the patch available.
\nFor completeness, please find below the original advisory:
\nIt was discovered that dhcp, a DHCP server for automatic IP address assignment,\ndidn't correctly allocate space for network replies. This could potentially\nallow a malicious DHCP client to execute arbitrary code upon the DHCP server.
\n\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.0pl5-19.5etch2.\n
\n\nFor the unstable distribution (sid), this problem will be fixed shortly.\n
\n\nUpdates to the old stable version (sarge) are pending.\n
\n\nWe recommend that you upgrade your dhcp packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that zoph, a web based photo management system,\nperforms insufficient input sanitising, which allows SQL injection.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 0.3.3-12sarge3.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.6-2.1etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.7.0.2-1.
\nWe recommend that you upgrade your zoph package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHamid Ebadi discovered a buffer overflow in the\nintT1_Env_GetCompletePath routine in t1lib, a Type 1 font rasterizer\nlibrary. This flaw could allow an attacker to crash an application\nusing the t1lib shared libraries, and potentially execute arbitrary code\nwithin such an application's security context.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 5.0.2-3sarge1.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.1.0-2etch1.
\nWe recommend that you upgrade your t1lib package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Icedove mail client,\nan unbranded version of the Thunderbird client. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nBernd Mielke, Boris Zbarsky, David Baron, Daniel Veditz, Jesse Ruderman,\n Lukas Loehrer, Martijn Wargers, Mats Palmgren, Olli Pettay, Paul\n Nickerson and Vladimir Sukhoy discovered crashes in the layout engine,\n which might allow the execution of arbitrary code.
Asaf Romano, Jesse Ruderman and Igor Bukanov discovered crashes in the\n JavaScript engine, which might allow the execution of arbitrary code.
moz_bug_r_a4
discovered that a regression in the handling of\n about:blank
windows used by addons may lead to an attacker being\n able to modify the content of web sites.
Jesper Johansson discovered that missing sanitising of double-quotes\n and spaces in URIs passed to external programs may allow an attacker\n to pass arbitrary arguments to the helper program if the user is\n tricked into opening a malformed web page.
L. David Baron, Boris Zbarsky, Georgi Guninski, Paul Nickerson, Olli Pettay,\n Jesse Ruderman, Vladimir Sukhoy, Daniel Veditz, and Martijn Wargers discovered\n crashes in the layout engine, which might allow the execution of arbitrary code.
Igor Bukanov, Eli Friedman, and Jesse Ruderman discovered crashes in the\n JavaScript engine, which might allow the execution of arbitrary code. Generally,\n enabling Javascript in Icedove is not recommended.
The Mozilla products in the oldstable distribution (sarge) are no longer\nsupported with security updates.
\nFor the stable distribution (etch) these problems have been fixed in version\n1.5.0.13+1.5.0.14b.dfsg1-0etch1. Builds for hppa will be provided later.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your icedove packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nMichal Zalewski discovered that the unload event handler had access to\n the address of the next page to be loaded, which could allow information\n disclosure or spoofing.
Stefano Di Paola discovered that insufficient validation of user names\n used in Digest authentication on a web site allows HTTP response splitting\n attacks.
It was discovered that insecure focus handling of the file upload\n control can lead to information disclosure. This is a variant of\n CVE-2006-2894.
Eli Friedman discovered that web pages written in Xul markup can hide the\n titlebar of windows, which can lead to spoofing attacks.
Georgi Guninski discovered the insecure handling of smb:// and sftp:// URI\n schemes may lead to information disclosure. This vulnerability is only\n exploitable if Gnome-VFS support is present on the system.
moz_bug_r_a4
discovered that the protection scheme offered by XPCNativeWrappers\n could be bypassed, which might allow privilege escalation.
L. David Baron, Boris Zbarsky, Georgi Guninski, Paul Nickerson, Olli Pettay,\n Jesse Ruderman, Vladimir Sukhoy, Daniel Veditz, and Martijn Wargers discovered\n crashes in the layout engine, which might allow the execution of arbitrary code.
Igor Bukanov, Eli Friedman, and Jesse Ruderman discovered crashes in the\n JavaScript engine, which might allow the execution of arbitrary code.
The oldstable distribution (sarge) doesn't contain xulrunner.
\nFor the stable distribution (etch) these problems have been fixed in version\n1.8.0.14~pre071019b-0etch1. Builds for hppa and mipsel will be provided later.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that xfce-terminal, a terminal emulator for the xfce\nenvironment, did not correctly escape arguments passed to the processes\nspawned by Open Link
. This allowed malicious links to execute arbitrary\ncommands upon the local system.
For the stable distribution (etch), this problem has been fixed in version\n0.2.5.6rc1-2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n0.2.6-3.
\nWe recommend that you upgrade your xfce4-terminal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that reprepro, a tool to create a repository of Debian\npackages, only checks the validity of known signatures when updating\nfrom a remote site, and thus does not reject packages with only unknown\nsignatures. This allows an attacker to bypass this authentication\nmechanism.
\nThe oldstable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.3.1+1-1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.4-1.
\nWe recommend that you upgrade your reprepro package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered that xen-utils,\na collection of XEN administrative tools, used temporary files insecurely\nwithin the xenmon tool allowing local users to truncate arbitrary files.
\nFor the old stable distribution (sarge) this package was not present.
\nFor the stable distribution (etch) this problem has been fixed in version\n3.0.3-0-4.
\nFor the unstable distribution (sid) this problem will be fixed soon.
\nWe recommend that you upgrade your xen-3.0 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel web\nbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:\n
\n\n Michal Zalewski discovered that the unload event handler had access to\n the address of the next page to be loaded, which could allow information\n disclosure or spoofing.\n
\n Stefano Di Paola discovered that insufficient validation of user names\n used in Digest authentication on a web site allows HTTP response splitting\n attacks.
\n\n It was discovered that insecure focus handling of the file upload\n control can lead to information disclosure. This is a variant of\n CVE-2006-2894.\n
\n Eli Friedman discovered that web pages written in Xul markup can hide the\n titlebar of windows, which can lead to spoofing attacks.\n
\n Georgi Guninski discovered the insecure handling of smb:// and sftp:// URI\n schemes may lead to information disclosure. This vulnerability is only\n exploitable if Gnome-VFS support is present on the system.\n
\nmoz_bug_r_a4
discovered that the protection scheme offered by XPCNativeWrappers\n could be bypassed, which might allow privilege escalation.\n
\n L. David Baron, Boris Zbarsky, Georgi Guninski, Paul Nickerson, Olli Pettay,\n Jesse Ruderman, Vladimir Sukhoy, Daniel Veditz, and Martijn Wargers discovered\n crashes in the layout engine, which might allow the execution of arbitrary code.\n
\n Igor Bukanov, Eli Friedman, and Jesse Ruderman discovered crashes in the\n JavaScript engine, which might allow the execution of arbitrary code.
\nThe Mozilla products in the oldstable distribution (sarge) are no longer\nsupported with security updates.\n
\n\nFor the stable distribution (etch) these problems have been fixed in version\n2.0.0.6+2.0.0.8-0etch1. Builds for arm and sparc will be provided later.\n
\n\nFor the unstable distribution (sid) these problems have been fixed in version\n2.0.0.8-1.\n
\n\nWe recommend that you upgrade your iceweasel packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nAn integer overflow in the BigInteger data type implementation has been\ndiscovered in the free .NET runtime Mono.\n
\n\nThe oldstable distribution (sarge) doesn't contain mono.\n
\n\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.2.2.1-1etch1. A powerpc build will be provided later.\n
\n\nThe unstable distribution (sid) will be fixed soon.\n
\n\nWe recommend that you upgrade your mono packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nBernhard Mueller of SEC Consult has discovered a format string\nvulnerability in perdition, an IMAP proxy. This vulnerability could\nallow an unauthenticated remote user to run arbitrary code on the\nperdition server by providing a specially formatted IMAP tag.\n
\n\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 1.15-5sarge1.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.17-7etch1.\n
\n\nWe recommend that you upgrade your perdition package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nTavis Ormandy of the Google Security Team has discovered several\nsecurity issues in PCRE, the Perl-Compatible Regular Expression library,\nwhich potentially allow attackers to execute arbitrary code by compiling\nspecially crafted regular expressions.\n
\n\nVersion 7.0 of the PCRE library featured a major rewrite of the regular\nexpression compiler, and it was deemed infeasible to backport the\nsecurity fixes in version 7.3 to the versions in Debian's stable and\noldstable distributions (6.7 and 4.5, respectively). Therefore, this\nupdate is based on version 7.4 (which includes the security bug fixes of\nthe 7.3 version, plus several regression fixes), with special patches to\nimprove the compatibility with the older versions. As a result, extra\ncare is necessary when applying this update.\n
\n\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:\n
\n\n Unmatched \\Q\\E sequences with orphan \\E codes can cause the compiled\n regex to become desynchronized, resulting in corrupt bytecode that may\n result in multiple exploitable conditions.\n
\n Multiple forms of character classes had their sizes miscalculated on\n initial passes, resulting in too little memory being allocated.\n
\n Multiple patterns of the form \\X?\\d or \\P{L}?\\d in non-UTF-8 mode\n could backtrack before the start of the string, possibly leaking\n information from the address space, or causing a crash by reading out\n of bounds.\n
\n A number of routines can be fooled into reading past the end of a\n string looking for unmatched parentheses or brackets, resulting in a\n denial of service.\n
\n Multiple integer overflows in the processing of escape sequences could\n result in heap overflows or out of bounds reads/writes.\n
\n Multiple infinite loops and heap overflows were discovered in the\n handling of \\P and \\P{x} sequences, where the length of these\n non-standard operations was mishandled.\n
\n Character classes containing a lone unicode sequence were incorrectly\n optimised, resulting in a heap overflow.\n
\nFor the old stable distribution (sarge), these problems have been fixed in\nversion 4.5+7.4-1.\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 6.7+7.4-2.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 7.3-1.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nWill Drewry and Tavis Ormandy of the Google Security Team have\ndiscovered a UTF-8 related heap overflow in Perl's regular expression\ncompiler, probably allowing attackers to execute arbitrary code by\ncompiling specially crafted regular expressions.\n
\n\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 5.8.4-8sarge6.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.8.8-7etch1.\n
\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n
\n\nSome architectures are missing from this DSA; these updates will be\nreleased once they are available.\n
\n\nWe recommend that you upgrade your perl package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceape internet\nsuite, an unbranded version of the Seamonkey Internet Suite. The Common\nVulnerabilities and Exposures project identifies the following problems:\n
\n\n Michal Zalewski discovered that the unload event handler had access to\n the address of the next page to be loaded, which could allow information\n disclosure or spoofing.\n
\n Stefano Di Paola discovered that insufficient validation of user names\n used in Digest authentication on a web site allows HTTP response splitting\n attacks.\n
\n It was discovered that insecure focus handling of the file upload\n control can lead to information disclosure. This is a variant of\n CVE-2006-2894.\n
\n Eli Friedman discovered that web pages written in Xul markup can hide the\n titlebar of windows, which can lead to spoofing attacks.\n
\n Georgi Guninski discovered the insecure handling of smb:// and sftp:// URI\n schemes may lead to information disclosure. This vulnerability is only\n exploitable if Gnome-VFS support is present on the system.\n
\nmoz_bug_r_a4
discovered that the protection scheme offered by XPCNativeWrappers\n could be bypassed, which might allow privilege escalation.\n
\n L. David Baron, Boris Zbarsky, Georgi Guninski, Paul Nickerson, Olli Pettay,\n Jesse Ruderman, Vladimir Sukhoy, Daniel Veditz, and Martijn Wargers discovered\n crashes in the layout engine, which might allow the execution of arbitrary code.\n
\n Igor Bukanov, Eli Friedman, and Jesse Ruderman discovered crashes in the\n JavaScript engine, which might allow the execution of arbitrary code.\n
\nThe Mozilla products in the oldstable distribution (sarge) are no longer\nsupported with security updates.\n
\n\nFor the stable distribution (etch) these problems have been fixed in version\n1.0.11~pre071022-0etch1.\n
\n\nFor the unstable distribution (sid) these problems have been fixed in version\n1.1.5-1.\n
\n\nWe recommend that you upgrade your iceape packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered that gforge,\na collaborative development tool, used temporary files insecurely which\ncould allow local users to truncate files upon the system with the privileges\nof the gforge user, or create a denial of service attack.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 3.1-31sarge4.
\nFor the stable distribution (etch), this problem has been fixed in version\n4.5.14-22etch3.
\nWe recommend that you upgrade your gforge package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nOmer Singer of the DigiTrust Group discovered several vulnerabilities in\nphpMyAdmin, an application to administrate MySQL over the WWW. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nphpMyAdmin allows a remote attacker to inject arbitrary web script\n or HTML in the context of a logged in user's session (cross site\n scripting).
phpMyAdmin, when accessed by a browser that does not URL-encode\n requests, allows remote attackers to inject arbitrary web script\n or HTML via the query string.
For the old stable distribution (sarge) this problem has been fixed in\nversion 4:2.6.2-3sarge6.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 4:2.9.1.1-6.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4:2.11.1.2-1.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNicklous Roberts discovered that the Reupload module of Gallery 2, a web\nbased photo management application, allowed unauthorized users to edit\nGallery's data file.
\nThe oldstable distribution (sarge) does not contain a gallery2 package.\nThe previous gallery package is not affected by this vulnerability.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2.1.2-2.0.etch.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.2.3-1.
\nWe recommend that you upgrade your gallery2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Plone, a web content management system, allows\nremote attackers to execute arbitrary code via specially crafted web\nbrowser cookies.
\nThe oldstable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2.5.1-4etch3.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.5.2-3.
\nWe recommend that you upgrade your zope-cmfplone package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in the Horde web\napplication framework. The Common Vulnerabilities and Exposures project\nidentifies the following problems:\n
\n\n Moritz Naumann discovered that Horde allows remote attackers\n to inject arbitrary web script or HTML in the context of a logged\n in user (cross site scripting).\n
\n\n This vulnerability applies to oldstable (sarge) only.\n
\n\n Moritz Naumann discovered that Horde does not properly restrict\n its image proxy, allowing remote attackers to use the server as a\n proxy.\n
\n\n This vulnerability applies to oldstable (sarge) only.\n
\n\n Marc Ruef discovered that Horde allows remote attackers to\n include web pages from other sites, which could be useful for\n phishing attacks.\n
\n\n This vulnerability applies to oldstable (sarge) only.\n
\n\n Moritz Naumann discovered that Horde allows remote attackers\n to inject arbitrary web script or HTML in the context of a logged\n in user (cross site scripting).\n
\n\n This vulnerability applies to both stable (etch) and oldstable (sarge).\n
\n\n iDefense discovered that the cleanup cron script in Horde\n allows local users to delete arbitrary files.\n
\n\n This vulnerability applies to oldstable (sarge) only.\n
\n\nFor the old stable distribution (sarge) these problems have been fixed in\nversion 3.0.4-4sarge6.\n
\n\nFor the stable distribution (etch) these problems have been fixed in\nversion 3.1.3-4etch1.\n
\n\nFor the unstable distribution (sid) these problems have been fixed in\nversion 3.1.4-1.\n
\n\nWe recommend that you upgrade your horde3 package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nAlin Rad Pop discovered that the Common UNIX Printing System is\nvulnerable to an off-by-one buffer overflow in the code to process IPP\npackets, which may lead to the execution of arbitrary code.\n
\n\nThe cupsys version in the old stable distribution (sarge) is not\nvulnerable to arbitrary code execution.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.2.7-4etch1. Updated packages for the arm architecture will be\nprovided later.\n
\n\nWe recommend that you upgrade your cupsys packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlin Rad Pop discovered a buffer overflow in kpdf, which could allow\nthe execution of arbitrary code if a malformed PDF file is displayed.
\nThe old stable distribution (sarge) will be fixed later.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 4:3.5.5-3etch2. Builds for arm and sparc are not yet available.
\nWe recommend that you upgrade your kdegraphics packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThis update fixes all currently known regressions introduced with\nthe previous two revisions of DSA-1409.\nThe original text is reproduced below:
\n\n\nSeveral local/remote vulnerabilities have been discovered in samba,\na LanManager-like file and printer server for Unix. The Common\nVulnerabilities and Exposures project identifies the following problems:
\n\n
\n- CVE-2007-5398\n
\nAlin Rad Pop of Secunia Research discovered that nmbd did not properly\n check the length of netbios packets. When samba is configured as a WINS\n server, a remote attacker could send multiple crafted requests resulting\n in the execution of arbitrary code with root privileges.
\n- CVE-2007-4572\n
\nSamba developers discovered that nmbd could be made to overrun a buffer\n during the processing of GETDC logon server requests. When samba is\n configured as a Primary or Backup Domain Controller, a remote attacker\n could send malicious logon requests and possibly cause a denial of\n service.
\n
For the old stable distribution (sarge), these problems have been fixed in\nversion 3.0.14a-3sarge10.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 3.0.24-6etch8.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.0.27-1.
\nWe recommend that you upgrade your samba packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Ruby, an object-oriented\nscripting language. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that the Ruby HTTP(S) module performs insufficient\n validation of SSL certificates, which may lead to man-in-the-middle\n attacks.
It was discovered that the Ruby modules for FTP, Telnet, IMAP, POP\n and SMTP perform insufficient validation of SSL certificates, which\n may lead to man-in-the-middle attacks.
For the old stable distribution (sarge) these problems have been fixed\nin version 1.8.2-7sarge6. Packages for sparc will be provided later.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 1.8.5-4etch1. Packages for sparc will be provided later.
\nWe recommend that you upgrade your ruby1.8 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Ruby, an object-oriented\nscripting language. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that the Ruby HTTP(S) module performs insufficient\n validation of SSL certificates, which may lead to man-in-the-middle\n attacks.
It was discovered that the Ruby modules for FTP, Telnet, IMAP, POP\n and SMTP perform insufficient validation of SSL certificates, which\n may lead to man-in-the-middle attacks.
For the old stable distribution (sarge) these problems have been fixed\nin version 0.1.4a-1sarge1. Packages for sparc will be provided later.
\nThe stable distribution (etch) no longer contains libopenssl-ruby.
\nWe recommend that you upgrade your libopenssl-ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Ruby, an object-oriented\nscripting language. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that the Ruby HTTP(S) module performs insufficient\n validation of SSL certificates, which may lead to man-in-the-middle\n attacks.
It was discovered that the Ruby modules for FTP, Telnet, IMAP, POP\n and SMTP perform insufficient validation of SSL certificates, which\n may lead to man-in-the-middle attacks.
The old stable distribution (sarge) doesn't contain ruby1.9 packages.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 1.9.0+20060609-1etch1. Updated packages for hppa and sparc will\nbe provided later.
\nWe recommend that you upgrade your ruby1.9 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in the MySQL database packages\nwith implications ranging from unauthorized database modifications to\nremotely triggered server crashes. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nThe in_decimal::set function in item_cmpfunc.cc in MySQL\n\tbefore 5.0.40 allows context-dependent attackers to cause a\n\tdenial of service (crash) via a crafted IF clause that results\n\tin a divide-by-zero error and a NULL pointer dereference.\n\t(Affects source version 5.0.32.)
MySQL does not require the DROP privilege for RENAME TABLE\n\tstatements, which allows remote authenticated users to rename\n\tarbitrary tables. (All supported versions affected.)
The mysql_change_db function does not restore THD::db_access\n\tprivileges when returning from SQL SECURITY INVOKER stored\n\troutines, which allows remote authenticated users to gain\n\tprivileges. (Affects source version 5.0.32.)
MySQL could be made to overflow a signed char during\n\tauthentication. Remote attackers could use specially crafted\n\tauthentication requests to cause a denial of\n\tservice. (Upstream source versions 4.1.11a and 5.0.32\n\taffected.)
Phil Anderton discovered that MySQL did not properly verify\n\taccess privileges when accessing external tables. As a result,\n\tauthenticated users could exploit this to obtain UPDATE\n\tprivileges to external tables. (Affects source version\n\t5.0.32.)
The convert_search_mode_to_innobase function in ha_innodb.cc\n\tin the InnoDB engine in MySQL 5.1.23-BK and earlier allows\n\tremote authenticated users to cause a denial of service\n\t(database crash) via a certain CONTAINS operation on an\n\tindexed column, which triggers an assertion error. (Affects\n\tsource version 5.0.32.)
For the old stable distribution (sarge), these problems have been fixed in\nversion 4.0.24-10sarge3 of mysql-dfsg and version 4.1.11a-4sarge8 of\nmysql-dfsg-4.1.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 5.0.32-7etch3 of the mysql-dfsg-5.0 packages.
\nWe recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Wireshark\nnetwork traffic analyzer, which may lead to denial of service or\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nStefan Esser discovered a buffer overflow in the SSL dissector.\n Fabiodds
discovered a buffer overflow in the iSeries trace\n dissector.
A programming error was discovered in the HTTP dissector, which may\n lead to denial of service.
The MEGACO dissector could be tricked into resource exhaustion.
The Bluetooth SDP dissector could be tricked into an endless loop.
The RPC portmap dissector could be tricked into dereferencing\n a NULL pointer.
For the old stable distribution (sarge), these problems have been\nfixed in version 0.10.10-2sarge10. (In Sarge Wireshark used to be\ncalled Ethereal). Updated packages for sparc and m68k will be provided\nlater.
\nFor the stable distribution (etch), these problems have been fixed\nin version 0.99.4-5.etch.1. Updated packages for sparc will be provided\nlater.
\nWe recommend that you upgrade your wireshark/ethereal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Tk, a cross-platform graphical toolkit for Tcl,\nperforms insufficient input validation in the code used to load GIF\nimages, which may lead to the execution of arbitrary code.
\nFor the old stable distribution (sarge), this problem has been fixed\nin version 8.4.9-1sarge1.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 8.4.12-1etch1.
\nWe recommend that you upgrade your tk8.4 packages. Updated packages for\nsparc will be provided later.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Tk, a cross-platform graphical toolkit for Tcl,\nperforms insufficient input validation in the code used to load GIF\nimages, which may lead to the execution of arbitrary code.
\nDue to the technical limitation in the Debian archive scripts the update\nfor the old stable distribution (sarge) cannot be released in sync with\nthe update for the stable distribution. It will be provided in the next\ndays.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 8.3.5-6etch1.
\nWe recommend that you upgrade your tk8.3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTilghman Lesher discovered that the logging engine of Asterisk, a free\nsoftware PBX and telephony toolkit, performs insufficient sanitising of\ncall-related data, which may lead to SQL injection.
\nFor the old stable distribution (sarge), this problem has been fixed\nin version 1:1.0.7.dfsg.1-2sarge6.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1:1.2.13~dfsg-2etch2. Updated packages for ia64 will be provided\nlater.
\nWe recommend that you upgrade your asterisk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Cacti, a tool to monitor systems and networks,\nperforms insufficient input sanitising, which allows SQL injection.
\nFor the oldstable distribution (sarge) this problem has been fixed in\nversion 0.8.6c-7sarge5.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.8.6i-3.2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.8.7a-1.
\nWe recommend that you upgrade your cacti package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in HSQLDB, the default database\nengine shipped with OpenOffice.org. This could result in the\nexecution of arbitrary Java code embedded in a OpenOffice.org database\ndocument with the user's privilege. This update requires an update of\nboth openoffice.org and hsqldb.
\nThe old stable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2.0.4.dfsg.2-7etch4 of OpenOffice.org and in version\n1.8.0.7-1etch1 of hsqldb.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.3.1-1 of OpenOffice.org and in version 1.8.0.9-2 of hsqldb.
\nFor the experimental distribution this problem has been fixed in\nversion 2.3.1~rc1-1 of OpenOffice.org and in version 1.8.0.9-1 of\nhsqldb.
\nWe recommend that you upgrade your OpenOffice.org and hsqldb packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nBas van Schaik discovered that the agentd process of Zabbix, a network\nmonitor system, may run user-supplied commands as group id root, not\nzabbix, which may lead to a privilege escalation.\n
\n\nzabbix is not included in the oldstable distribution (sarge).\n
\n\nFor the stable distribution (etch), this problem has been fixed in version\n1:1.1.4-10etch1.\n
\n\nWe recommend that you upgrade your zabbix packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in Battle for Wesnoth that allows\nremote attackers to read arbitrary files the user running the client\nhas access to on the machine running the game client.
\nFor the old stable distribution (sarge) this problem has been fixed in\nversion 0.9.0-7.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.2-3.
\nFor the stable backports distribution (etch-backports) this problem\nhas been fixed in version 1.2.8-1~bpo40+1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.2.8-1.
\nFor the experimental distribution this problem has been fixed in\nversion 1.3.12-1.
\nWe recommend that you upgrade your wesnoth package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRafal Wojtczuk of McAfee AVERT Research discovered that e2fsprogs, the\next2 file system utilities and libraries, contained multiple\ninteger overflows in memory allocations, based on sizes taken directly\nfrom filesystem information. These could result in heap-based\noverflows potentially allowing the execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.39+1.40-WIP-2006.11.14+dfsg-2etch1.
\nFor the unstable distribution (sid), this problem will be fixed shortly.
\nWe recommend that you upgrade your e2fsprogs package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in sitebar, a\nweb based bookmark manager written in PHP. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nA directory traversal vulnerability in the translation module allows\n remote authenticated users to chmod arbitrary files to 0777 via ..
\n sequences in the lang
parameter.
A static code injection vulnerability in the translation module allows\n a remote authenticated user to execute arbitrary PHP code via the value
\n parameter.
An eval injection vulnerability in the translation module allows\n remote authenticated users to execute arbitrary PHP code via the\n edit
parameter in an upd cmd
action.
A path traversal vulnerability in the translation module allows\n remote authenticated users to read arbitrary files via an absolute\n path in the dir
parameter.
An error in command.php allows remote attackers to redirect users\n to arbitrary web sites via the forward
parameter in a Log In
action.
Multiple cross site scripting flaws allow remote attackers to inject\n arbitrary script or HTML fragments into several scripts.
For the old stable distribution (sarge), these problems have been fixed in\nversion 3.2.6-7.1sarge1.
\nFor the stable distribution (etch), these problems have been fixed in version\n3.3.8-7etch1.
\nFor the unstable distribution (sid), these problems have been fixed in version\n3.3.8-12.1.
\nWe recommend that you upgrade your sitebar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel web\nbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nJesse Ruderman and Petko D. Petkov discovered that the URI handler\n for JAR archives allows cross-site scripting.
Several crashes in the layout engine were discovered, which might\n allow the execution of arbitrary code.
Gregory Fleischer discovered a race condition in the handling of\n the window.location
property, which might lead to cross-site\n request forgery.
The Mozilla products in the oldstable distribution (sarge) are no longer\nsupported with security updates.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 2.0.0.10-0etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.0.0.10-2.
\nWe recommend that you upgrade your iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nJesse Ruderman and Petko D. Petkov discovered that the URI handler\n for JAR archives allows cross-site scripting.
Several crashes in the layout engine were discovered, which might\n allow the execution of arbitrary code.
Gregory Fleischer discovered a race condition in the handling of\n the window.location
property, which might lead to cross-site\n request forgery.
The oldstable distribution (sarge) doesn't contain xulrunner.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 1.8.0.14~pre071019c-0etch1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.8.1.11-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local/remote vulnerabilities have been discovered in the Qt GUI\nlibrary. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nTim Brown and Dirk M\u00fcller discovered several format string\n vulnerabilities in the handling of error messages, which might lead\n to the execution of arbitrary code.
Dirk M\u00fcller discovered an off-by-one buffer overflow in the Unicode\n handling, which might lead to the execution of arbitrary code.
For the old stable distribution (sarge), these problems have been fixed\nin version 3:3.3.4-3sarge3. Packages for m68k will be provided later.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 3:3.3.7-4etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3:3.3.7-8.
\nWe recommend that you upgrade your qt-x11-free packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nAlin Rad Pop discovered that Samba, a LanManager-like file and printer server\nfor Unix, is vulnerable to a buffer overflow in the nmbd code which handles\nGETDC mailslot requests, which might lead to the execution of arbitrary code.\n
\n\nFor the old stable distribution (sarge), this problem has been fixed in version\n3.0.14a-3sarge11. Packages for m68k will be provided later.\n
\n\nFor the stable distribution (etch), this problem has been fixed in version\n3.0.24-6etch9.\n
\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n
\n\nWe recommend that you upgrade your samba packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nThis is an update to DSA 1428-1 which omitted a reference to CVE-2007-5904.
\nEric Sandeen provided a backport of Tejun Heo's fix for a local denial\n of service vulnerability in sysfs. Under memory pressure, a dentry\n structure maybe reclaimed resulting in a bad pointer dereference causing\n an oops during a readdir.
Chris Evans discovered an issue with certain drivers that make use of the\n Linux kernel's ieee80211 layer. A remote user could generate a malicious\n 802.11 frame that could result in a denial of service (crash). The ipw2100\n driver is known to be affected by this issue, while the ipw2200 is\n believed not to be.
Scott James Remnant diagnosed a coding error in the implementation of\n ptrace which could be used by a local user to cause the kernel to enter\n an infinite loop.
Przemyslaw Wegrzyn discovered an issue in the CIFS filesystem that could\n allow a malicious server to cause a denial of service (crash) by overflowing\n a buffer.
These problems have been fixed in the stable distribution in version\n2.6.18.dfsg.1-13etch5.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch.13etch5 |
| user-mode-linux | 2.6.18-1um-2etch.13etch5 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Skibbe discovered that htdig, a WWW search system for an intranet\nor small internet, did not adequately quote values submitted to the search\nscript, allowing remote attackers to inject arbitrary script or HTML\ninto specially crafted links.
\nFor the old stable distribution (sarge), this problem was not present.
\nFor the stable distribution (etch), this problem has been fixed in version\n1:3.2.0b6-3.1etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n1:3.2.0b6-4.
\nWe recommend that you upgrade your htdig package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was reported that a race condition exists in libnss-ldap, an\nNSS module for using LDAP as a naming service, which could cause\ndenial of service attacks if applications use pthreads.
\nThis problem was spotted in the dovecot IMAP/POP server but\npotentially affects more programs.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 238-1sarge1.
\nFor the stable distribution (etch), this problem has been fixed in version\n251-7.5etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 256-1.
\nWe recommend that you upgrade your libnss-ldap package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that ruby-gnome2, the GNOME-related bindings for the Ruby\nlanguage, didn't properly sanitize input prior to constructing dialogs.\nThis could allow the execution of arbitrary code if untrusted input\nis displayed within a dialog.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 0.12.0-2sarge1.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.15.0-1.1etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.16.0-10.
\nWe recommend that you upgrade your ruby-gnome2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlin Rad Pop discovered that link-grammar, Carnegie Mellon University's\nlink grammar parser for English, performed insufficient validation within\nits tokenizer, which could allow a malicious input file to execute\narbitrary code.
\nFor the old stable distribution (sarge), this package is not present.
\nFor the stable distribution (etch), this problem has been fixed in version\n4.2.2-4etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n4.2.5-1.
\nWe recommend that you upgrade your link-grammar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in centericq,\na text-mode multi-protocol instant messenger client, which could allow\nremote attackers to execute arbitrary code due to insufficient bounds-testing.\n
\n\nFor the old stable distribution (sarge) these problems have been fixed in\nversion 4.20.0-1sarge5.\n
\n\nFor the stable distribution (etch) these problems have been fixed in version\n4.21.0-18etch1.\n
\n\nWe recommend that you upgrade your centericq package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that in MyDNS, a domain name server with database\nbackend, the daemon could be crashed through malicious remote update\nrequests, which may lead to denial of service.\n
\n\nThe old stable distribution (sarge) is not affected.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1:1.1.0-7etch1.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.0-8.\n
\nWe recommend that you upgrade your mydns packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Clam\nanti-virus toolkit. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that an integer overflow in the decompression code\n for MEW archives may lead to the execution of arbitrary code.
It was discovered that on off-by-one in the MS-ZIP decompression\n code may lead to the execution of arbitrary code.
The old stable distribution (sarge) is not affected by these problems.\nHowever, since the clamav version from Sarge cannot process all current\nClam malware signatures any longer, support for the ClamAV in Sarge is\nnow discontinued. We recommend to upgrade to the stable distribution\nor run a backport of the stable version.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 0.90.1-3etch8.
\nFor the unstable distribution (sid) these problems will be fixed soon.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the Linux kernel\nthat may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nLMH reported an issue in the minix filesystem that allows local users\n with mount privileges to create a DoS (printk flood) by mounting a\n specially crafted corrupt filesystem.
Warren Togami discovered an issue in the hrtimer subsystem that allows\n a local user to cause a DoS (soft lockup) by requesting a timer sleep\n for a long period of time leading to an integer overflow.
Venustech AD-LAB discovered a buffer overflow in the isdn ioctl\n handling, exploitable by a local user.
Blake Frantz discovered that when a core file owned by a non-root user\n exists, and a root-owned process dumps core over it, the core file\n retains its original ownership. This could be used by a local user to\n gain access to sensitive information.
Hugh Dickins discovered an issue in the tmpfs filesystem where, under\n a rare circumstance, a kernel page may be improperly cleared, leaking\n sensitive kernel memory to userspace or resulting in a DoS (crash).
These problems have been fixed in the stable distribution in version\n2.6.18.dfsg.1-13etch6.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch.13etch6 |
| user-mode-linux | 2.6.18-1um-2etch.13etch6 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral local vulnerabilities have been discovered in the Common UNIX Printing\nSystem. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:\n
\n\n Wei Wang discovered that an buffer overflow in the SNMP backend may lead to\n the execution of arbitrary code.\n
\n Elias Pipping discovered that insecure handling of a temporary file in the\n pdftops.pl script may lead to local denial of service. This vulnerability\n is not exploitable in the default configuration.\n
\nThe old stable distribution (sarge) is not affected by CVE-2007-5849.\nThe other issue doesn't warrant an update on it's own and has been\npostponed.\n
\n\nFor the stable distribution (etch), these problems have been fixed in version\n1.2.7-4etch2.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in version\n1.3.5-1.\n
\n\nWe recommend that you upgrade your cupsys packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral vulnerabilities have been discovered in GNU Tar. The Common\nVulnerabilities and Exposures project identifies the following problems:\n
\n\n A directory traversal vulnerability enables attackers using\n specially crafted archives to extract contents outside the\n directory tree created by tar.\n
\n A stack-based buffer overflow in the file name checking code may\n lead to arbitrary code execution when processing maliciously\n crafted archives.\n
\nFor the old stable distribution (sarge), these problems have been\nfixed in version 1.14-2.4.\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.16-2etch1.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.18-2.\n
\n\nWe recommend that you upgrade your tar package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nHenning Pingel discovered that TYPO3, a web content management framework,\nperforms insufficient input sanitising, making it vulnerable to SQL\ninjection by logged-in backend users.\n
\n\nThe old stable distribution (sarge) doesn't contain typo3-src.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 4.0.2+debian-4.\n
\n\nFor the unstable distribution (sid) and for the testing distribution\n(lenny), this problem has been fixed in version 4.1.5-1.\n
\n\nWe recommend that you upgrade your typo3-src packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that a buffer overflow in the filename processing of\nthe inotify-tools, a command-line interface to inotify, may lead to\nthe execution of arbitrary code. This only affects the internal\nlibrary and none of the frontend tools shipped in Debian.\n
\n\nThe old stable distribution (sarge) does not provide inotify-tools.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 3.3-2.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.11-1.\n
\n\nWe recommend that you upgrade your inotify-tools package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nLuigi Auriemma discovered that PeerCast, a P2P audio and video streaming\nserver, is vulnerable to a heap overflow in the HTTP server code, which\nallows remote attackers to cause a denial of service and possibly execute\narbitrary code via a long SOURCE request.\n
\n\nThe old stable distribution (sarge) does not contain peercast.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.1217.toots.20060314-1etch0.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.1218+svn20071220+2.\n
\n\nWe recommend that you upgrade your peercast packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nRubert Buchholz discovered that libsndfile, a library for reading /\nwriting audio files, performs insufficient boundary checks when\nprocessing FLAC files, which might lead to the execution of arbitrary\ncode.\n
\n\nThe old stable distribution (sarge) is not affected by this problem.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.0.16-2.\n
\n\nWe recommend that you upgrade your libsndfile packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that several buffer overflows in tcpreen, a tool for\nmonitoring a TCP connection, may lead to denial of service.\n
\n\nThe old stable distribution (sarge) doesn't contain tcpreen.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.4.3-0.1etch1.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.4.3-0.3.\n
\n\nWe recommend that you upgrade your tcpreen package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that the patch for CVE-2007-4659 could lead to\nregressions in some scenarios. The fix has been reverted for now,\na revised update will be provided in a future PHP DSA.\n
\nFor reference the original advisory below:
\n\nSeveral remote vulnerabilities have been discovered in PHP, a\nserver-side, HTML-embedded scripting language. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:\n
\n\n It was discovered that the session_start() function allowed the\n insertion of attributes into the session cookie.\n
\n Mattias Bengtsson and Philip Olausson discovered that a\n programming error in the implementation of the wordwrap() function\n allowed denial of service through an infinite loop.\n
\n Stanislav Malyshev discovered that a format string vulnerability\n in the money_format() function could allow the execution of\n arbitrary code.\n
\n Stefan Esser discovered that execution control flow inside the\n zend_alter_ini_entry() function is handled incorrectly in case\n of a memory limit violation.\n
\n Gerhard Wagner discovered an integer overflow inside the\n chunk_split() function.\n
\n Rasmus Lerdorf discovered that incorrect parsing of multibyte\n sequences may lead to disclosure of memory contents.\n
\n It was discovered that the output_add_rewrite_var() function could\n leak session ID information, resulting in information disclosure.\n
\nThis update also fixes two bugs from the PHP 5.2.4 release which\ndon't have security impact according to the Debian PHP security policy\n(CVE-2007-4657 and CVE-2007-4662), but which are fixed nonetheless.\n
\n\nThe old stable distribution (sarge) doesn't contain php5.\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 5.2.0-8+etch10.\n
\n\nFor the unstable distribution (sid), these problems have been fixed\nin version 5.2.4-1, with the exception of CVE-2007-5898 and\nCVE-2007-5899, which will be fixed soon. Please note that Debian's\nversion of PHP is hardened with the Suhosin patch beginning with\nversion 5.2.4-1, which renders several vulnerabilities ineffective.\n
\n\nWe recommend that you upgrade your php5 packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nMichael Krieger and Sam Trenholme discovered a programming error in\nMaraDNS, a simple security-aware Domain Name Service server, which\nmight lead to denial of service through malformed DNS packets.\n
\n\nFor the old stable distribution (sarge), this problem has been fixed\nin version 1.0.27-2.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.2.12.04-1etch2.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.2.12.08-1.\n
\n\nWe recommend that you upgrade your maradns package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in the Wireshark\nnetwork traffic analyzer, which may lead to denial of service. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:\n
\n\n The RPL dissector could be tricked into an infinite loop.\n
\n The CIP dissector could be tricked into excessive memory\n allocation.\n
\nFor the old stable distribution (sarge), these problems have been fixed in\nversion 0.10.10-2sarge11. (In Sarge Wireshark used to be called Ethereal).\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.99.4-5.etch.2.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.99.7-1.\n
\n\nWe recommend that you upgrade your wireshark packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in the Tomcat\nservlet and JSP engine. The Common Vulnerabilities and Exposures project\nidentifies the following problems:\n
\n\n It was discovered that single quotes (') in cookies were treated\n as a delimiter, which could lead to an information leak.\n
\n It was discovered that the character sequence \\\" in cookies was\n handled incorrectly, which could lead to an information leak.\n
\n It was discovered that the host manager servlet performed\n insufficient input validation, which could lead to a cross-site\n scripting attack.\n
\n It was discovered that the JULI logging component did not restrict\n its target path, resulting in potential denial of service through\n file overwrites.\n
\n It was discovered that the WebDAV servlet is vulnerable to absolute\n path traversal.\n
\nThe old stable distribution (sarge) doesn't contain tomcat5.5.\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 5.5.20-2etch1.\n
\n\nFor the unstable distribution (sid) these problems will be fixed soon.\n
\n\nWe recommend that you upgrade your tomcat5.5 packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that eggdrop, an advanced IRC robot, was vulnerable\nto a buffer overflow which could result in a remote user executing\narbitrary code.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 1.6.17-3sarge1.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.6.18-1etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6.18-1.1
\nWe recommend that you upgrade your eggdrop package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that loop-aes-utils, tools for mounting and manipulating\nfilesystems, didn't drop privileged user and group permissions in the correct order\nin the mount and umount commands. This could potentially allow a local\nuser to gain additional privileges.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 2.12p-4sarge2.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.12r-15+etch1.
\nWe recommend that you upgrade your loop-aes-utils package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that util-linux, miscellaneous system utilities,\ndidn't drop privileged user and group permissions in the correct order\nin the mount and umount commands. This could potentially allow a local\nuser to gain additional privileges.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 2.12p-4sarge2.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.12r-19etch1.
\nWe recommend that you upgrade your util-linux package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral local/remote vulnerabilities have been discovered in the MySQL\ndatabase server. The Common Vulnerabilities and Exposures project\nidentifies the following problems:\n
\n\n It was discovered that the privilege validation for the source table\n of CREATE TABLE LIKE statements was insufficiently enforced, which\n might lead to information disclosure. This is only exploitable by\n authenticated users.\n
\n It was discovered that symbolic links were handled insecurely during\n the creation of tables with DATA DIRECTORY or INDEX DIRECTORY\n statements, which might lead to denial of service by overwriting\n data. This is only exploitable by authenticated users.\n
\n It was discovered that queries to data in a FEDERATED table can\n lead to a crash of the local database server, if the remote server\n returns information with less columns than expected, resulting in\n denial of service.\n
\nThe old stable distribution (sarge) doesn't contain mysql-dfsg-5.0.\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 5.0.32-7etch4.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 5.0.51-1.\n
\n\nWe recommend that you upgrade your mysql-dfsg-5.0 packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nk1tk4t
discovered that wzdftpd, a portable, modular, small and efficient\nftp server, did not correctly handle the receipt of long usernames. This\ncould allow remote users to cause the daemon to exit.
For the old stable distribution (sarge), this problem has been fixed in\nversion 0.5.2-1.1sarge3.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.8.1-2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n0.8.2-2.1.
\nWe recommend that you upgrade your wzdftpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in the Tomcat\nservlet and JSP engine. The Common Vulnerabilities and Exposures project\nidentifies the following problems:\n
\n\n It was discovered that single quotes (') in cookies were treated\n as a delimiter, which could lead to an information leak.\n
\n It was discovered that the character sequence \\\" in cookies was\n handled incorrectly, which could lead to an information leak.\n
\n It was discovered that the WebDAV servlet is vulnerable to absolute\n path traversal.\n
\nThe old stable distribution (sarge) doesn't contain tomcat5.\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 5.0.30-12etch1.\n
\n\nThe unstable distribution (sid) no longer contains tomcat5.\n
\n\nWe recommend that you upgrade your tomcat5 packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nGreg MacManus discovered an integer overflow in the font handling of\nlibfreetype, a FreeType 2 font engine, which might lead to denial of\nservice or possibly the execution of arbitrary code if a user is tricked\ninto opening a malformed font.\n
\n\nFor the old stable distribution (sarge) this problem will be fixed\nsoon.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.2.1-5+etch2.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.3.5-1.\n
\n\nWe recommend that you upgrade your freetype packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local/remote vulnerabilities have been discovered in libarchive1,\na single library to read/write tar, cpio, pax, zip, iso9660 archives.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nIt was discovered that libarchive1 would miscompute the length of a buffer\n resulting in a buffer overflow if yet another type of corruption occurred\n in a pax extension header.
It was discovered that if an archive prematurely ended within a pax\n extension header the libarchive1 library could enter an infinite loop.
If an archive prematurely ended within a tar header, immediately following\n a pax extension header, libarchive1 could dereference a NULL pointer.
The old stable distribution (sarge), does not contain this package.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.2.53-2etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.2.4-1.
\nWe recommend that you upgrade your libarchive package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nDaniel B. Cid discovered that fail2ban, a tool to block IP addresses\nthat cause login failures, is too liberal about parsing SSH log files,\nallowing an attacker to block any IP address.\n
\n\nThe old stable distribution (sarge) doesn't contain fail2ban.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.7.5-2etch1.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.8.0-4.\n
\n\nWe recommend that you upgrade your fail2ban package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that Dovecot, a POP3 and IMAP server, only when used\nwith LDAP authentication and base
contains variables, could allow\na user to log in to the account of another user with the same password.\n
\nThe old stable distribution (sarge) is not affected.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.0.rc15-2etch3.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.0.10-1.\n
\n\nWe recommend that you upgrade your dovecot packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nA race condition in the OpenAFS fileserver allows remote attackers to\ncause a denial of service (daemon crash) by simultaneously acquiring and\ngiving back file callbacks, which causes the handler for the\nGiveUpAllCallBacks RPC to perform linked-list operations without the\nhost_glock lock.\n
\n\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 1.3.81-3sarge3.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.4.2-6etch1.\n
\n\nWe recommend that you upgrade your openafs packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that Gforge, a collaborative development tool, did not\nproperly sanitise some CGI parameters, allowing SQL injection in scripts\nrelated to RSS exports.\n
\n\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 3.1-31sarge5.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 4.5.14-22etch4.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 4.6.99+svn6330-1.\n
\n\nWe recommend that you upgrade your gforge packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral local vulnerabilities have been discovered in PostgreSQL, an\nobject-relational SQL database. The Common Vulnerabilities and Exposures\nproject identifies the following problems:\n
\n\n It was discovered that the DBLink module performed insufficient\n credential validation. This issue is also tracked as CVE-2007-6601,\n since the initial upstream fix was incomplete.\n
\n Tavis Ormandy and Will Drewry discovered that a bug in the handling\n of back-references inside the regular expressions engine could lead\n to an out of bounds read, resulting in a crash. This constitutes only\n a security problem if an application using PostgreSQL processes\n regular expressions from untrusted sources.\n
\n Tavis Ormandy and Will Drewry discovered that the optimizer for regular\n expression could be tricked into an infinite loop, resulting in denial\n of service. This constitutes only a security problem if an application\n using PostgreSQL processes regular expressions from untrusted sources.\n
\n Tavis Ormandy and Will Drewry discovered that the optimizer for regular\n expression could be tricked massive resource consumption. This\n constitutes only a security problem if an application using PostgreSQL\n processes regular expressions from untrusted sources.\n
\n Functions in index expressions could lead to privilege escalation. For\n a more in depth explanation please see the upstream announce available\n at http://www.postgresql.org/about/news.905.\n
\nThe old stable distribution (sarge), doesn't contain postgresql-8.1.\n
\n\nFor the stable distribution (etch), these problems have been fixed in version\npostgresql-8.1 8.1.11-0etch1.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 8.2.6-1 of postgresql-8.2.\n
\n\nWe recommend that you upgrade your postgresql-8.1 (8.1.11-0etch1) package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nBrad Fitzpatrick discovered that the UTF-8 decoding functions of libxml2,\nthe GNOME XML library, validate UTF-8 correctness insufficiently, which\nmay lead to denial of service by forcing libxml2 into an infinite loop.\n
\n\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 2.6.16-7sarge1.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.6.27.dfsg-2.\n
\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n
\n\nWe recommend that you upgrade your libxml2 packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nKees Cook discovered that the hpssd tool of the HP Linux Printing and\nImaging System (HPLIP) performs insufficient input sanitising of shell\nmeta characters, which may result in local privilege escalation to\nthe hplip user.\n
\n\nThe old stable distribution (sarge) is not affected by this problem.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.6.10-3etch1.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6.10-4.3.\n
\n\nWe recommend that you upgrade your hplip packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral local vulnerabilities have been discovered in PostgreSQL, an\nobject-relational SQL database. The Common Vulnerabilities and Exposures\nproject identifies the following problems:\n
\n\n It was discovered that the DBLink module performed insufficient\n credential validation. This issue is also tracked as CVE-2007-6601,\n since the initial upstream fix was incomplete.\n
\n Tavis Ormandy and Will Drewry discovered that a bug in the handling\n of back-references inside the regular expressions engine could lead\n to an out of bounds read, resulting in a crash. This constitutes only\n a security problem if an application using PostgreSQL processes\n regular expressions from untrusted sources.\n
\n Tavis Ormandy and Will Drewry discovered that the optimizer for regular\n expression could be tricked into an infinite loop, resulting in denial\n of service. This constitutes only a security problem if an application\n using PostgreSQL processes regular expressions from untrusted sources.\n
\n Tavis Ormandy and Will Drewry discovered that the optimizer for regular\n expression could be tricked massive resource consumption. This\n constitutes only a security problem if an application using PostgreSQL\n processes regular expressions from untrusted sources.\n
\n Functions in index expressions could lead to privilege escalation. For\n a more in depth explanation please see the upstream announce available\n at http://www.postgresql.org/about/news.905.\n
\nFor the old stable distribution (sarge), some of these problems have been\nfixed in version 7.4.7-6sarge6 of the postgresql package. Please note that\nthe fix for CVE-2007-6600 and for the handling of regular expressions\nhavn't been backported due to the intrusiveness of the fix. We recommend\nto upgrade to the stable distribution if these vulnerabilities affect your\nsetup.\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 7.4.19-0etch1.\n
\n\nThe unstable distribution (sid) no longer contains postgres-7.4.\n
\n\nWe recommend that you upgrade your postgresql-7.4 packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nOriol Carreras discovered that syslog-ng, a next generation logging\ndaemon can be tricked into dereferencing a NULL pointer through\nmalformed timestamps, which can lead to denial of service and the\ndisguise of an subsequent attack, which would otherwise be logged.\n
\n\nThe old stable distribution (sarge) is not affected.\n
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.0.0-1etch1.\n
\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.0.6-1.\n
\n\nWe recommend that you upgrade your syslog-ng package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFelipe Sateler discovered that apt-listchanges, a package change history\nnotification tool, used unsafe paths when importing its python libraries.\nThis could allow the execution of arbitrary shell commands if the root user\nexecuted the command in a directory which other local users may write\nto.
\nFor the old stable distribution (sarge), this problem was not present.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.72.5etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n2.82.
\nWe recommend that you upgrade your apt-listchanges package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe X.org fix for CVE-2007-6429 introduced a regression in the MIT-SHM\nextension, which prevented the start of a few applications. This update\nprovides updated packages for the xfree86 version included in Debian\nold stable (sarge) in addition to the fixed packages for Debian stable\n(etch), which were provided in DSA 1466-2.
\nFor reference the original advisory text below:
\nSeveral local vulnerabilities have been discovered in the X.Org X\nserver. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nregenrecht
discovered that missing input sanitising within\n the XFree86-Misc extension may lead to local privilege escalation.
It was discovered that error messages of security policy file\n handling may lead to a minor information leak disclosing the\n existence of files otherwise inaccessible to the user.
regenrecht
discovered that missing input sanitising within\n the XInput-Misc extension may lead to local privilege escalation.
regenrecht
discovered that missing input sanitising within\n the TOG-CUP extension may lead to disclosure of memory contents.
regenrecht
discovered that integer overflows in the EVI\n and MIT-SHM extensions may lead to local privilege escalation.
It was discovered that insufficient validation of PCF fonts could lead\n to local privilege escalation.
For the oldstable distribution (sarge), this problem has been fixed in\nversion 4.3.0.dfsg.1-14sarge7 of xfree86.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.1.1-21etch3 of xorg-server and 1.2.2-2.etch1 of libxfont.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2:1.4.1~git20080118-1 of xorg-server and version 1:1.3.1-2\nof libxfont.
\nWe recommend that you upgrade your X.org/Xfree86 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Mantis, a web based\nbug tracking system. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nCustom fields were not appropriately protected by per-item access\n control, allowing for sensitive data to be published.
Multiple cross site scripting issues allowed a remote attacker to\n insert malicious HTML or web script into Mantis web pages.
For the old stable distribution (sarge), these problems have been fixed in\nversion 0.19.2-5sarge5.
\nThe stable distribution (etch) is not affected by these problems.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.0.8-4.
\nWe recommend that you upgrade your mantis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Tomcat\nservlet and JSP engine. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nOlaf Kock discovered that HTTPS encryption was insufficiently\n enforced for single-sign-on cookies, which could result in\n information disclosure.
It was discovered that the Manager and Host Manager web applications\n performed insufficient input sanitising, which could lead to cross site\n scripting.
This update also adapts the tomcat5.5-webapps package to the tightened\nJULI permissions introduced in the previous tomcat5.5 DSA. However, it\nshould be noted, that the tomcat5.5-webapps is for demonstration and\ndocumentation purposes only and should not be used for production\nsystems.
\nThe old stable distribution (sarge) doesn't contain tomcat5.5.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 5.5.20-2etch2.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your tomcat5.5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSean de Regge and Greg Linares discovered multiple heap and stack based\nbuffer overflows in FLAC, the Free Lossless Audio Codec, which could\nlead to the execution of arbitrary code.
\nFor the old stable distribution (sarge), these problems have been\nfixed in version 1.1.1-5sarge1.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.1.2-8.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.2.1-1.
\nWe recommend that you upgrade your flac packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered that the HTML filter of the Horde web\napplication framework performed insufficient input sanitising, which\nmay lead to the deletion of emails if a user is tricked into viewing\na malformed email inside the Imp client.
\nThis update also provides backported bugfixes to the cross-site\nscripting filter and the user management API from the latest Horde\nrelease 3.1.6.
\nThe old stable distribution (sarge) is not affected. An update to\nEtch is recommended, though.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 3.1.3-4etch2.
\nWe recommend that you upgrade your horde3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities were found in the Vorbis General Audio\nCompression Codec, which may lead to denial of service or the\nexecution of arbitrary code, if a user is tricked into opening\na malformed Ogg Audio file with an application linked against\nlibvorbis.
\nFor the old stable distribution (sarge), these problems have been fixed\nin version 1.1.0-2.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.1.2.dfsg-1.3.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.2.0.dfsg-1.
\nWe recommend that you upgrade your libvorbis packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered that the Xine media player library performed\ninsufficient input sanitising during the handling of RTSP streams,\nwhich could lead to the execution of arbitrary code.
\nFor the old stable distribution (sarge), this problem has been fixed\nin version 1.0.1-1sarge6.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.1.2+dfsg-5.
\nFor the testing distribution (lenny), this problem has been fixed in\nversion 1.1.8-3+lenny1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your xine-lib packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJoachim Breitner discovered that Subversion support in scponly is\ninherently insecure, allowing execution of arbitrary commands. Further\ninvestigation showed that rsync and Unison support suffer from similar\nissues. This set of issues has been assigned CVE-2007-6350.
\nIn addition, it was discovered that it was possible to invoke scp\nwith certain options that may lead to the execution of arbitrary commands\n(CVE-2007-6415).
\nThis update removes Subversion, rsync and Unison support from the\nscponly package, and prevents scp from being invoked with the dangerous\noptions.
\nFor the old stable distribution (sarge), these problems have been fixed\nin version 4.0-1sarge2.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 4.6-1etch1.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your scponly package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMeder Kydyraliev discovered an integer overflow in the thumbnail\nhandling of libexif, the EXIF/IPTC metadata manipulation library, which\ncould result in the execution of arbitrary code.
\nThe old stable distribution (sarge) doesn't contain exiv2 packages.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.10-1.5.
\nWe recommend that you upgrade your exiv2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJos\u00e9 Ram\u00f3n Palanco discovered that a cross site scripting vulnerability\nin GForge, a collaborative development tool, allows remote attackers to\ninject arbitrary web script or HTML in the context of a logged in user's\nsession.
\nThe old stable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch), this problem has been fixed in version\n4.5.14-22etch5.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 4.6.99+svn6347-1.
\nWe recommend that you upgrade your gforge package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarcus Meissner discovered that the PulseAudio sound server performed\ninsufficient checks when dropping privileges, which could lead to local\nprivilege escalation.
\nThe old stable distribution (sarge) doesn't contain pulseaudio.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.9.5-5etch1.
\nWe recommend that you upgrade your pulseaudio packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDuncan Gilmore discovered that yarssr, an RSS aggregator and reader,\nperforms insufficient input sanitising, which could result in the\nexecution of arbitrary shell commands if a malformed feed is read.
\nDue to a technical limitation of the archive management scripts, the\nfix for the old stable distribution (sarge) needs to be postponed\nby a few days.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.2.2-1etch1.
\nWe recommend that you upgrade your yarssr packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma discovered two buffer overflows in YaSSL, an SSL\nimplementation included in the MySQL database package, which could lead\nto denial of service and possibly the execution of arbitrary code.
\nThe old stable distribution (sarge) doesn't contain mysql-dfsg-5.0.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 5.0.32-7etch5.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 5.0.51-3.
\nWe recommend that you upgrade your mysql-dfsg-5.0 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the Linux kernel\nthat may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nBart Oldeman reported a denial of service (DoS) issue in the VFAT\n filesystem that allows local users to corrupt a kernel structure resulting\n in a system crash. This is only an issue for systems which make use\n of the VFAT compat ioctl interface, such as systems running an 'amd64'\n flavor kernel.
Takashi Iwai supplied a fix for a memory leak in the snd_page_alloc module.\n Local users could exploit this issue to obtain sensitive information from\n the kernel.
ADLAB discovered a possible memory overrun in the ISDN subsystem that\n may permit a local user to overwrite kernel memory by issuing\n ioctls with unterminated data.
Bill Roman of Datalight noticed a coding error in the linux VFS subsystem\n that, under certain conditions, can allow local users to remove\n directories for which they should not have removal privileges.
These problems have been fixed in the stable distribution in version\n2.6.18.dfsg.1-17etch1.
\nWe recommend that you upgrade your kernel packages immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlin Rad Pop discovered several buffer overflows in the Poppler PDF\nlibrary, which could allow the execution of arbitrary code if a\nmalformed PDF file is opened.
\nThe old stable distribution (sarge) doesn't contain poppler.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.4.5-5.1etch2.
\nWe recommend that you upgrade your poppler packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a directory traversal vulnerability in CherryPy,\na pythonic, object-oriented web development framework, may lead to denial\nof service by deleting files through malicious session IDs in cookies.
\nThe old stable distribution (sarge) doesn't contain python-cherrypy.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.2.1-3etch1.
\nWe recommend that you upgrade your python-cherrypy packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that malformed cache update replies against the Squid\nWWW proxy cache could lead to the exhaustion of system memory, resulting\nin potential denial of service.
\nFor the old stable distribution (sarge), the update cannot currently\nbe processed on the buildd security network due to a bug in the archive\nmanagement script. This will be resolved soon. An update for i386\nis temporarily available at https://people.debian.org/~jmm/squid/.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.6.5-6etch1.
\nWe recommend that you upgrade your squid packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote\nattackers to cause a denial of service (CPU and memory consumption)\nvia a GETBULK request with a large max-repeaters value.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.2.3-7etch2.
\nFor the unstable and testing distributions (sid and lenny,\nrespectively), this problem has been fixed in version 5.4.1~dfsg-2.
\nWe recommend that you upgrade your net-snmp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nJesse Ruderman, Kai Engert, Martijn Wargers, Mats Palmgren and Paul\n Nickerson discovered crashes in the layout engine, which might allow\n the execution of arbitrary code.
Carsten Book, Wesley Garland, Igor Bukanov, moz_bug_r_a4
, shutdown
,\n Philip Taylor and tgirmann
discovered crashes in the JavaScript\n engine, which might allow the execution of arbitrary code.
hong
and Gregory Fleischer discovered that file input focus\n vulnerabilities in the file upload control could allow information\n disclosure of local files.
moz_bug_r_a4
and Boris Zbarsky discovered several\n vulnerabilities in JavaScript handling, which could allow\n privilege escalation.
Justin Dolske discovered that the password storage mechanism could\n be abused by malicious web sites to corrupt existing saved passwords.
Gerry Eisenhaur and moz_bug_r_a4
discovered that a directory\n traversal vulnerability in chrome: URI handling could lead to\n information disclosure.
David Bloom discovered a race condition in the image handling of\n designMode elements, which could lead to information disclosure or\n potentially the execution of arbitrary code.
Michal Zalewski discovered that timers protecting security-sensitive\n dialogs (which disable dialog elements until a timeout is reached)\n could be bypassed by window focus changes through JavaScript.
It was discovered that malformed content declarations of saved\n attachments could prevent a user from opening local files\n with a .txt
file name, resulting in minor denial of service.
Martin Straka discovered that insecure stylesheet handling during\n redirects could lead to information disclosure.
Emil Ljungdahl and Lars-Olof Moilanen discovered that phishing\n protections could be bypassed with <div> elements.
The old stable distribution (sarge) doesn't contain xulrunner.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.8.0.15~pre080131b-0etch1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Icedove mail\nclient, an unbranded version of the Thunderbird client. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nJesse Ruderman, Kai Engert, Martijn Wargers, Mats Palmgren and Paul\n Nickerson discovered crashes in the layout engine, which might allow\n the execution of arbitrary code.
Carsten Book, Wesley Garland, Igor Bukanov, moz_bug_r_a4
, shutdown
,\n Philip Taylor and tgirmann
discovered crashes in the JavaScript\n engine, which might allow the execution of arbitrary code.
moz_bug_r_a4
and Boris Zbarsky discovered several\n vulnerabilities in JavaScript handling, which could allow\n privilege escalation.
Gerry Eisenhaur and moz_bug_r_a4
discovered that a directory\n traversal vulnerability in chrome: URI handling could lead to\n information disclosure.
David Bloom discovered a race condition in the image handling of\n designMode elements, which can lead to information disclosure and\n potentially the execution of arbitrary code.
Michal Zalewski discovered that timers protecting security-sensitive\n dialogs (by disabling dialog elements until a timeout is reached)\n could be bypassed by window focus changes through JavaScript.
The Mozilla products from the old stable distribution (sarge) are no\nlonger supported with security updates.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.5.0.13+1.5.0.15b.dfsg1-0etch2.
\nWe recommend that you upgrade your icedove packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nr0t
discovered that gnatsweb, a web interface to GNU GNATS, did not\ncorrectly sanitize the database parameter in the main CGI script. This\ncould allow the injection of arbitrary HTML, or JavaScript code.
For the stable distribution (etch), this problem has been fixed in version\n4.00-1etch1.
\nWe recommend that you upgrade your gnatsweb package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the EXIF parsing code\nof the libexif library, which can lead to denial of service or the\nexecution of arbitrary code if a user is tricked into opening a\nmalformed image. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nVictor Stinner discovered an integer overflow, which may result in\n denial of service or potentially the execution of arbitrary code.
Meder Kydyraliev discovered an infinite loop, which may result in\n denial of service.
Victor Stinner discovered an integer overflow, which may result\n in denial of service or potentially the execution of arbitrary\n code.
This update also fixes two potential NULL pointer deferences.
\nFor the old stable distribution (sarge), these problems have been\nfixed in 0.6.9-6sarge2.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.6.13-5etch2.
\nWe recommend that you upgrade your libexif packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in phpBB, a web\nbased bulletin board. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nPrivate messaging allowed cross site request forgery, making\n\tit possible to delete all private messages of a user by sending\n\tthem to a crafted web page.
Cross site request forgery enabled an attacker to perform various\n\tactions on behalf of a logged in user. (Applies to sarge only.)
A negative start parameter could allow an attacker to create\n\tinvalid output. (Applies to sarge only.)
Redirection targets were not fully checked, leaving room for\n\tunauthorised external redirections via a phpBB forum.\n\t(Applies to sarge only.)
An authenticated forum administrator may upload files of any\n\ttype by using specially crafted filenames. (Applies to sarge only.)
For the old stable distribution (sarge), these problems have been\nfixed in version 2.0.13+1-6sarge4.
\nFor the stable distribution (etch), these problems have been fixed\nin version 2.0.21-7.
\nFor the unstable distribution (sid) these problems have been fixed\nin version 2.0.22-3.
\nWe recommend that you upgrade your phpbb2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel\nweb browser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nJesse Ruderman, Kai Engert, Martijn Wargers, Mats Palmgren and Paul\n Nickerson discovered crashes in the layout engine, which might allow\n the execution of arbitrary code.
Carsten Book, Wesley Garland, Igor Bukanov, moz_bug_r_a4
, shutdown
,\n Philip Taylor and tgirmann
discovered crashes in the JavaScript\n engine, which might allow the execution of arbitrary code.
hong
and Gregory Fleischer discovered that file input focus\n vulnerabilities in the file upload control could allow information\n disclosure of local files.
moz_bug_r_a4
and Boris Zbarsky discovered several\n vulnerabilities in JavaScript handling, which could allow\n privilege escalation.
Justin Dolske discovered that the password storage mechanism could\n be abused by malicious web sites to corrupt existing saved passwords.
Gerry Eisenhaur and moz_bug_r_a4
discovered that a directory\n traversal vulnerability in chrome: URI handling could lead to\n information disclosure.
David Bloom discovered a race condition in the image handling of\n designMode elements, which can lead to information disclosure and\n potentially the execution of arbitrary code.
Michal Zalewski discovered that timers protecting security-sensitive\n dialogs (by disabling dialog elements until a timeout is reached)\n could be bypassed by window focus changes through JavaScript.
It was discovered that malformed content declarations of saved\n attachments could prevent a user from opening local files\n with a .txt
file name, resulting in minor denial of service.
Martin Straka discovered that insecure stylesheet handling during\n redirects could lead to information disclosure.
Emil Ljungdahl and Lars-Olof Moilanen discovered that phishing\n protections could be bypassed with <div> elements.
The Mozilla products from the old stable distribution (sarge) are no\nlonger supported with security updates.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2.0.0.12-0etch1.
\nWe recommend that you upgrade your iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a buffer overflow in the GIF image parsing code\nof Tk, a cross-platform graphical toolkit, could lead to a denial of\nservice and potentially the execution of arbitrary code.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 8.3.5-4sarge1.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 8.3.5-6etch2.
\nWe recommend that you upgrade your tk8.3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a buffer overflow in the GIF image parsing code\nof Tk, a cross-platform graphical toolkit, could lead to a denial of\nservice and potentially the execution of arbitrary code.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 8.4.9-1sarge2.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 8.4.12-1etch2.
\nWe recommend that you upgrade your tk8.4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFrank Lichtenheld and Nico Golde discovered that WML, an off-line HTML\ngeneration toolkit, creates insecure temporary files in the eperl and\nipp backends and in the wmg.cgi script, which could lead to a local denial\nof service by overwriting files.
\nThe old stable distribution (sarge) is not affected.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2.0.11-1etch1.
\nWe recommend that you upgrade your wml packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral local/remote vulnerabilities have been discovered in the image\nloading library for the Simple DirectMedia Layer 1.2. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nGynvael Coldwind discovered a buffer overflow in GIF image parsing,\n which could result in denial of service and potentially the\n execution of arbitrary code.
It was discovered that a buffer overflow in IFF ILBM image parsing\n could result in denial of service and potentially the execution of\n arbitrary code.
For the old stable distribution (sarge), these problems have been fixed\nin version 1.2.4-1etch1. Due to a copy & paste error etch1
was appended\nto the version number instead of sarge1
. Since the update is otherwise\ntechnically correct, the update was not rebuilt on the buildd network.
For the stable distribution (etch), these problems have been fixed in\nversion 1.2.5-2+etch1.
\nWe recommend that you upgrade your sdl-image1.2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe vmsplice system call did not properly verify address arguments\npassed by user space processes, which allowed local attackers to\noverwrite arbitrary kernel memory, gaining root privileges\n(CVE-2008-0010,\nCVE-2008-0600).
\nIn the vserver-enabled kernels, a missing access check on certain\nsymlinks in /proc enabled local attackers to access resources in other\nvservers (CVE-2008-0163).
\nThe old stable distribution (sarge) is not affected by this problem.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.6.18.dfsg.1-18etch1.
\nIn addition to these fixes, this update also incorporates changes from the\nupcoming point release of the stable distribution.
\nSome architecture builds were not yet available at the time of DSA-1494-1.\nThis update to DSA-1494 provides linux-2.6 packages for these remaining\narchitectures, as well as additional binary packages that are built\nfrom source code provided by linux-2.6.
\nThe unstable (sid) and testing (lenny) distributions will be fixed soon.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nMD5 checksums of the listed files are available in the original advisory.
\nMD5 checksums of the listed files are available in the revised advisory.
\n\n\n\nSeveral local/remote vulnerabilities have been discovered in two of\nthe plugins for the Nagios network monitoring and management system.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nA buffer overflow has been discovered in the parser for HTTP\n Location headers (present in the check_http module).
A buffer overflow has been discovered in the check_snmp module.
For the old stable distribution (sarge), these problems have been\nfixed in version 1.4-6sarge1.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.4.5-1etch1.
\nWe recommend that you upgrade your nagios-plugins package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral buffer overflows have been discovered in the MPlayer movie player,\nwhich might lead to the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nFelipe Manzano and Anibal Sacco discovered a buffer overflow in\n the demuxer for MOV files.
Reimar Doeffinger discovered a buffer overflow in the FLAC header\n parsing.
Adam Bozanich discovered a buffer overflow in the CDDB access code.
Adam Bozanich discovered a buffer overflow in URL parsing.
The old stable distribution (sarge) doesn't contain mplayer.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.0~rc1-12etch2.
\nWe recommend that you upgrade your mplayer packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Clam anti-virus\ntoolkit, which may lead to the execution of arbitrary code or local denial\nof service. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nIt was discovered that temporary files are created insecurely,\n which may result in local denial of service by overwriting files.
Silvio Cesare discovered an integer overflow in the parser for PE\n headers.
The version of clamav in the old stable distribution (sarge) is no\nlonger supported with security updates.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.90.1dfsg-3etch10. In addition to these fixes, this update\nalso incorporates changes from the upcoming point release of the\nstable distribution (non-free RAR handling code was removed).
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that libimager-perl, a Perl extension for generating 24-bit images,\ndid not correctly handle 8-bit compressed images, which could\nallow the execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.50-1etch1.
\nWe recommend that you upgrade your libimager-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that specially crafted regular expressions involving\ncodepoints greater than 255 could cause a buffer overflow in the PCRE\nlibrary (CVE-2008-0674).
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 4.5+7.4-2.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.7+7.4-3.
\nFor the unstable distribution (sid), this problem has been fixed in version\n7.6-1.
\nWe recommend that you upgrade your pcre3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMike Ashton discovered that splitvt, a utility to run two programs in a\nsplit screen, did not drop group privileges prior to executing xprop
.\nThis could allow any local user to gain the privileges of group utmp.
For the stable distribution (etch), this problem has been fixed in version\n1.6.5-9etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6.6-4.
\nWe recommend that you upgrade your splitvt package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTobias Gr\u00fctzmacher discovered that a Debian-provided CRON script in dspam,\na statistical spam filter, included a database password on the command line.\nThis allowed a local attacker to read the contents of the dspam database,\nsuch as emails.
\nThe old stable distribution (sarge) does not contain the dspam package.
\nFor the stable distribution (etch), this problem has been fixed in version\n3.6.8-5etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n3.6.8-5.1.
\nWe recommend that you upgrade your dspam package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in wordpress, a weblog\nmanager. The Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nCross-site scripting (XSS) vulnerability in functions.php in the default\n theme in WordPress allows remote authenticated administrators to inject\n arbitrary web script or HTML via the PATH_INFO (REQUEST_URI) to\n wp-admin/themes.php.
SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress\n before 2.2 allows remote attackers to execute arbitrary SQL commands via\n the cookie parameter.
Cross-site scripting (XSS) vulnerability in wp-db-backup.php in\n WordPress 2.0.11 and earlier allows remote attackers to inject\n arbitrary web script or HTML via the backup parameter in a\n wp-db-backup.php action to wp-admin/edit.php.
Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3\n and earlier allows remote attackers to read arbitrary files, delete\n arbitrary files, and cause a denial of service via a .. (dot dot) in the\n backup parameter in a wp-db-backup.php action to wp-admin/edit.php.
Wordpress is not present in the oldstable distribution (sarge).
\nFor the stable distribution (etch), these problems have been fixed in version\n2.0.10-1etch1.
\nWe recommend that you upgrade your wordpress package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\ninfamous41md reported multiple integer overflows in the Sbus PROM\n driver that would allow for a DoS (Denial of Service) attack by a\n local user, and possibly the execution of arbitrary code.
Doug Chapman discovered a potential local DoS (deadlock) in the mincore\n function caused by improper lock handling.
Eric Sandeen provided a fix for a local memory corruption vulnerability\n resulting from a misinterpretation of return values when operating on\n inodes which have been marked bad.
LMH reported a potential local DoS which could be exploited by a malicious\n user with the privileges to mount and read a corrupted cramfs filesystem.
LMH reported a potential local DoS which could be exploited by a malicious\n user with the privileges to mount and read a corrupted ext3 filesystem.
LMH reported a potential local DoS which could be exploited by a malicious\n user with the privileges to mount and read a corrupted ext2 filesystem.
Marcel Holtman discovered multiple buffer overflows in the Bluetooth\n subsystem which can be used to trigger a remote DoS (crash) and potentially\n execute arbitrary code.
Ilja van Sprundel discovered that kernel memory could be leaked via the\n Bluetooth setsockopt call due to an uninitialized stack buffer. This\n could be used by local attackers to read the contents of sensitive kernel\n memory.
Masayuki Nakagawa discovered that flow labels were inadvertently\n being shared between listening sockets and child sockets. This defect\n can be exploited by local users to cause a DoS (Oops).
Thomas Graf reported a typo in the DECnet protocol handler that could\n be used by a local attacker to overrun an array via crafted packets,\n potentially resulting in a Denial of Service (system crash).\n A similar issue exists in the IPV4 protocol handler and will be fixed\n in a subsequent update.
Florian Zumbiehl discovered a memory leak in the PPPOE subsystem caused\n by releasing a socket before PPPIOCGCHAN is called upon it. This could\n be used by a local user to DoS a system by consuming all available memory.
Wojciech Purczynski discovered that pdeath_signal was not being reset\n properly under certain conditions which may allow local users to gain\n privileges by sending arbitrary signals to suid binaries.
Alan Cox reported an issue in the aacraid driver that allows unprivileged\n local users to make ioctl calls which should be restricted to admin\n privileges.
PaX team discovered an issue in the random driver where a defect in the\n reseeding code leads to a reduction in entropy.
Alex Smith discovered an issue with the pwc driver for certain webcam\n devices. If the device is removed while a userspace application has it\n open, the driver will wait for userspace to close the device, resulting\n in a blocked USB subsystem. This issue is of low security impact as\n it requires the attacker to either have physical access to the system\n or to convince a user with local access to remove the device on their\n behalf.
Venustech AD-LAB discovered a a buffer overflow in the isdn ioctl\n handling, exploitable by a local user.
ADLAB discovered a possible memory overrun in the ISDN subsystem that\n may permit a local user to overwrite kernel memory by issuing\n ioctls with unterminated data.
Blake Frantz discovered that when a core file owned by a non-root user\n exists, and a root-owned process dumps core over it, the core file\n retains its original ownership. This could be used by a local user to\n gain access to sensitive information.
Cyrill Gorcunov reported a NULL pointer dereference in code specific\n to the CHRP PowerPC platforms. Local users could exploit this issue\n to achieve a Denial of Service (DoS).
Nick Piggin of SuSE discovered a number of issues in subsystems which\n register a fault handler for memory mapped areas. This issue can be\n exploited by local users to achieve a Denial of Service (DoS) and possibly\n execute arbitrary code.
The following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 3.1 (sarge) |
|---|---|
| alsa-modules-i386 | 1.0.8+2sarge2 |
| kernel-image-2.4.27-arm | 2.4.27-2sarge6 |
| kernel-image-2.4.27-m68k | 2.4.27-3sarge6 |
| kernel-image-speakup-i386 | 2.4.27-1.1sarge5 |
| kernel-image-2.4.27-alpha | 2.4.27-10sarge6 |
| kernel-image-2.4.27-s390 | 2.4.27-2sarge6 |
| kernel-image-2.4.27-sparc | 2.4.27-9sarge6 |
| kernel-image-2.4.27-i386 | 2.4.27-10sarge6 |
| kernel-image-2.4.27-ia64 | 2.4.27-10sarge6 |
| kernel-patch-2.4.27-mips | 2.4.27-10.sarge4.040815-3 |
| kernel-patch-powerpc-2.4.27 | 2.4.27-10sarge6 |
| kernel-latest-2.4-alpha | 101sarge3 |
| kernel-latest-2.4-i386 | 101sarge2 |
| kernel-latest-2.4-s390 | 2.4.27-1sarge2 |
| kernel-latest-2.4-sparc | 42sarge3 |
| i2c | 1:2.9.1-1sarge2 |
| lm-sensors | 1:2.9.1-1sarge4 |
| mindi-kernel | 2.4.27-2sarge5 |
| pcmcia-modules-2.4.27-i386 | 3.2.5+2sarge2 |
| hostap-modules-i386 | 1:0.3.7-1sarge3 |
| systemimager | 3.2.3-6sarge5 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local and remote vulnerabilities have been discovered in the Linux\nkernel that may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nLMH reported a potential local DoS which could be exploited by a malicious\n user with the privileges to mount and read a corrupted cramfs filesystem.
LMH reported a potential local DoS which could be exploited by a malicious\n user with the privileges to mount and read a corrupted ext2 filesystem.
LMH reported an issue in the minix filesystem that allows local users\n with mount privileges to create a DoS (printk flood) by mounting a\n specially crafted corrupt filesystem.
OpenVZ Linux kernel team reported an issue in the smbfs filesystem which\n can be exploited by local users to cause a DoS (oops) during mount.
Ilja van Sprundel discovered that kernel memory could be leaked via the\n Bluetooth setsockopt call due to an uninitialized stack buffer. This\n could be used by local attackers to read the contents of sensitive kernel\n memory.
Thomas Graf reported a typo in the DECnet protocol handler that could\n be used by a local attacker to overrun an array via crafted packets,\n potentially resulting in a Denial of Service (system crash).\n A similar issue exists in the IPV4 protocol handler and will be fixed\n in a subsequent update.
Florian Zumbiehl discovered a memory leak in the PPPOE subsystem caused\n by releasing a socket before PPPIOCGCHAN is called upon it. This could\n be used by a local user to DoS a system by consuming all available memory.
The PaX Team discovered a potential buffer overflow in the random number\n generator which may permit local users to cause a denial of service or\n gain additional privileges. This issue is not believed to effect default\n Debian installations where only root has sufficient privileges to exploit\n it.
Adam Litke reported a potential local denial of service (oops) on\n powerpc platforms resulting from unchecked VMA expansion into address\n space reserved for hugetlb pages.
Steve French reported that CIFS filesystems with CAP_UNIX enabled\n were not honoring a process' umask which may lead to unintentionally\n relaxed permissions.
Wojciech Purczynski discovered that pdeath_signal was not being reset\n properly under certain conditions which may allow local users to gain\n privileges by sending arbitrary signals to suid binaries.
Hugh Dickins discovered a potential local DoS (panic) in hugetlbfs.\n A misconversion of hugetlb_vmtruncate_list to prio_tree may allow\n local users to trigger a BUG_ON() call in exit_mmap.
Alan Cox reported an issue in the aacraid driver that allows unprivileged\n local users to make ioctl calls which should be restricted to admin\n privileges.
Wojciech Purczynski discovered a vulnerability that can be exploited\n by a local user to obtain superuser privileges on x86_64 systems.\n This resulted from improper clearing of the high bits of registers\n during ia32 system call emulation. This vulnerability is relevant\n to the Debian amd64 port as well as users of the i386 port who run\n the amd64 linux-image flavour.
Alex Smith discovered an issue with the pwc driver for certain webcam\n devices. If the device is removed while a userspace application has it\n open, the driver will wait for userspace to close the device, resulting\n in a blocked USB subsystem. This issue is of low security impact as\n it requires the attacker to either have physical access to the system\n or to convince a user with local access to remove the device on their\n behalf.
Venustech AD-LAB discovered a a buffer overflow in the isdn ioctl\n handling, exploitable by a local user.
ADLAB discovered a possible memory overrun in the ISDN subsystem that\n may permit a local user to overwrite kernel memory by issuing\n ioctls with unterminated data.
Blake Frantz discovered that when a core file owned by a non-root user\n exists, and a root-owned process dumps core over it, the core file\n retains its original ownership. This could be used by a local user to\n gain access to sensitive information.
Cyrill Gorcunov reported a NULL pointer dereference in code specific\n to the CHRP PowerPC platforms. Local users could exploit this issue\n to achieve a Denial of Service (DoS).
Nick Piggin of SuSE discovered a number of issues in subsystems which\n register a fault handler for memory mapped areas. This issue can be\n exploited by local users to achieve a Denial of Service (DoS) and possibly\n execute arbitrary code.
The following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 3.1 (sarge) |
|---|---|
| kernel-image-2.6.8-alpha | 2.6.8-17sarge1 |
| kernel-image-2.6.8-amd64 | 2.6.8-17sarge1 |
| kernel-image-2.6.8-hppa | 2.6.8-7sarge1 |
| kernel-image-2.6.8-i386 | 2.6.8-17sarge1 |
| kernel-image-2.6.8-ia64 | 2.6.8-15sarge1 |
| kernel-image-2.6.8-m68k | 2.6.8-5sarge1 |
| kernel-image-2.6.8-s390 | 2.6.8-6sarge1 |
| kernel-image-2.6.8-sparc | 2.6.8-16sarge1 |
| kernel-patch-powerpc-2.6.8 | 2.6.8-13sarge1 |
| fai-kernels | 1.9.1sarge8 |
We recommend that you upgrade your kernel package immediately and reboot\nthe machine. If you have built a custom kernel from the kernel source\npackage, you will need to rebuild to take advantage of these fixes.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTakashi Iwai supplied a fix for a memory leak in the snd_page_alloc module.\nLocal users could exploit this issue to obtain sensitive information from\nthe kernel (CVE-2007-4571).
\nFor the oldstable distribution (sarge), this problem has been fixed in\nversion 1.0.8-7sarge1. The prebuilt modules provided by alsa-modules-i386\nhave been rebuilt to take advantage of this update, and are available in\nversion 1.0.8+2sarge2.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.0.13-5etch1. This issue was already fixed for the version\nof ALSA provided by linux-2.6 in DSA 1479.
\nFor the unstable distributions (sid), this problem was fixed in version\n1.0.15-1.
\nWe recommend that you upgrade your alsa-driver and alsa-modules-i386\npackages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceape internet\nsuite, an unbranded version of the Seamonkey Internet Suite. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nJesse Ruderman, Kai Engert, Martijn Wargers, Mats Palmgren and Paul\n Nickerson discovered crashes in the layout engine, which might allow\n the execution of arbitrary code.
Carsten Book, Wesley Garland, Igor Bukanov, moz_bug_r_a4
, shutdown
,\n Philip Taylor and tgirmann
discovered crashes in the Javascript\n engine, which might allow the execution of arbitrary code.
hong
and Gregory Fleischer discovered that file input focus\n vulnerabilities in the file upload control could allow information\n disclosure of local files.
moz_bug_r_a4
and Boris Zbarsky discovered several\n vulnerabilities in Javascript handling, which could allow\n privilege escalation.
Justin Dolske discovered that the password storage mechanism could\n be abused by malicious web sites to corrupt existing saved passwords.
Gerry Eisenhaur and moz_bug_r_a4
discovered that a directory\n traversal vulnerability in chrome: URI handling could lead to\n information disclosure.
David Bloom discovered a race condition in the image handling of\n designMode elements, which can lead to information disclosure and\n potentially the execution of arbitrary code.
Michal Zalewski discovered that timers protecting security-sensitive\n dialogs (by disabling dialog elements until a timeout is reached)\n could be bypassed by window focus changes through Javascript.
It was discovered that malformed content declarations of saved\n attachments could prevent a user in the opening local files\n with a .txt
file name, resulting in minor denial of service.
Martin Straka discovered that insecure stylesheet handling during\n redirects could lead to information disclosure.
Emil Ljungdahl and Lars-Olof Moilanen discovered that phishing\n protections could be bypassed with <div> elements.
The Mozilla products from the old stable distribution (sarge) are no\nlonger supported with security updates.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.0.12~pre080131b-0etch1.
\nWe recommend that you upgrade your iceape packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter Paul Elfferich discovered that turba2, a contact management component\nfor horde framework, did not correctly check access rights before allowing\nusers to edit addresses. This could result in valid users being able to\nalter private address records.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 2.0.2-1sarge1.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.1.3-1etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n2.1.7-1.
\nWe recommend that you upgrade your turba2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Dennison discovered that Diatheke, a CGI program to make a bible\nwebsite, performs insufficient sanitising of a parameter, allowing a\nremote attacker to execute arbitrary shell commands as the web server\nuser.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 1.5.7-7sarge1.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.5.9-2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n1.5.9-8.
\nWe recommend that you upgrade your diatheke package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in xpdf code that is\nembedded in koffice, an integrated office suite for KDE. These flaws\ncould allow an attacker to execute arbitrary code by inducing the user\nto import a specially crafted PDF document. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nArray index error in the DCTStream::readProgressiveDataUnit method in\nxpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice,\nCUPS, and other products, allows remote attackers to trigger memory\ncorruption and execute arbitrary code via a crafted PDF file.
Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in\nXpdf 3.02p11 allows remote attackers to execute arbitrary code via a\ncrafted PDF file, resulting in a heap-based buffer overflow.
Heap-based buffer overflow in the CCITTFaxStream::lookChar method in\nxpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute\narbitrary code via a PDF file that contains a crafted CCITTFaxDecode\nfilter.
Updates for the old stable distribution (sarge) will be made available\nas soon as possible.
\nFor the stable distribution (etch), these problems have been fixed in version\n1:1.6.1-2etch2.
\nWe recommend that you upgrade your koffice package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered a buffer overflow in the color space handling\ncode of the Ghostscript PostScript/PDF interpreter, which might result\nin the execution of arbitrary code if a user is tricked into processing\na malformed file.
\nFor the stable distribution (etch), this problem has been fixed in version\n8.54.dfsg.1-5etch1 of gs-gpl and 8.15.3.dfsg.1-1etch1 of gs-esp.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 8.01-6 of gs-gpl and 7.07.1-9sarge1 of gs-esp.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your gs-esp and gs-gpl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in libicu,\nInternational Components for Unicode, The Common Vulnerabilities and\nExposures project identifies the following problems:
\n\n libicu in International Components for Unicode (ICU) 3.8.1 and earlier\n attempts to process backreferences to the nonexistent capture group\n zero (aka \\0), which might allow context-dependent attackers to read\n from, or write to, out-of-bounds memory locations, related to\n corruption of REStackFrames.
\n\n Heap-based buffer overflow in the doInterval function in regexcmp.cpp\n in libicu in International Components for Unicode (ICU) 3.8.1 and\n earlier allows context-dependent attackers to cause a denial of\n service (memory consumption) and possibly have unspecified other\n impact via a regular expression that writes a large amount of data to\n the backtracking stack.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 3.6-2etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.8-6.
\nWe recommend that you upgrade your libicu package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nUlf H\u00e4rnhammar discovered that Evolution, the e-mail and groupware suite,\nhad a format string vulnerability in the parsing of encrypted mail messages.\nIf the user opened a specially crafted email message, code execution was\npossible.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.6.3-6etch2.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 2.0.4-2sarge3. Some architectures have not yet completed building\nthe updated package for sarge, they will be added as they come available.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.12.3-1.1.
\nWe recommend that you upgrade your evolution package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that lighttpd, a fast webserver with minimal memory\nfootprint, would display the source to CGI scripts if their execution\nfailed in some circumstances.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.4.13-4etch5.
\nFor the unstable distribution, this problem will be fixed soon.
\nWe recommend that you upgrade your lighttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in MoinMoin, a\nPython clone of WikiWiki. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nA cross-site-scripting vulnerability has been discovered in\n attachment handling.
Access control lists for calendars and includes were\n insufficiently enforced, which could lead to information\n disclosure.
A cross-site-scripting vulnerability has been discovered in\n the login code.
A cross-site-scripting vulnerability has been discovered in\n attachment handling.
A directory traversal vulnerability in cookie handling could\n lead to local denial of service by overwriting files.
Cross-site-scripting vulnerabilities have been discovered in\n the GUI editor formatter and the code to delete pages.
The macro code validates access control lists insufficiently,\n which could lead to information disclosure.
For the stable distribution (etch), these problems have been fixed in\nversion 1.5.3-1.2etch1. This update also includes a bugfix with respect to the\nencoding of password reminder mails, which doesn't have security\nimplications.
\nThe old stable distribution (sarge) will not be updated due to\nthe many changes and support for Sarge ending end of this month\nanyway. You're advised to upgrade to the stable distribution if\nyou run moinmoin.
\nWe recommend that you upgrade your moin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in libnet-dns-perl.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered that libnet-dns-perl generates very weak transaction\nIDs when sending queries (CVE-2007-3377). This update switches\ntransaction ID generation to the Perl random generator, making\nprediction attacks more difficult.
\nCompression loops in domain names resulted in an infinite loop in the\ndomain name expander written in Perl (CVE-2007-3409). The Debian\npackage uses an expander written in C by default, but this vulnerability\nhas been addressed nevertheless.
\nDecoding malformed A records could lead to a crash (via an uncaught\nPerl exception) of certain applications using libnet-dns-perl\n(CVE-2007-6341).
\nFor the old stable distribution (sarge), these problems have been fixed in\nversion 0.48-1sarge1.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.59-1etch1.
\nWe recommend that you upgrade your libnet-dns-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPrior to this update, the default configuration for Dovecot used by\nDebian runs the server daemons with group mail privileges. This means\nthat users with write access to their mail directory on the server\n(for example, through an SSH login) could read and also delete via a symbolic link mailboxes owned by\nother users for which they do not have direct access\n(CVE-2008-1199). In addition, an internal interpretation conflict in\npassword handling has been addressed proactively, even though it is\nnot known to be exploitable (CVE-2008-1218).
\nNote that applying this update requires manual action: The\nconfiguration setting mail_extra_groups = mail
has been replaced\nwith mail_privileged_group = mail
. The update will show a\nconfiguration file conflict in /etc/dovecot/dovecot.conf. It is\nrecommended that you keep the currently installed configuration file,\nand change the affected line. For your reference, the sample\nconfiguration (without your local changes) will have been written to\n/etc/dovecot/dovecot.conf.dpkg-new.
If your current configuration uses mail_extra_groups with a value\ndifferent from mail
, you may have to resort to the\nmail_access_groups configuration directive.
For the old stable distribution (sarge), no updates are provided.\nWe recommend that you consider upgrading to the stable distribution.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.0.rc15-2etch4.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.0.13-1.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDon Armstrong discovered that ldapscripts, a suite of tools to manipulate\nuser accounts in LDAP, sends the password as a command line argument when\ncalling LDAP programs, which may allow a local attacker to read this password\nfrom the process listing.
\nThe old stable distribution (sarge) does not contain an ldapscripts package.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.4-2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n1.7.1-2.
\nWe recommend that you upgrade your ldapscripts package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMicha Lenk discovered that backup-manager, a command-line backup tool,\nsends the password as a command line argument when calling a FTP client,\nwhich may allow a local attacker to read this password (which provides\naccess to all backed-up files) from the process listing.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 0.5.7-1sarge2.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.7.5-4.
\nFor the unstable distribution (sid), this problem has been fixed in version\n0.7.6-3.
\nWe recommend that you upgrade your backup-manager package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Horde web application framework permits arbitrary\nfile inclusion by a remote attacker through the theme preference parameter.
For the old stable distribution (sarge) this problem has been fixed in\nversion 3.0.4-4sarge7.
\nFor the stable distribution (etch) this problem has been fixed in version\n3.1.3-4etch3.
\nFor the unstable distribution (sid) this problem has been fixed in version\n3.1.7-1.
\nWe recommend that you upgrade your horde3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the regex module in Smarty, a PHP templating engine,\nallows attackers to call arbitrary PHP functions via templates using the\nregex_replace plugin by a specially crafted search string.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 2.6.9-1sarge1.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.6.14-1etch1.
\nFor the unstable distribution (sid), this problem has been fixed in version\n2.6.18-1.1.
\nWe recommend that you upgrade your smarty package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJulien Cayzac discovered that under certain circumstances lighttpd,\na fast webserver with minimal memory footprint, might allow the reading\nof arbitrary files from the system. This problem could only occur\nwith a non-standard configuration.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.4.13-4etch6.
\nWe recommend that you upgrade your lighttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy discovered that unzip, when processing specially crafted\nZIP archives, could pass invalid pointers to the C library's free\nroutine, potentially leading to arbitrary code execution\n(CVE-2008-0888).
\nFor the old stable distribution (sarge), this problem has been fixed\nin version 5.52-1sarge5.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.52-9etch1.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your unzip package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJosh Triplett discovered that ikiwiki did not block Javascript in\nURLs, leading to cross-site scripting vulnerabilities (CVE-2008-0808,\nCVE-2008-0809).
\nThe old stable distribution (sarge) did not contain an ikiwiki package.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.33.4.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.31.1.
\nWe recommend that you upgrade your ikiwiki package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the kdc component\nof the krb5, a system for authenticating users and services on a\nnetwork. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nAn unauthenticated remote attacker may cause a krb4-enabled KDC to\ncrash, expose information, or execute arbitrary code. Successful\nexploitation of this vulnerability could compromise the Kerberos key\ndatabase and host security on the KDC host.
An unauthenticated remote attacker may cause a krb4-enabled KDC to\nexpose information. It is theoretically possible for the exposed\ninformation to include secret key data on some platforms.
An unauthenticated remote attacker can cause memory corruption in the\nkadmind process, which is likely to cause kadmind to crash, resulting in\na denial of service. It is at least theoretically possible for such\ncorruption to result in database corruption or arbitrary code execution,\nthough we have no such exploit and are not aware of any such exploits in\nuse in the wild. In versions of MIT Kerberos shipped by Debian, this\nbug can only be triggered in configurations that allow large numbers of\nopen file descriptors in a process.
For the old stable distribution (sarge), these problems have been fixed\nin version krb5 1.3.6-2sarge6.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.4.4-7etch5.
\nWe recommend that you upgrade your krb5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Asterisk, a free\nsoftware PBX and telephony toolkit. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nTilghman Lesher discovered that database-based registrations are\n insufficiently validated. This only affects setups, which are\n configured to run without a password and only host-based\n authentication.
Jason Parker discovered that insufficient validation of From:\n headers inside the SIP channel driver may lead to authentication\n bypass and the potential external initiation of calls.
This update also fixes a format string vulnerability, which can only be\n triggered through configuration files under control of the local\n administrator. In later releases of Asterisk this issue is remotely\n exploitable and tracked as CVE-2008-1333.
The status of the old stable distribution (sarge) is currently being\ninvestigated. If affected, an update will be released through\nsecurity.debian.org.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1:1.2.13~dfsg-2etch3.
\nWe recommend that you upgrade your asterisk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp from the Debian Security Audit project discovered several local\nvulnerabilities in xwine, a graphical user interface for the WINE emulator.
\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nThe xwine command makes unsafe use of local temporary files when\n printing. This could allow the removal of arbitrary files belonging\n to users who invoke the program.
The xwine command changes the permissions of the global WINE configuration\n file such that it is world-writable. This could allow local users to edit\n it such that arbitrary commands could be executed whenever any local user\n executed a program under WINE.
For the stable distribution (etch), these problems have been fixed in version\n1.0.1-1etch1.
\nWe recommend that you upgrade your xwine package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThomas de Grenier de Latour discovered that the checkrestart tool in the\ndebian-goodies suite of utilities, allowed local users to gain privileges\nvia shell metacharacters in the name of the executable file for a running\nprocess.
\nFor the old stable distribution (sarge), this problem has been fixed in\nversion 0.24+sarge1.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.27+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.34.
\nWe recommend that you upgrade your debian-goodies package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter H\u00fcwe and Hanno B\u00f6ck discovered that Serendipity, a weblog manager,\ndid not properly sanitise input to several scripts which allowed\ncross site scripting.
\nThe old stable distribution (sarge) does not contain a serendipity package.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.0.4-1+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3-1.
\nWe recommend that you upgrade your serendipity package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nMultiple security problems have been discovered in the Firebird database,\nwhich may lead to the execution of arbitrary code or denial of service.\n
\n\nThis Debian security advisory is a bit unusual. While it's normally\nour strict policy to backport security bugfixes to older releases, this\nturned out to be infeasible for Firebird 1.5 due to large infrastructural\nchanges necessary to fix these issues. As a consequence security support\nfor Firebird 1.5 is hereby discontinued, leaving two options to\nadministrators running a Firebird database:\n
\nFor a more detailed description of the security problems, please refer\nto the entries in the Debian Bug Tracking System referenced above and\nthe following URLs:
\n\nhttp://www.firebirdsql.org/rlsnotes/Firebird-2.0-ReleaseNotes.pdf
\nhttp://www.firebirdsql.org/rlsnotes/Firebird-2.0.1-ReleaseNotes.pdf
\nhttp://www.firebirdsql.org/rlsnotes/Firebird-2.0.2-ReleaseNotes.pdf
Several local/remote vulnerabilities have been discovered in cupsys, the\nCommon Unix Printing System. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\n\nHeap-based buffer overflow in CUPS, when printer sharing is enabled,\nallows remote attackers to execute arbitrary code via crafted search\nexpressions.\n
\n\nDouble free vulnerability in the process_browse_data function in CUPS\n1.3.5 allows remote attackers to cause a denial of service (daemon\ncrash) and possibly the execution of arbitrary code via crafted packets to the\ncupsd port (631/udp), related to an unspecified manipulation of a\nremote printer.\n
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.2.7-4etch3.
\nWe recommend that you upgrade your cupsys packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Howells discovered that policyd-weight, a policy daemon for the Postfix\nmail transport agent, created its socket in an insecure way, which may be\nexploited to overwrite or remove arbitrary files from the local system.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.1.14-beta-6etch2.
\nThe old stable distribution (sarge) does not contain a policyd-weight package.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your policyd-weight package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nPeter Brodersen and Alexander Klink discovered that the\n autoselection of SSL client certificates could lead to users\n being tracked, resulting in a loss of privacy.
moz_bug_r_a4
discovered that variants of CVE-2007-3738 and\n CVE-2007-5338 allow the execution of arbitrary code through\n XPCNativeWrapper.
moz_bug_r_a4
discovered that insecure handling of event\n handlers could lead to cross-site scripting.
Boris Zbarsky, Johnny Stenback and moz_bug_r_a4
discovered\n that incorrect principal handling could lead to cross-site\n scripting and the execution of arbitrary code.
Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett and Mats\n Palmgren discovered crashes in the layout engine, which might\n allow the execution of arbitrary code.
georgi
, tgirmann
and Igor Bukanov discovered crashes in the\n Javascript engine, which might allow the execution of arbitrary\n code.
Gregory Fleischer discovered that HTTP Referrer headers were\n handled incorrectly in combination with URLs containing Basic\n Authentication credentials with empty usernames, resulting\n in potential Cross-Site Request Forgery attacks.
Gregory Fleischer discovered that web content fetched through\n the jar: protocol can use Java to connect to arbitrary ports.\n This is only an issue in combination with the non-free Java\n plugin.
Chris Thomas discovered that background tabs could generate\n XUL popups overlaying the current tab, resulting in potential\n spoofing attacks.
The Mozilla products from the old stable distribution (sarge) are no\nlonger supported.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.8.0.15~pre080323b-0etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.8.1.13-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChristian Schmid and Meder Kydyraliev (Google Security) discovered a\nnumber of vulnerabilities in exiftags, a utility for extracting EXIF\nmetadata from JPEG images. The Common Vulnerabilities and Exposures\nproject identified the following three problems:
\nInadequate EXIF property validation could lead to invalid memory\n accesses if executed on a maliciously crafted image, potentially\n including heap corruption and the execution of arbitrary code.
Flawed data validation could lead to integer overflows, causing\n other invalid memory accesses, also with the potential for memory\n corruption or arbitrary code execution.
Cyclical EXIF image file directory (IFD) references could cause\n a denial of service (infinite loop).
For the oldstable distribution (sarge), these problems have been fixed\nin version 0.98-1.1+0sarge1.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.98-1.1+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.01-0.1.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceape internet\nsuite, an unbranded version of the Seamonkey Internet Suite. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nPeter Brodersen and Alexander Klink discovered that the\n autoselection of SSL client certificates could lead to users\n being tracked, resulting in a loss of privacy.
moz_bug_r_a4
discovered that variants of CVE-2007-3738 and\n CVE-2007-5338 allow the execution of arbitrary code through\n XPCNativeWrapper.
moz_bug_r_a4
discovered that insecure handling of event\n handlers could lead to cross-site scripting.
Boris Zbarsky, Johnny Stenback and moz_bug_r_a4
discovered\n that incorrect principal handling could lead to cross-site\n scripting and the execution of arbitrary code.
Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett and Mats\n Palmgren discovered crashes in the layout engine, which might\n allow the execution of arbitrary code.
georgi
, tgirmann
and Igor Bukanov discovered crashes in the\n Javascript engine, which might allow the execution of arbitrary\n code.
Gregory Fleischer discovered that HTTP Referrer headers were\n handled incorrectly in combination with URLs containing Basic\n Authentication credentials with empty usernames, resulting\n in potential Cross-Site Request Forgery attacks.
Gregory Fleischer discovered that web content fetched through\n the jar: protocol can use Java to connect to arbitrary ports.\n This is only an issue in combination with the non-free Java\n plugin.
Chris Thomas discovered that background tabs could generate\n XUL popups overlaying the current tab, resulting in potential\n spoofing attacks.
The Mozilla products from the old stable distribution (sarge) are no\nlonger supported.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.0.13~pre080323b-0etch1.
\nWe recommend that you upgrade your iceape packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel\nweb browser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nPeter Brodersen and Alexander Klink discovered that the\n autoselection of SSL client certificates could lead to users\n being tracked, resulting in a loss of privacy.
moz_bug_r_a4
discovered that variants of CVE-2007-3738 and\n CVE-2007-5338 allow the execution of arbitrary code through\n XPCNativeWrapper.
moz_bug_r_a4
discovered that insecure handling of event\n handlers could lead to cross-site scripting.
Boris Zbarsky, Johnny Stenback and moz_bug_r_a4
discovered\n that incorrect principal handling could lead to cross-site\n scripting and the execution of arbitrary code.
Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett and Mats\n Palmgren discovered crashes in the layout engine, which might\n allow the execution of arbitrary code.
georgi
, tgirmann
and Igor Bukanov discovered crashes in the\n Javascript engine, which might allow the execution of arbitrary\n code.
Gregory Fleischer discovered that HTTP Referrer headers were\n handled incorrectly in combination with URLs containing Basic\n Authentication credentials with empty usernames, resulting\n in potential Cross-Site Request Forgery attacks.
Gregory Fleischer discovered that web content fetched through\n the jar: protocol can use Java to connect to arbitrary ports.\n This is only an issue in combination with the non-free Java\n plugin.
Chris Thomas discovered that background tabs could generate\n XUL popups overlaying the current tab, resulting in potential\n spoofing attacks.
The Mozilla products from the old stable distribution (sarge) are no\nlonger supported.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2.0.0.13-0etch1.
\nWe recommend that you upgrade your iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in Xine, a\nmedia player library, allowed for a denial of service or arbitrary code\nexecution, which could be exploited through viewing malicious content.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nThe DMO_VideoDecoder_Open function does not set the biSize before use in a\n memcpy, which allows user-assisted remote attackers to cause a buffer overflow\n and possibly execute arbitrary code (applies to sarge only).
Array index error in the sdpplin_parse function allows remote RTSP servers\n to execute arbitrary code via a large streamid SDP parameter.
Array index vulnerability in libmpdemux/demux_audio.c might allow remote\n attackers to execute arbitrary code via a crafted FLAC tag, which triggers\n a buffer overflow (applies to etch only).
Buffer overflow in the Matroska demuxer allows remote attackers to cause a\n denial of service (crash) and possibly execute arbitrary code via a Matroska\n file with invalid frame sizes.
For the old stable distribution (sarge), these problems have been fixed in\nversion 1.0.1-1sarge7.
\nFor the stable distribution (etch), these problems have been fixed in version\n1.1.2+dfsg-6.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.1.11-1.
\nWe recommend that you upgrade your xine-lib package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlin Rad Pop (Secunia) discovered a number of vulnerabilities in xpdf, a set\nof tools for display and conversion of Portable Document Format (PDF) files.\nThe Common Vulnerabilities and Exposures project identifies the following\nthree problems:
\nInadequate DCT stream validation allows an attacker to corrupt\n memory and potentially execute arbitrary code by supplying a\n maliciously crafted PDF file.
An integer overflow vulnerability in DCT stream handling could\n allow an attacker to overflow a heap buffer, enabling the execution\n of arbitrary code.
A buffer overflow vulnerability in xpdf's CCITT image compression\n handlers allows overflow on the heap, allowing an attacker to\n execute arbitrary code by supplying a maliciously crafted\n CCITTFaxDecode filter.
For the stable distribution (etch), these problems have been fixed in\nversion 3.01-9.1+etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.02-1.3.
\nWe recommend that you upgrade your xpdf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sj\u00f6lund discovered a buffer overflow vulnerability in the Ogg\nVorbis input plugin of the alsaplayer audio playback application.\nSuccessful exploitation of this vulnerability through the opening of a\nmaliciously crafted Vorbis file could lead to the execution of\narbitrary code.
\nFor the stable distribution (etch), the problem has been fixed in\nversion 0.99.76-9+etch1.
\nFor the unstable distribution (sid), the problem was fixed in version\n0.99.80~rc4-1.
\nWe recommend that you upgrade your alsaplayer packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Schmidt and Daniel Morissette discovered two vulnerabilities\nin mapserver, a development environment for spatial and mapping\napplications. The Common Vulnerabilities and Exposures project\nidentifies the following two problems:
\nLack of input sanitizing and output escaping in the CGI\n mapserver's template handling and error reporting routines leads\n to cross-site scripting vulnerabilities.
Missing bounds checking in mapserver's template handling leads to\n a stack-based buffer overrun vulnerability, allowing a remote\n attacker to execute arbitrary code with the privileges of the CGI\n or httpd user.
For the stable distribution (etch), these problems have been fixed in\nversion 4.10.0-5.1+etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.10.3-1.
\nWe recommend that you upgrade your mapserver (4.10.0-5.1+etch2) package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that lighttpd, a fast webserver with minimal memory\nfootprint, didn't correctly handle SSL errors. This could allow\na remote attacker to disconnect all active SSL connections.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.4.13-4etch7.
\nWe recommend that you upgrade your lighttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in OpenLDAP, a\nfree implementation of the Lightweight Directory Access Protocol. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nThomas Sesselmann discovered that slapd could be crashed by a\n malformed modify requests.
Toby Blade discovered that incorrect memory handling in slapo-pcache\n could lead to denial of service through crafted search requests.
It was discovered that a programming error in the interface to the\n BDB storage backend could lead to denial of service through\n crafted modify requests.
It was discovered that a programming error in the interface to the\n BDB storage backend could lead to denial of service through\n crafted modrdn requests.
For the stable distribution (etch), these problems have been fixed in\nversion 2.3.30-5+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.4.7-6.1.
\nWe recommend that you upgrade your openldap2.3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter Valchev (Google Security) discovered a series of integer\noverflow weaknesses in Cairo, a vector graphics rendering library used\nby many other applications. If an application uses cairo to render a\nmaliciously crafted PNG image, the vulnerability allows the execution\nof arbitrary code.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.2.4-4.1+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.4.10-1.1.
\nWe recommend that you upgrade your libcairo packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuigi Auriemma, Alin Rad Pop, R\u00e9mi Denis-Courmont, Quovodis, Guido\nLandi, Felipe Manzano, Anibal Sacco and others discovered multiple\nvulnerabilities in vlc, an application for playback and streaming of\naudio and video. In the worst case, these weaknesses permit a remote,\nunauthenticated attacker to execute arbitrary code with the privileges\nof the user running vlc.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing eight problems:
\nA buffer overflow vulnerability in subtitle handling allows an\n attacker to execute arbitrary code through the opening of a\n maliciously crafted MicroDVD, SSA or Vplayer file.
A format string vulnerability in the HTTP-based remote control\n facility of the vlc application allows a remote, unauthenticated\n attacker to execute arbitrary code.
Insecure argument validation allows a remote attacker to overwrite\n arbitrary files writable by the user running vlc, if a maliciously\n crafted M3U playlist or MP3 audio file is opened.
Heap buffer overflows in RTSP stream and session description\n protocol (SDP) handling allow an attacker to execute arbitrary\n code if a maliciously crafted RTSP stream is played.
Insufficient integer bounds checking in SDP handling allows the\n execution of arbitrary code through a maliciously crafted SDP\n stream ID parameter in an RTSP stream.
Insufficient integrity checking in the MP4 demuxer allows a remote\n attacker to overwrite arbitrary memory and execute arbitrary code\n if a maliciously crafted MP4 file is opened.
An integer overflow vulnerability in MP4 handling allows a remote\n attacker to cause a heap buffer overflow, inducing a crash and\n possibly the execution of arbitrary code if a maliciously crafted\n MP4 file is opened.
For the stable distribution (etch), these problems have been fixed in\nversion 0.8.6-svn20061012.debian-5.1+etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.8.6.e-2.
\nWe recommend that you upgrade your vlc packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAmit Klein discovered that pdns-recursor, a caching DNS resolver, uses a\nweak random number generator to create DNS transaction IDs and UDP\nsource port numbers. As a result, cache poisoning attacks were\nsimplified. (CVE-2008-1637\nand CVE-2008-3217)
\nFor the stable distribution (etch), these problems have been fixed in\nversion 3.1.4-1+etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.1.7-1.
\nWe recommend that you upgrade your pdns-recursor package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSebastian Krahmer discovered that an integer overflow in rsync's code\nfor handling extended attributes may lead to arbitrary code execution.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.6.9-2etch2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.0.2-1.
\nWe recommend that you upgrade your rsync package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThilo Pfennig and Morten Welinder discovered several integer overflow\nweaknesses in Gnumeric, a GNOME spreadsheet application. These\nvulnerabilities could result in the execution of arbitrary code\nthrough the opening of a maliciously crafted Excel spreadsheet.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.6.3-5+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.8.1-1.
\nWe recommend that you upgrade your gnumeric packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security related problems have been discovered in\nOpenOffice.org, the free office suite. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nSeveral bugs have been discovered in the way OpenOffice.org parses\n Quattro Pro files that may lead to a overflow in the heap\n potentially leading to the execution of arbitrary code.
Specially crafted EMF files can trigger a buffer overflow in the\n heap that may lead to the execution of arbitrary code.
A bug has been discovered in the processing of OLE files that can\n cause a buffer overflow in the heap potentially leading to the\n execution of arbitrary code.
Recently reported problems in the ICU library are fixed in separate\nlibicu packages with DSA 1511 against which OpenOffice.org is linked.
\nFor the old stable distribution (sarge) these problems have been fixed in\nversion 1.1.3-9sarge9.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 2.0.4.dfsg.2-7etch5.
\nFor the testing (lenny) and unstable (sid) distributions these\nproblems have been fixed in version 2.4.0~ooh680m5-1.
\nWe recommend that you upgrade your openoffice.org packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nKees Cook discovered a vulnerability in xpdf, a set of tools for\ndisplay and conversion of Portable Document Format (PDF) files. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblem:
\nXpdf's handling of embedded fonts lacks sufficient validation\n and type checking. If a maliciously crafted PDF file is opened,\n the vulnerability may allow the execution of arbitrary code with\n the privileges of the user running xpdf.
For the stable distribution (etch), these problems have been fixed in\nversion 3.01-9.1+etch4.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.02-1.2.
\nWe recommend that you upgrade your xpdf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Clam anti-virus\ntoolkit. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nDamian Put discovered that a buffer overflow in the handler for\n PeSpin binaries may lead to the execution of arbitrary code.
Alin Rad Pop discovered that a buffer overflow in the handler for\n Upack PE binaries may lead to the execution of arbitrary code.
\nDamian Put and Thomas Pollet discovered that a buffer overflow in\n the handler for WWPack-compressed PE binaries may lead to the\n execution of arbitrary code.
For the stable distribution (etch) these problems have been fixed\nin version 0.90.1dfsg-3etch11.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.92.1~dfsg2-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that suphp, an Apache module to run PHP scripts with\nowner permissions handles symlinks insecurely, which may lead to\nprivilege escalation by local users.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.6.2-1+etch0.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your suphp packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the interpreter for the\nPython language. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nPiotr Engelking discovered that the strxfrm() function of the locale\n module miscalculates the length of an internal buffer, which may\n result in a minor information disclosure.
It was discovered that several integer overflows in the imageop\n module may lead to the execution of arbitrary code, if a user is\n tricked into processing malformed images. This issue is also\n tracked as CVE-2008-1679 due to an initially incomplete patch.
Justin Ferguson discovered that a buffer overflow in the zlib\n module may lead to the execution of arbitrary code.
Justin Ferguson discovered that insufficient input validation in\n PyString_FromStringAndSize() may lead to the execution of arbitrary\n code.
For the stable distribution (etch), these problems have been fixed in\nversion 2.4.4-3+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.4.5-2.
\nWe recommend that you upgrade your python2.4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the MPlayer movie player performs insufficient\ninput sanitising on SDP session data, leading to potential execution\nof arbitrary code through a malformed multimedia stream.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.0~rc1-12etch3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.0~rc2-10.
\nWe recommend that you upgrade your mplayer package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that ikiwiki, a Wiki implementation, does not\nguard password and content changes against cross-site request forgery\n(CSRF) attacks.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.33.5.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.42.
\nWe recommend that you upgrade your ikiwiki package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRoundup, an issue tracking system, fails to properly escape HTML input,\nallowing an attacker to inject client-side code (typically JavaScript)\ninto a document that may be viewed in the victim's browser.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.2.1-5+etch2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.3-3.1.
\nWe recommend that you upgrade your roundup packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that crashes in the Javascript engine of Iceweasel,\nan unbranded version of the Firefox browser, could potentially lead to\nthe execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.0.0.14-0etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.0.0.14-1.
\nWe recommend that you upgrade your iceweasel package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that the Perl interpreter may encounter a buffer\noverflow condition when compiling certain regular expressions containing\nUnicode characters. This also happens if the offending characters are\ncontained in a variable reference protected by the \\Q...\\E quoting\nconstruct. When encountering this condition, the Perl interpreter\ntypically crashes, but arbitrary code execution cannot be ruled out.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.8.8-7etch3.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your perl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in phpMyAdmin,\nan application to administrate MySQL over the WWW. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nAttackers with CREATE table permissions were allowed to read\n arbitrary files readable by the webserver via a crafted\n HTTP POST request.
The PHP session data file stored the username and password of\n a logged in user, which in some setups can be read by a local\n user.
Cross site scripting and SQL injection were possible by attackers\n that had permission to create cookies in the same cookie domain\n as phpMyAdmin runs in.
For the stable distribution (etch), these problems have been fixed in\nversion 4:2.9.1.1-7.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4:2.11.5.2-1.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that crashes in the Javascript engine of xulrunner,\nthe Gecko engine library, could potentially lead to the execution of\narbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.8.0.15~pre080323b-0etch2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.8.1.14-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that phpGedView, an application to provide online access\nto genealogical data, performed insufficient input sanitising on some\nparameters, making it vulnerable to cross site scripting.
\nFor the stable distribution (etch), this problem has been fixed in version\n4.0.2.dfsg-3.
\nFor the unstable distribution (sid), this problem has been fixed in version\n4.1.e+4.1.1-2.
\nWe recommend that you upgrade your phpgedview package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"The-0utl4w\" discovered that the Kronolith, calendar component for\nthe Horde Framework, didn't properly sanitise URL input, leading to\na cross-site scripting vulnerability in the add event screen.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.1.4-1etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.1.8-1.
\nWe recommend that you upgrade your kronolith2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChristian Herzog discovered that within the Linux Terminal Server Project,\nit was possible to connect to X on any LTSP client from any host on the\nnetwork, making client windows and keystrokes visible to that host.
\nNOTE: most ldm installs are likely to be in a chroot environment exported\nover NFS, and will not be upgraded merely by upgrading the server itself.\nFor example, on the i386 architecture, to upgrade ldm will likely require:
\nchroot /opt/ltsp/i386 apt-get update\n chroot /opt/ltsp/i386 apt-get dist-upgrade\n
For the stable distribution (etch), this problem has been fixed in\nversion 0.99debian11+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2:0.1~bzr20080308-1.
\nWe recommend that you upgrade your ldm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that crashes in the JavaScript engine of Iceape,\nan unbranded version of the Seamonkey internet suite could\npotentially lead to the execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.0.13~pre080323b-0etch3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.9-2.
\nWe recommend that you upgrade your iceape packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJoel R. Voss discovered that the IAX2 module of Asterisk, a free\nsoftware PBX and telephony toolkit performs insufficient validation of\nIAX2 protocol messages, which may lead to denial of service.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.2.13~dfsg-2etch4.
\nFor the unstable distribution (sid), this problem has been fixed\nin version 1.4.19.1~dfsg-1.
\nWe recommend that you upgrade your asterisk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in WordPress,\na weblog manager. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nInsufficient input sanitising allowed for remote attackers to\n redirect visitors to external websites.
Multiple cross-site scripting vulnerabilities allowed remote\n authenticated administrators to inject arbitrary web script or HTML.
SQL injection vulnerability allowed allowed remote authenticated\n administrators to execute arbitrary SQL commands.
WordPress allows remote attackers to cause a denial of service\n (bandwidth or thread consumption) via pingback service calls with\n a source URI that corresponds to a file with a binary content type,\n which is downloaded even though it cannot contain usable pingback data.
Insufficient input sanitising caused an attacker with a normal user\n account to access the administrative interface.
For the stable distribution (etch), these problems have been fixed in version\n2.0.10-1etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.2.3-1.
\nWe recommend that you upgrade your wordpress package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the Linux kernel\nthat may lead to a denial of service or the execution of arbitrary\ncode. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nCyrill Gorcunov reported a NULL pointer dereference in code specific\n to the CHRP PowerPC platforms. Local users could exploit this issue\n to achieve a Denial of Service (DoS).
Nick Piggin of SuSE discovered a number of issues in subsystems which\n register a fault handler for memory mapped areas. This issue can be\n exploited by local users to achieve a Denial of Service (DoS) and possibly\n execute arbitrary code.
David Peer discovered that users could escape administrator imposed cpu\n time limitations (RLIMIT_CPU) by setting a limit of 0.
Alexander Viro discovered a race condition in the directory notification\n subsystem that allows local users to cause a Denial of Service (oops)\n and possibly result in an escalation of privileges.
For the stable distribution (etch), these problems have been fixed in version\n2.6.18.dfsg.1-18etch3.
\nThe unstable (sid) and testing distributions will be fixed soon.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDmitry Levin discovered a vulnerability in path handling code used by\nthe cpio archive utility. The weakness could enable a denial of\nservice (crash) or potentially the execution of arbitrary code if a\nvulnerable version of cpio is used to extract or to list the contents\nof a maliciously crafted archive.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2.6-18.1+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.9-5.
\nWe recommend that you upgrade your cpio packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Cornelius discovered a vulnerability in the Radiance High\nDynamic Range (HDR) image parser in Blender, a 3D modelling\napplication. The weakness could enable a stack-based buffer overflow\nand the execution of arbitrary code if a maliciously-crafted HDR file\nis opened, or if a directory containing such a file is browsed via\nBlender's image-open dialog.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2.42a-7.1+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.45-5.
\nWe recommend that you upgrade your blender packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\"unsticky\" discovered that b2evolution, a blog engine, performs insufficient\ninput sanitising, allowing for cross site scripting.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.9.2-3+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.9.2-4.
\nWe recommend that you upgrade your b2evolution package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Cacti, a systems and services monitoring frontend,\nperformed insufficient input sanitising, leading to cross site scripting\nand SQL injection being possible.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.8.6i-3.4.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.8.7b-1.
\nWe recommend that you upgrade your cacti package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndrews Salomon reported that kazehakase, a GTK+-based web browser that\nallows pluggable rendering engines, contained an embedded copy of the\nPCRE library in its source tree which was compiled in and used in preference\nto the system-wide version of this library.
\nThe PCRE library has been updated to fix the security issues reported\nagainst it in previous Debian Security Advisories. This update ensures that\nkazehakase uses that supported library, and not its own embedded and\ninsecure version.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.4.2-1etch1.
\nWe recommend that you upgrade your kazehakase package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLuciano Bello discovered that the random number generator in Debian's\nopenssl package is predictable. This is caused by an incorrect\nDebian-specific change to the openssl package (CVE-2008-0166). As a\nresult, cryptographic key material may be guessable.
\nThis is a Debian-specific vulnerability which does not affect other\noperating systems which are not based on Debian. However, other systems\ncan be indirectly affected if weak keys are imported into them.
\nIt is strongly recommended that all cryptographic key material which has\nbeen generated by OpenSSL versions starting with 0.9.8c-1 on Debian\nsystems is recreated from scratch. Furthermore, all DSA keys ever used\non affected Debian systems for signing or authentication purposes should\nbe considered compromised; the Digital Signature Algorithm relies on a\nsecret random value used during signature generation.
\nThe first vulnerable version, 0.9.8c-1, was uploaded to the unstable\ndistribution on 2006-09-17, and has since that date propagated to the testing and\ncurrent stable (etch) distributions. The old stable distribution\n(sarge) is not affected.
\nAffected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key\nmaterial for use in X.509 certificates and session keys used in SSL/TLS\nconnections. Keys generated with GnuPG or GNUTLS are not affected,\nthough.
\nA detector for known weak key material will be published at:
\nhttp://security.debian.org/project/extra/dowkd/dowkd.pl.gz\n(OpenPGP signature)
\nInstructions how to implement key rollover for various packages will be\npublished at:
\nhttps://www.debian.org/security/key-rollover/
\nThis web site will be continuously updated to reflect new and updated\ninstructions on key rollovers for packages using SSL certificates.\nPopular packages not affected will also be listed.
\nIn addition to this critical change, two other vulnerabilities have been\nfixed in the openssl package which were originally scheduled for release\nwith the next etch point release: OpenSSL's DTLS (Datagram TLS,\nbasically SSL over UDP
) implementation did not actually implement the\nDTLS specification, but a potentially much weaker protocol, and\ncontained a vulnerability permitting arbitrary code execution\n(CVE-2007-4995). A side channel attack in the integer multiplication\nroutines is also addressed (CVE-2007-3108).
For the stable distribution (etch), these problems have been fixed in\nversion 0.9.8c-4etch3.
\nFor the unstable distribution (sid) and the testing distribution\n(lenny), these problems have been fixed in version 0.9.8g-9.
\nWe recommend that you upgrade your openssl package and subsequently\nregenerate any cryptographic material, as outlined above.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in PHP, a server-side,\nHTML-embedded scripting language. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nThe glob function allows context-dependent attackers to cause\n a denial of service and possibly execute arbitrary code via\n an invalid value of the flags parameter.
Integer overflow allows context-dependent attackers to cause\n a denial of service and possibly have other impact via a\n printf format parameter with a large width specifier.
Stack-based buffer overflow in the FastCGI SAPI.
The escapeshellcmd API function could be attacked via\n incomplete multibyte chars.
For the stable distribution (etch), these problems have been fixed in\nversion 5.2.0-8+etch11.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 5.2.6-1.
\nWe recommend that you upgrade your php5 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in rdesktop, a\nRemote Desktop Protocol client. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nRemote exploitation of an integer underflow vulnerability allows\n attackers to execute arbitrary code with the privileges of the\n logged-in user.
Remote exploitation of a BSS overflow vulnerability allows\n attackers to execute arbitrary code with the privileges of the\n logged-in user.
Remote exploitation of an integer signedness vulnerability allows\n attackers to execute arbitrary code with the privileges of the\n logged-in user.
For the stable distribution (etch), these problems have been fixed in\nversion 1.5.0-1etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.5.0-4+cvs20071006.
\nWe recommend that you upgrade your rdesktop package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Icedove mail\nclient, an unbranded version of the Thunderbird client. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nmoz_bug_r_a4
discovered that variants of CVE-2007-3738 and\n CVE-2007-5338 allow the execution of arbitrary code through\n XPCNativeWrapper.
moz_bug_r_a4
discovered that insecure handling of event\n handlers could lead to cross-site scripting.
Boris Zbarsky, Johnny Stenback and moz_bug_r_a4
discovered\n that incorrect principal handling could lead to cross-site\n scripting and the execution of arbitrary code.
Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett and Mats\n Palmgren discovered crashes in the layout engine, which might\n allow the execution of arbitrary code.
georgi
, tgirmann
and Igor Bukanov discovered crashes in the\n Javascript engine, which might allow the execution of arbitrary\n code.
For the stable distribution (etch), these problems have been fixed in\nversion 1.5.0.13+1.5.0.15b.dfsg1+prepatch080417a-0etch1.
\nWe recommend that you upgrade your icedove packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in the Linux kernel that may lead\nto a denial of service. The Common Vulnerabilities and Exposures\nproject identifies the following problem:
\nAlexander Viro discovered a race condition in the fcntl code that\n may permit local users on multi-processor systems to execute parallel\n code paths that are otherwise prohibited and gain re-ordered access\n to the descriptor table.
For the stable distribution (etch), this problem has been fixed in version\n2.6.18.dfsg.1-18etch4.
\nFor the unstable distribution (sid), this problem has been fixed in version\n2.6.25-2.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe recently announced vulnerability in Debian's openssl package\n(DSA-1571-1, CVE-2008-0166) indirectly affects OpenSSH. As a result,\nall user and host keys generated using broken versions of the openssl\npackage must be considered untrustworthy, even after the openssl update\nhas been applied.
\n1. Install the security updates
\nThis update contains a dependency on the openssl update and will\n automatically install a corrected version of the libssl0.9.8 package,\n and a new package openssh-blacklist.
\nOnce the update is applied, weak user keys will be automatically\n rejected where possible (though they cannot be detected in all\n cases). If you are using such keys for user authentication, they\n will immediately stop working and will need to be replaced (see\n step 3).
\nOpenSSH host keys can be automatically regenerated when the OpenSSH\n security update is applied. The update will prompt for confirmation\n before taking this step.
\n2. Update OpenSSH known_hosts files
\nThe regeneration of host keys will cause a warning to be displayed when\n connecting to the system using SSH until the host key is updated in the\n known_hosts file. The warning will look like this:
\n\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\nIT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!\nSomeone could be eavesdropping on you right now (man-in-the-middle attack)!\nIt is also possible that the RSA host key has just been changed.\n\n
In this case, the host key has simply been changed, and you should update\n the relevant known_hosts file as indicated in the error message.\n It is recommended that you use a trustworthy channel to exchange the\n server key. It is found in the file /etc/ssh/ssh_host_rsa_key.pub on\n the server; it's fingerprint can be printed using the command:
\nssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub
\nIn addition to user-specific known_hosts files, there may be a\n system-wide known hosts file /etc/ssh/ssh_known_hosts. This is file is\n used both by the ssh client and by sshd for the hosts.equiv\n functionality. This file needs to be updated as well.
\n3. Check all OpenSSH user keys
\nThe safest course of action is to regenerate all OpenSSH user keys,\n except where it can be established to a high degree of certainty that the\n key was generated on an unaffected system.
\nCheck whether your key is affected by running the ssh-vulnkey tool, included\n in the security update. By default, ssh-vulnkey will check the standard\n location for user keys (~/.ssh/id_rsa, ~/.ssh/id_dsa and ~/.ssh/identity),\n your authorized_keys file (~/.ssh/authorized_keys and\n ~/.ssh/authorized_keys2), and the system's host keys\n (/etc/ssh/ssh_host_dsa_key and /etc/ssh/ssh_host_rsa_key).
\nTo check all your own keys, assuming they are in the standard\n locations (~/.ssh/id_rsa, ~/.ssh/id_dsa, or ~/.ssh/identity):
\nssh-vulnkey
\nTo check all keys on your system:
\nsudo ssh-vulnkey -a
\nTo check a key in a non-standard location:
\nssh-vulnkey /path/to/key
\nIf ssh-vulnkey says \"Unknown (no blacklist information)\", then it has no\n information about whether that key is affected. In this case, you\n can examine the modification time (mtime) of the file using \"ls -l\".\n Keys generated before September 2006 are not affected. Keep in mind\n that, although unlikely, backup procedures may have changed the file\n date back in time (or the system clock may have been incorrectly\n set).\n If in doubt, generate a new key and remove the old one from any\n servers.
\n4. Regenerate any affected user keys
\nOpenSSH keys used for user authentication must be manually regenerated,\n including those which may have since been transferred to a different system\n after being generated.
\nNew keys can be generated using ssh-keygen, e.g.:
\n\n $ ssh-keygen\n Generating public/private rsa key pair.\n Enter file in which to save the key (/home/user/.ssh/id_rsa):\n Enter passphrase (empty for no passphrase):\n Enter same passphrase again:\n Your identification has been saved in /home/user/.ssh/id_rsa.\n Your public key has been saved in /home/user/.ssh/id_rsa.pub.\n The key fingerprint is:\n 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00 user@host\n\n
5. Update authorized_keys files (if necessary)
\nOnce the user keys have been regenerated, the relevant public keys\n must be propagated to any authorized_keys files (and authorized_keys2\n files, if applicable) on remote systems. Be sure to delete the lines\n containing old keys from those files.
\nIn addition to countermeasures to mitigate the randomness vulnerability,\nthis OpenSSH update fixes several other vulnerabilities:
\nCVE-2008-1483:\n Timo Juhani Lindfors discovered that, when using X11 forwarding, the\n SSH client selects an X11 forwarding port without ensuring that it\n can be bound on all address families. If the system is configured\n with IPv6 (even if it does not have working IPv6 connectivity), this\n could allow a local attacker on the remote server to hijack X11\n forwarding.
\nCVE-2007-4752:\n Jan Pechanec discovered that ssh falls back to creating a trusted X11\n cookie if creating an untrusted cookie fails, potentially exposing\n the local display to a malicious remote server when using X11\n forwarding.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 4.3p2-9etch1. Currently, only a subset of all supported\narchitectures have been built; further updates will be provided when\nthey become available.
\nFor the unstable distribution (sid) and the testing distribution\n(lenny), these problems have been fixed in version 4.7p1-9.
\nWe recommend that you upgrade your openssh packages and take the\nmeasures indicated above.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStephen Gran and Mark Hymers discovered that some scripts run by GForge,\na collaborative development tool, open files in write mode in a potentially\ninsecure manner. This may be exploited to overwrite arbitrary files on the\nlocal system.
\nFor the stable distribution (etch), this problem has been fixed in version\n4.5.14-22etch8.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your gforge package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in PHP version 4, a\nserver-side, HTML-embedded scripting language. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nThe session_start function allows remote attackers to insert\n arbitrary attributes into the session cookie via special characters\n in a cookie that is obtained from various parameters.
A denial of service was possible through a malicious script abusing\n the glob() function.
Certain maliciously constructed input to the wordwrap() function could\n lead to a denial of service attack.
Large len values of the stspn() or strcspn() functions could allow an\n attacker to trigger integer overflows to expose memory or cause denial\n of service.
The escapeshellcmd API function could be attacked via incomplete\n multibyte chars.
For the stable distribution (etch), these problems have been fixed in\nversion 6:4.4.4-8+etch6.
\nThe php4 packages are no longer present the unstable distribution (sid).
\nWe recommend that you upgrade your php4 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability was discovered in the GIF reader implementation in\nnetpbm-free, a suite of image manipulation utilities. Insufficient\ninput data validation could allow a maliciously-crafted GIF file\nto overrun a stack buffer, potentially permitting the execution of\narbitrary code.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2:10.0-11.1+etch1.
\nFor the unstable distribution (sid), these problems were fixed in\nversion 2:10.0-11.1.
\nWe recommend that you upgrade your netpbm packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that phpGedView, an application to provide online access\nto genealogical data, allowed remote attackers to gain administrator\nprivileges due to a programming error.
\nNote: this problem was a fundamental design flaw in the interface (API) to\nconnect phpGedView with external programs like content management systems.\nResolving this problem was only possible by completely reworking the API,\nwhich is not considered appropriate for a security update. Since these are\nperipheral functions probably not used by the large majority of package\nusers, it was decided to remove these interfaces. If you require that\ninterface nonetheless, you are advised to use a version of phpGedView\nbackported from Debian Lenny, which has a completely redesigned API.
\nFor the stable distribution (etch), this problem has been fixed in version\n4.0.2.dfsg-4.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 4.1.e+4.1.5-1.
\nWe recommend that you upgrade your phpgedview package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in GNUTLS, an\nimplementation of the SSL/TLS protocol suite.
\nNOTE: The libgnutls13 package, which provides the GNUTLS library, does\nnot contain logic to automatically restart potentially affected\nservices. You must restart affected services manually (mainly Exim,\nusing /etc/init.d/exim4 restart
) after applying the update, to make\nthe changes fully effective. Alternatively, you can reboot the system.
The Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nA pre-authentication heap overflow involving oversized session\n resumption data may lead to arbitrary code execution.
Repeated client hellos may result in a pre-authentication denial of\n service condition due to a null pointer dereference.
Decoding cipher padding with an invalid record length may cause GNUTLS\n to read memory beyond the end of the received record, leading to a\n pre-authentication denial of service condition.
For the stable distribution (etch), these problems have been fixed in\nversion 1.4.4-3+etch1. (Builds for the arm architecture are currently\nnot available and will be released later.)
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your GNUTLS packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNico Golde discovered that PeerCast, a P2P audio and video streaming\nserver, is vulnerable to a buffer overflow in the HTTP Basic\nAuthentication code, allowing a remote attacker to crash PeerCast or\nexecute arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.1217.toots.20060314-1etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.1218+svn20080104-1.1.
\nWe recommend that you upgrade your peercast package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in GNOME PeerCast,\nthe GNOME interface to PeerCast, a P2P audio and video streaming\nserver. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nLuigi Auriemma discovered that PeerCast is vulnerable to a heap\n overflow in the HTTP server code, which allows remote attackers to\n cause a denial of service and possibly execute arbitrary code via a\n long SOURCE request.
Nico Golde discovered that PeerCast, a P2P audio and video streaming\n server, is vulnerable to a buffer overflow in the HTTP Basic\n Authentication code, allowing a remote attacker to crash PeerCast or\n execute arbitrary code.
For the stable distribution (etch), these problems have been fixed in\nversion 0.5.4-1.1etch0.
\ngnome-peercast has been removed from the unstable distribution (sid).
\nWe recommend that you upgrade your gnome-peercast package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that libfishsound, a simple programming interface that\nwraps Xiph.Org audio codecs, didn't correctly handle negative values in\na particular header field. This could allow malicious files to execute\narbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.7.0-2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.7.0-2.2.
\nWe recommend that you upgrade your libfishsound package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that speex, the Speex codec command line tools, did\nnot correctly deal with negative offsets in a particular\nheader field. This could allow a malicious file to execute arbitrary\ncode.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.1.12-3etch1.
\nWe recommend that you upgrade your speex package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities have been discovered in xine-lib, a library\nwhich supplies most of the application functionality of the xine\nmultimedia player. The Common Vulnerabilities and Exposures project\nidentifies the following three problems:
\nInteger overflow vulnerabilities exist in xine's FLV, QuickTime,\n RealMedia, MVE and CAK demuxers, as well as the EBML parser used\n by the Matroska demuxer. These weaknesses allow an attacker to\n overflow heap buffers and potentially execute arbitrary code by\n supplying a maliciously crafted file of those types.
Insufficient input validation in the Speex implementation used\n by this version of xine enables an invalid array access and the\n execution of arbitrary code by supplying a maliciously crafted\n Speex file.
Inadequate bounds checking in the NES Sound Format (NSF) demuxer\n enables a stack buffer overflow and the execution of arbitrary\n code through a maliciously crafted NSF file.
For the stable distribution (etch), these problems have been fixed in\nversion 1.1.2+dfsg-7.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.1.12-2.
\nWe recommend that you upgrade your xine-lib packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAdam Zabrocki discovered that under certain circumstances mtr, a full\nscreen ncurses and X11 traceroute tool, could be tricked into executing\narbitrary code via overly long reverse DNS records.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.71-2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.73-1.
\nWe recommend that you upgrade your mtr package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that may\nlead to a denial of service. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nJohannes Bauer discovered an integer overflow condition in the hrtimer\n subsystem on 64-bit systems. This can be exploited by local users to\n trigger a denial of service (DoS) by causing the kernel to execute an\n infinite loop.
Jan Kratochvil reported a local denial of service condition that\n permits local users on systems running the amd64 flavor kernel\n to cause a system crash.
Paul Harks discovered a memory leak in the Simple Internet Transition\n (SIT) code used for IPv6 over IPv4 tunnels. This can be exploited\n by remote users to cause a denial of service condition.
David Miller and Jan Lieskovsky discovered issues with the virtual\n address range checking of mmaped regions on the sparc architecture\n that may be exploited by local users to cause a denial of service.
For the stable distribution (etch), this problem has been fixed in version\n2.6.18.dfsg.1-18etch5.
\nBuilds for linux-2.6/s390 and fai-kernels/powerpc were not yet available at\nthe time of this advisory. This advisory will be updated as these builds\nbecome available.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that libxslt, an XSLT processing runtime library,\ncould be coerced into executing arbitrary code via a buffer overflow\nwhen an XSL style sheet file with a long XSLT \"transformation match\"\ncondition triggered a large number of steps.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.1.19-2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.24-1.
\nWe recommend that you upgrade your libxslt package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlin Rad Pop discovered that Samba contained a buffer overflow condition\nwhen processing certain responses received while acting as a client,\nleading to arbitrary code execution (CVE-2008-1105).
\nFor the stable distribution (etch), this problem has been fixed in version\n3.0.24-6etch10.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.0.30-1.
\nWe recommend that you upgrade your samba packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local (remote) vulnerabilities have been discovered in libvorbis,\na library for the Vorbis general-purpose compressed audio codec. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nlibvorbis does not properly handle a zero value which allows remote\n attackers to cause a denial of service (crash or infinite loop) or\n trigger an integer overflow.
Integer overflow in libvorbis allows remote attackers to execute\n arbitrary code via a crafted OGG file, which triggers a heap overflow.
Integer overflow in libvorbis allows remote attackers to cause a denial\n of service (crash) or execute arbitrary code via a crafted OGG file\n which triggers a heap overflow.
For the stable distribution (etch), these problems have been fixed in version\n1.1.2.dfsg-1.4.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.2.0.dfsg-3.1.
\nWe recommend that you upgrade your libvorbis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in the Linux kernel that may\nlead to a denial of service or arbitrary code execution. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nWei Wang from McAfee reported a potential heap overflow in the\n ASN.1 decode code that is used by the SNMP NAT and CIFS\n subsystem. Exploitation of this issue may lead to arbitrary code\n execution. This issue is not believed to be exploitable with the\n pre-built kernel images provided by Debian, but it might be an\n issue for custom images built from the Debian-provided source\n package.
Brandon Edwards of McAfee Avert labs discovered an issue in the\n DCCP subsystem. Due to missing feature length checks it is possible\n to cause an overflow that may result in remote arbitrary code\n execution.
For the stable distribution (etch) these problems have been fixed in\nversion 2.6.18.dfsg.1-18etch6.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Host Manager web application performed\ninsufficient input sanitising, which could lead to cross-site scripting.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.5.20-2etch3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 5.5.26-3.
\nWe recommend that you upgrade your tomcat5.5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Cornelius discovered two buffer overflows in Imlib's - a powerful\nimage loading and rendering library - image loaders for PNM and XPM\nimages, which may result in the execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.3.0.0debian1-4+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.4.0-1.1.
\nWe recommend that you upgrade your imlib2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the X Window system.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nLack of validation of the parameters of the\n SProcSecurityGenerateAuthorization and SProcRecordCreateContext\n functions makes it possible for a specially crafted request to trigger\n the swapping of bytes outside the parameter of these requests, causing\n memory corruption.
An integer overflow in the validation of the parameters of the\n ShmPutImage() request makes it possible to trigger the copy of\n arbitrary server memory to a pixmap that can subsequently be read by\n the client, to read arbitrary parts of the X server memory space.
An integer overflow may occur in the computation of the size of the\n glyph to be allocated by the AllocateGlyph() function which will cause\n less memory to be allocated than expected, leading to later heap\n overflow.
An integer overflow may occur in the computation of the size of the\n glyph to be allocated by the ProcRenderCreateCursor() function which\n will cause less memory to be allocated than expected, leading later\n to dereferencing un-mapped memory, causing a crash of the X server.
Integer overflows can also occur in the code validating the parameters\n for the SProcRenderCreateLinearGradient, SProcRenderCreateRadialGradient\n and SProcRenderCreateConicalGradient functions, leading to memory\n corruption by swapping bytes outside of the intended request\n parameters.
For the stable distribution (etch), these problems have been fixed in version\n2:1.1.1-21etch5.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2:1.4.1~git20080517-2.
\nWe recommend that you upgrade your xorg-server package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the TYPO3 content\nmanagement framework.
\nBecause of a not sufficiently secure default value of the TYPO3\nconfiguration variable fileDenyPattern, authenticated backend users\ncould upload files that allowed to execute arbitrary code as the\nwebserver user.
\nUser input processed by fe_adminlib.inc is not being properly filtered\nto prevent Cross Site Scripting (XSS) attacks, which is exposed when\nspecific plugins are in use.
\nFor the stable distribution (etch), these problems have been fixed in version\n4.0.2+debian-5.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.1.7-1.
\nWe recommend that you upgrade your typo3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThree vulnerabilities have been discovered in the mt-daapd DAAP audio\nserver (also known as the Firefly Media Server). The Common\nVulnerabilities and Exposures project identifies the following three\nproblems:
\nInsufficient validation and bounds checking of the Authorization:\n HTTP header enables a heap buffer overflow, potentially enabling\n the execution of arbitrary code.
Format string vulnerabilities in debug logging within the\n authentication of XML-RPC requests could enable the execution of\n arbitrary code.
An integer overflow weakness in the handling of HTTP POST\n variables could allow a heap buffer overflow and potentially\n arbitrary code execution.
For the stable distribution (etch), these problems have been fixed in\nversion 0.2.4+r1376-1.1+etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.9~r1696-1.4.
\nWe recommend that you upgrade your mt-daapd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a buffer overflow in the GIF image parsing code\nof Tk, a cross-platform graphical toolkit, could lead to denial of\nservice and potentially the execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in version\n1:1.3-15etch2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:1.3-release-7.
\nWe recommend that you upgrade your libtk-img package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nHavoc Pennington discovered that DBus, a simple interprocess messaging\nsystem, performs insufficient validation of security policies, which\nmight allow local privilege escalation.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.0.2-1+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.20-1.
\nWe recommend that you upgrade your dbus packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that sympa, a modern mailing list manager, would\ncrash when processing certain types of malformed messages.
\nFor the stable distribution (etch), this problem has been fixed in version\n5.2.3-1.2+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 5.3.4-4.
\nWe recommend that you upgrade your sympa package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Wordpress,\nthe weblog manager. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nWordPress allows remote attackers to redirect authenticated users\n to other websites and potentially obtain sensitive information.
The XML-RPC implementation, when registration is enabled, allows\n remote attackers to edit posts of other blog users.
For the stable distribution (etch), these problems have been fixed in\nversion 2.0.10-1etch3.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.3.3-1.
\nWe recommend that you upgrade your wordpress package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy discovered that PCRE, the Perl-Compatible Regular\nExpression library, may encounter a heap overflow condition when\ncompiling certain regular expressions involving in-pattern options and\nbranches, potentially leading to arbitrary code execution.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.7+7.4-4.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your pcre3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Kaminsky discovered that properties inherent to the DNS protocol\nlead to practical DNS cache poisoning attacks. Among other things,\nsuccessful attacks can lead to misdirected web traffic and email\nrerouting.
\nThis update changes Debian's BIND 9 packages to implement the\nrecommended countermeasure: UDP query source port randomization. This\nchange increases the size of the space from which an attacker has to\nguess values in a backwards-compatible fashion and makes successful\nattacks significantly more difficult.
\nNote that this security update changes BIND network behavior in a\nfundamental way, and the following steps are recommended to ensure a\nsmooth upgrade.
\n1. Make sure that your network configuration is compatible with source\nport randomization. If you guard your resolver with a stateless packet\nfilter, you may need to make sure that no non-DNS services listen on\nthe 1024--65535 UDP port range and open it at the packet filter. For\ninstance, packet filters based on etch's Linux 2.6.18 kernel only\nsupport stateless filtering of IPv6 packets, and therefore pose this\nadditional difficulty. (If you use IPv4 with iptables and ESTABLISHED\nrules, networking changes are likely not required.)
\n2. Install the BIND 9 upgrade, using \"apt-get update\" followed by\n\"apt-get install bind9\". Verify that the named process has been\nrestarted and answers recursive queries. (If all queries result in\ntimeouts, this indicates that networking changes are necessary; see the\nfirst step.)
\n3. Verify that source port randomization is active. Check that the\n/var/log/daemon.log file does not contain messages of the following\nform
\nnamed[6106]: /etc/bind/named.conf.options:28: using specific query-source port suppresses port randomization and can be insecure.\n
right after the \"listening on IPv6 interface\" and \"listening on IPv4\ninterface\" messages logged by BIND upon startup. If these messages are\npresent, you should remove the indicated lines from the configuration,\nor replace the port numbers contained within them with \"*\" sign (e.g.,\nreplace \"port 53\" with \"port *\").
\nFor additional certainty, use tcpdump or some other network monitoring\ntool to check for varying UDP source ports. If there is a NAT device\nin front of your resolver, make sure that it does not defeat the\neffect of source port randomization.
\n4. If you cannot activate source port randomization, consider\nconfiguring BIND 9 to forward queries to a resolver which can, possibly\nover a VPN such as OpenVPN to create the necessary trusted network link.\n(Use BIND's forward-only mode in this case.)
\nOther caching resolvers distributed by Debian (PowerDNS, MaraDNS,\nUnbound) already employ source port randomization, and no updated\npackages are needed. BIND 9.5 up to and including version\n1:9.5.0.dfsg-4 only implements a weak form of source port\nrandomization and needs to be updated as well. For information on\nBIND 8, see DSA-1604-1, and for the status of\nthe libc stub resolver, see DSA-1605-1.
\nThe updated bind9 packages contain changes originally scheduled for\nthe next stable point release, including the changed IP address of\nL.ROOT-SERVERS.NET (Debian bug #449148).
\nFor the stable distribution (etch), this problem has been fixed in\nversion 9.3.4-2etch3.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your bind9 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Kaminsky discovered that properties inherent to the DNS protocol\nlead to practical DNS cache poisoning attacks. Among other things,\nsuccessful attacks can lead to misdirected web traffic and email\nrerouting.
\nThe BIND 8 legacy code base could not be updated to include the\nrecommended countermeasure (source port randomization, see\nDSA-1603-1\nfor details). There are two ways to deal with this situation:
\n1. Upgrade to BIND 9 (or another implementation with source port\nrandomization). The documentation included with BIND 9 contains a\nmigration guide.
\n2. Configure the BIND 8 resolver to forward queries to a BIND 9\nresolver. Provided that the network between both resolvers is trusted,\nthis protects the BIND 8 resolver from cache poisoning attacks (to the\nsame degree that the BIND 9 resolver is protected).
\nThis problem does not apply to BIND 8 when used exclusively as an\nauthoritative DNS server. It is theoretically possible to safely use\nBIND 8 in this way, but updating to BIND 9 is strongly recommended.\nBIND 8 (that is, the bind package) will be removed from the etch\ndistribution in a future point release.
\nDan Kaminsky discovered that properties inherent to the DNS protocol\nlead to practical DNS spoofing and cache poisoning attacks. Among\nother things, successful attacks can lead to misdirected web traffic\nand email rerouting.
\nAt this time, it is not possible to implement the recommended\ncountermeasures in the GNU libc stub resolver. The following\nworkarounds are available:
\n1. Install a local BIND 9 resolver on the host, possibly in\nforward-only mode. BIND 9 will then use source port randomization\nwhen sending queries over the network. (Other caching resolvers can\nbe used instead.)
\n2. Rely on IP address spoofing protection if available. Successful\nattacks must spoof the address of one of the resolvers, which may not\nbe possible if the network is guarded properly against IP spoofing\nattacks (both from internal and external sources).
\nThis DSA will be updated when patches for hardening the stub resolver\nare available.
\nIt was discovered that poppler, a PDF rendering library, did not\nproperly handle embedded fonts in PDF files, allowing attackers to\nexecute arbitrary code via a crafted font object.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.4.5-5.1etch3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.8.0-1.
\nWe recommend that you upgrade your poppler package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel\nwebbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nDevon Hubbard, Jesse Ruderman and Martijn Wargers discovered\n crashes in the layout engine, which might allow the execution of\n arbitrary code.
Igor Bukanov, Jesse Ruderman and Gary Kwong discovered crashes in\n the Javascript engine, which might allow the execution of arbitrary code.
\"moz_bug_r_a4\" discovered several cross-site scripting vulnerabilities.
Collin Jackson and Adam Barth discovered that Javascript code\n could be executed in the context of signed JAR archives.
\"moz_bug_r_a4\" discovered that XUL documents can escalate\n privileges by accessing the pre-compiled \"fastload\" file.
\"moz_bug_r_a4\" discovered that missing input sanitising in the\n mozIJSSubScriptLoader.loadSubScript() function could lead to the\n execution of arbitrary code. Iceweasel itself is not affected, but\n some addons are.
Claudio Santambrogio discovered that missing access validation in\n DOM parsing allows malicious web sites to force the browser to\n upload local files to the server, which could lead to information\n disclosure.
Daniel Glazman discovered that a programming error in the code for\n parsing .properties files could lead to memory content being\n exposed to addons, which could lead to information disclosure.
Masahiro Yamada discovered that file URLS in directory listings\n were insufficiently escaped.
John G. Myers, Frank Benkstein and Nils Toedtmann discovered that\n alternate names on self-signed certificates were handled\n insufficiently, which could lead to spoofings secure connections.
Greg McManus discovered a crash in the block reflow\n code, which might allow the execution of arbitrary code.
For the stable distribution (etch), these problems have been fixed in\nversion 2.0.0.15-0etch1.
\nIceweasel from the unstable distribution (sid) links dynamically\nagainst the xulrunner library.
\nWe recommend that you upgrade your iceweasel package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSergei Golubchik discovered that MySQL, a widely-deployed database\nserver, did not properly validate optional data or index directory\npaths given in a CREATE TABLE statement, nor would it (under proper\nconditions) prevent two databases from using the same paths for data\nor index files. This permits an authenticated user with authorization\nto create tables in one database to read, write or delete data from\ntables subsequently created in other databases, regardless of other\nGRANT authorizations. The Common Vulnerabilities and Exposures\nproject identifies this weakness as CVE-2008-2079.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.0.32-7etch6. Note that the fix applied will have the\nconsequence of disallowing the selection of data or index paths\nunder the database root, which on a Debian system is /var/lib/mysql;\ndatabase administrators needing to control the placement of these\nfiles under that location must do so through other means.
\nWe recommend that you upgrade your mysql-dfsg-5.0 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local/remote vulnerabilities have been discovered in lighttpd,\na fast webserver with minimal memory footprint.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nlighttpd 1.4.18, and possibly other versions before 1.5.0, does not\n properly calculate the size of a file descriptor array, which allows\n remote attackers to cause a denial of service (crash) via a large number\n of connections, which triggers an out-of-bounds access.
connections.c in lighttpd before 1.4.16 might accept more connections\n than the configured maximum, which allows remote attackers to cause a\n denial of service (failed assertion) via a large number of connection\n attempts.
For the stable distribution (etch), these problems have been fixed in\nversion 1.4.13-4etch9.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.4.18-2.
\nWe recommend that you upgrade your lighttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that gaim, an multi-protocol instant messaging client,\nwas vulnerable to several integer overflows in its MSN protocol handlers.\nThese could allow a remote attacker to execute arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in version\n1:2.0.0+beta5-10etch1.
\nFor the unstable distribution (sid), this package is not present.
\nWe recommend that you upgrade your gaim package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAnders Kaseorg discovered that afuse, an automounting file system\nin user-space, did not properly escape meta characters in paths.\nThis allowed a local attacker with read access to the filesystem to\nexecute commands as the owner of the filesystem.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.1.1-1+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.2-3.
\nWe recommend that you upgrade your afuse (0.1.1-1+etch1) package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the interpreter for\nthe Ruby language, which may lead to denial of service or the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nDrew Yao discovered that multiple integer overflows in the string\n processing code may lead to denial of service and potentially the\n execution of arbitrary code.
Drew Yao discovered that multiple integer overflows in the string\n processing code may lead to denial of service and potentially the\n execution of arbitrary code.
Drew Yao discovered that a programming error in the string\n processing code may lead to denial of service and potentially the\n execution of arbitrary code.
Drew Yao discovered that an integer overflow in the array handling\n code may lead to denial of service and potentially the execution\n of arbitrary code.
Drew Yao discovered that an integer overflow in the array handling\n code may lead to denial of service and potentially the execution\n of arbitrary code.
It was discovered that an integer overflow in the array handling\n code may lead to denial of service and potentially the execution\n of arbitrary code.
For the stable distribution (etch), these problems have been fixed in\nversion 1.8.5-4etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.8.7.22-2.
\nWe recommend that you upgrade your ruby1.8 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities have been identified in libgd2, a library\nfor programmatic graphics creation and manipulation. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nGrayscale PNG files containing invalid tRNS chunk CRC values\n could cause a denial of service (crash), if a maliciously\n crafted image is loaded into an application using libgd.
An array indexing error in libgd's GIF handling could induce a\n denial of service (crash with heap corruption) if exceptionally\n large color index values are supplied in a maliciously crafted\n GIF image file.
The imagearc() and imagefilledarc() routines in libgd allow\n an attacker in control of the parameters used to specify\n the degrees of arc for those drawing functions to perform\n a denial of service attack (excessive CPU consumption).
Multiple integer overflows exist in libgd's image resizing and\n creation routines; these weaknesses allow an attacker in control\n of the parameters passed to those routines to induce a crash or\n execute arbitrary code with the privileges of the user running\n an application or interpreter linked against libgd2.
For the stable distribution (etch), these problems have been fixed in\nversion 2.0.33-5.2etch1.
\nFor the unstable distribution (sid), these\nproblems have been fixed in version 2.0.35.dfsg-1.
\nWe recommend that you upgrade your libgd2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel\nweb browser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nIt was discovered that missing boundary checks on a reference\n counter for CSS objects can lead to the execution of arbitrary code.
Billy Rios discovered that passing an URL containing a pipe symbol\n to Iceweasel can lead to Chrome privilege escalation.
For the stable distribution (etch), these problems have been fixed in\nversion 2.0.0.16-0etch1. Updated packages for ia64, arm and mips are\nnot yet available and will be released as soon as they have been built.
\nFor the unstable distribution (sid), these problems have been fixed in\nxulrunner 1.9.0.1-1 and iceweasel 3.0.1-1.
\nWe recommend that you upgrade your iceweasel package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nIt was discovered that missing boundary checks on a reference\n counter for CSS objects can lead to the execution of arbitrary code.
Devon Hubbard, Jesse Ruderman and Martijn Wargers discovered\n crashes in the layout engine, which might allow the execution of\n arbitrary code.
Igor Bukanov, Jesse Ruderman and Gary Kwong discovered crashes in\n the Javascript engine, which might allow the execution of arbitrary code.
moz_bug_r_a4
discovered several cross-site scripting vulnerabilities.
Collin Jackson and Adam Barth discovered that Javascript code\n could be executed in the context of signed JAR archives.
moz_bug_r_a4
discovered that XUL documents can escalate\n privileges by accessing the pre-compiled fastload
file.
moz_bug_r_a4
discovered that missing input sanitising in the\n mozIJSSubScriptLoader.loadSubScript() function could lead to the\n execution of arbitrary code. Iceweasel itself is not affected, but\n some addons are.
Claudio Santambrogio discovered that missing access validation in\n DOM parsing allows malicious web sites to force the browser to\n upload local files to the server, which could lead to information\n disclosure.
Daniel Glazman discovered that a programming error in the code for\n parsing .properties files could lead to memory content being\n exposed to addons, which could lead to information disclosure.
Masahiro Yamada discovered that file URLs in directory listings\n were insufficiently escaped.
John G. Myers, Frank Benkstein and Nils Toedtmann discovered that\n alternate names on self-signed certificates were handled\n insufficiently, which could lead to spoofing of secure connections.
Greg McManus discovered a crash in the block reflow\n code, which might allow the execution of arbitrary code.
Billy Rios discovered that passing an URL containing a pipe symbol\n to Iceweasel can lead to Chrome privilege escalation.
For the stable distribution (etch), these problems have been fixed in\nversion 1.8.0.15~pre080614d-0etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.1-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDamian Put discovered a vulnerability in the ClamAV anti-virus\ntoolkit's parsing of Petite-packed Win32 executables. The weakness\nleads to an invalid memory access, and could enable an attacker to\ncrash clamav by supplying a maliciously crafted Petite-compressed\nbinary for scanning. In some configurations, such as when clamav\nis used in combination with mail servers, this could cause a system\nto fail open
, facilitating a follow-on viral attack.
A previous version of this advisory referenced packages that were\nbuilt incorrectly and omitted the intended correction. This\nissue was fixed in packages referenced by the -2 revision of the\nadvisory.
\nThe Common Vulnerabilities and Exposures project identifies this\nweakness as CVE-2008-2713\nand CVE-2008-3215.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.90.1dfsg-3.1+etch14.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.93.1.dfsg-1.1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIn DSA-1603-1, Debian released an update to the BIND 9 domain name\nserver, which introduced UDP source port randomization to mitigate\nthe threat of DNS cache poisoning attacks (identified by the Common\nVulnerabilities and Exposures project as CVE-2008-1447).\nThe fix, while correct, was incompatible with the version of SELinux Reference\nPolicy shipped with Debian Etch, which did not permit a process running in the\nnamed_t domain to bind sockets to UDP ports other than the standard 'domain'\nport (53).\nThe incompatibility affects both the 'targeted' and 'strict' policy packages\nsupplied by this version of refpolicy.\n
\n\nThis update to the refpolicy packages grants the ability to bind to\narbitrary UDP ports to named_t processes.\nWhen installed, the updated packages will attempt to update the bind policy\nmodule on systems where it had been previously loaded and where the previous\nversion of refpolicy was 0.0.20061018-5 or below.\n
\n\nBecause the Debian refpolicy packages are not yet designed with policy module\nupgradeability in mind, and because SELinux-enabled Debian systems often have\nsome degree of site-specific policy customization, it is difficult to assure\nthat the new bind policy can be successfully upgraded.\nTo this end, the package upgrade will not abort if the bind policy update\nfails.\nThe new policy module can be found at\n/usr/share/selinux/refpolicy-targeted/bind.pp after installation.\nAdministrators wishing to use the bind service policy can reconcile any policy\nincompatibilities and install the upgrade manually thereafter.\nA more detailed discussion of the corrective procedure may be found on\nhttps://wiki.debian.org/SELinux/Issues/BindPortRandomization.
\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.0.20061018-5.1+etch1.\n
\n\nThe unstable distribution (sid) is not affected, as subsequent refpolicy\nreleases have incorporated an analogous change.\n
\n\nWe recommend that you upgrade your refpolicy packages.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the interpreter for\nthe Ruby language, which may lead to denial of service or the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nDrew Yao discovered that multiple integer overflows in the string\n processing code may lead to denial of service and potentially the\n execution of arbitrary code.
Drew Yao discovered that multiple integer overflows in the string\n processing code may lead to denial of service and potentially the\n execution of arbitrary code.
Drew Yao discovered that a programming error in the string\n processing code may lead to denial of service and potentially the\n execution of arbitrary code.
Drew Yao discovered that an integer overflow in the array handling\n code may lead to denial of service and potentially the execution\n of arbitrary code.
Drew Yao discovered that an integer overflow in the array handling\n code may lead to denial of service and potentially the execution\n of arbitrary code.
It was discovered that an integer overflow in the array handling\n code may lead to denial of service and potentially the execution\n of arbitrary code.
For the stable distribution (etch), these problems have been fixed in\nversion 1.9.0+20060609-1etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.2-2.
\nWe recommend that you upgrade your ruby1.9 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple weaknesses have been identified in PyDNS, a DNS client\nimplementation for the Python language. Dan Kaminsky identified a\npractical vector of DNS response spoofing and cache poisoning,\nexploiting the limited entropy in a DNS transaction ID and lack of\nUDP source port randomization in many DNS implementations. Scott\nKitterman noted that python-dns is vulnerable to this predictability,\nas it randomizes neither its transaction ID nor its source port.\nTaken together, this lack of entropy leaves applications using\npython-dns to perform DNS queries highly susceptible to response\nforgery.
\nThe Common Vulnerabilities and Exposures project identifies this\nclass of weakness as CVE-2008-1447\nand this specific instance in PyDNS as CVE-2008-4099.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2.3.0-5.2+etch1.
\nWe recommend that you upgrade your python-dns package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the interpreter for the\nPython language. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nPiotr Engelking discovered that the strxfrm() function of the locale\n module miscalculates the length of an internal buffer, which may\n result in a minor information disclosure.
It was discovered that several integer overflows in the imageop\n module may lead to the execution of arbitrary code, if a user is\n tricked into processing malformed images. This issue is also\n tracked as CVE-2008-1679 due to an initially incomplete patch.
Justin Ferguson discovered that a buffer overflow in the zlib\n module may lead to the execution of arbitrary code.
Justin Ferguson discovered that insufficient input validation in\n PyString_FromStringAndSize() may lead to the execution of arbitrary\n code.
For the stable distribution (etch), these problems have been fixed in\nversion 2.5-5+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.5.2-3.
\nWe recommend that you upgrade your python2.5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in the Icedove\nmail client, an unbranded version of the Thunderbird client. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:\n
\n\n It was discovered that a buffer overflow in MIME decoding can lead\n to the execution of arbitrary code.\n
\n It was discovered that missing boundary checks on a reference\n counter for CSS objects can lead to the execution of arbitrary code.\n
\n Devon Hubbard, Jesse Ruderman and Martijn Wargers discovered\n crashes in the layout engine, which might allow the execution of\n arbitrary code.\n
\n Igor Bukanov, Jesse Ruderman and Gary Kwong discovered crashes in\n the Javascript engine, which might allow the execution of arbitrary code.\n
\n \"moz_bug_r_a4\" discovered that XUL documents can escalate\n privileges by accessing the pre-compiled \"fastload\" file.\n
\n \"moz_bug_r_a4\" discovered that missing input sanitising in the\n mozIJSSubScriptLoader.loadSubScript() function could lead to the\n execution of arbitrary code. Iceweasel itself is not affected, but\n some addons are.\n
\n Daniel Glazman discovered that a programming error in the code for\n parsing .properties files could lead to memory content being\n exposed to addons, which could lead to information disclosure.\n
\n John G. Myers, Frank Benkstein and Nils Toedtmann discovered that\n alternate names on self-signed certificates were handled\n insufficiently, which could lead to spoofings secure connections.\n
\n Greg McManus discovered discovered a crash in the block reflow\n code, which might allow the execution of arbitrary code.\n
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614d-0etch1.\nPackages for s390 are not yet available and will be provided later.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.0.0.16-1.\n
\n\nWe recommend that you upgrade your icedove package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that newsx, an NNTP news exchange utility, was affected\nby a buffer overflow allowing remote attackers to execute arbitrary code\nvia a news article containing a large number of lines starting with a period.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.6-2etch1.
\nFor the testing (lenny) and unstable distribution (sid), this problem has\nbeen fixed in version 1.6-3.
\nWe recommend that you upgrade your newsx package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Kaminsky discovered that properties inherent to the DNS protocol\nlead to practical DNS cache poisoning attacks. Among other things,\nsuccessful attacks can lead to misdirected web traffic and email\nrerouting.
\nThis update changes Debian's dnsmasq packages to implement the\nrecommended countermeasure: UDP query source port randomization. This\nchange increases the size of the space from which an attacker has to\nguess values in a backwards-compatible fashion and makes successful\nattacks significantly more difficult.
\nThis update also switches the random number generator to Dan\nBernstein's SURF.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.35-1+etch4. Packages for alpha will be provided later.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.43-1.
\nWe recommend that you upgrade your dnsmasq package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Evans discovered that a buffer overflow in the RC4 functions of\nlibexslt may lead to the execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.1.19-3.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your libxslt packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Common Unix\nPrinting System (CUPS). The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nBuffer overflows in the HP-GL input filter allowed to possibly run\n arbitrary code through crafted HP-GL files.
Buffer overflow in the GIF filter allowed to possibly run arbitrary\n code through crafted GIF files.
Integer overflows in the PNG filter allowed to possibly run arbitrary\n code through crafted PNG files.
For the stable distribution (etch), these problems have been fixed in\nversion 1.2.7-4etch4 of package cupsys.
\nFor the testing (lenny) and unstable distribution (sid), these problems\nhave been fixed in version 1.3.7-2 of package cups.
\nWe recommend that you upgrade your cupsys package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJoan Calvet discovered that httrack, a utility to create local copies of\nwebsites, is vulnerable to a buffer overflow potentially allowing to\nexecute arbitrary code when passed excessively long URLs.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 3.40.4-3.1+etch1.
\nFor the testing (lenny) and unstable distribution (sid), this problem has\nbeen fixed in version 3.42.3-1.
\nWe recommend that you upgrade your httrack package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChaskiel M Grundman discovered that opensc, a library and utilities to\nhandle smart cards, would initialise smart cards with the Siemens CardOS M4\ncard operating system without proper access rights. This allowed everyone\nto change the card's PIN.
\nWith this bug anyone can change a user PIN without having the PIN or PUK\nor the superusers PIN or PUK. However it can not be used to figure out the\nPIN. If the PIN on your card is still the same you always had, there's a\nreasonable chance that this vulnerability has not been exploited.
\nThis vulnerability affects only smart cards and USB crypto tokens based on\nSiemens CardOS M4, and within that group only those that were initialised\nwith OpenSC. Users of other smart cards and USB crypto tokens, or cards\nthat have been initialised with some software other than OpenSC, are not\naffected.
\nAfter upgrading the package, running\npkcs15-tool\u00a0-T\nwill show you whether the card is fine or vulnerable. If the card is\nvulnerable, you need to update the security setting using:\npkcs15-tool\u00a0-T\u00a0-U.
For the stable distribution (etch), this problem has been fixed in\nversion 0.11.1-2etch2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.11.4-5.
\nWe recommend that you upgrade your opensc package and check\nyour card(s) with the command described above.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBrian Dowling discovered that the PowerDNS authoritative name server\ndoes not respond to DNS queries which contain certain characters,\nincreasing the risk of successful DNS spoofing (CVE-2008-3337). This\nupdate changes PowerDNS to respond with SERVFAIL responses instead.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.9.20-8+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.9.21.1-1.
\nWe recommend that you upgrade your pdns package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSebastian Krahmer discovered that Postfix, a mail transfer agent,\nincorrectly checks the ownership of a mailbox. In some configurations,\nthis allows for appending data to arbitrary files as root.
\nNote that only specific configurations are vulnerable; the default\nDebian installation is not affected. Only a configuration meeting\nthe following requirements is vulnerable:
\nFor a detailed treating of the issue, please refer to the upstream\nauthor's announcement.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.3.8-2+etch1.
\nFor the testing distribution (lenny), this problem has been fixed in\nversion 2.5.2-2lenny1.
\nFor the unstable distribution (sid), this problem has been fixed\nin version 2.5.4-1.
\nWe recommend that you upgrade your postfix package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that may\nlead to a denial of service or arbitrary code execution. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nDirk Nehring discovered a vulnerability in the IPsec code that allows\n remote users to cause a denial of service by sending a specially crafted\n ESP packet.
Tavis Ormandy discovered a vulnerability that allows local users to access\n uninitialized kernel memory, possibly leaking sensitive data. This issue\n is specific to the amd64-flavour kernel images.
Andi Kleen discovered an issue where uninitialized kernel memory\n was being leaked to userspace during an exception. This issue may allow\n local users to gain access to sensitive data. Only the amd64-flavour\n Debian kernel images are affected.
Alan Cox discovered an issue in multiple tty drivers that allows\n local users to trigger a denial of service (NULL pointer dereference)\n and possibly obtain elevated privileges.
Gabriel Campana discovered an integer overflow in the sctp code that\n can be exploited by local users to cause a denial of service.
Miklos Szeredi reported a missing privilege check in the do_change_type()\n function. This allows local, unprivileged users to change the properties\n of mount points.
Tobias Klein reported a locally exploitable data leak in the\n snd_seq_oss_synth_make_info() function. This may allow local users\n to gain access to sensitive information.
Zoltan Sogor discovered a coding error in the VFS that allows local users\n to exploit a kernel memory leak resulting in a denial of service.
For the stable distribution (etch), this problem has been fixed in\nversion 2.6.18.dfsg.1-22etch2.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAndreas Solberg discovered that libxml2, the GNOME XML library,\ncould be forced to recursively evaluate entities, until available\nCPU and memory resources were exhausted.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.6.27.dfsg-4.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.6.32.dfsg-3.
\nWe recommend that you upgrade your libxml2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDrew Yao discovered that libTIFF, a library for handling the Tagged Image\nFile Format, is vulnerable to a programming error allowing malformed\ntiff files to lead to a crash or execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 3.8.2-7+etch1.
\nFor the testing distribution (lenny), this problem has been fixed in\nversion 3.8.2-10+lenny1.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your tiff package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that Slash, the Slashdot Like Automated\nStorytelling Homepage suffers from two vulnerabilities related to\ninsufficient input sanitation, leading to execution of SQL commands\n(CVE-2008-2231) and cross-site scripting (CVE-2008-2553).
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2.2.6-8etch1.
\nIn the unstable distribution (sid), the slash package is currently\nuninstallable and will be removed soon.
\nWe recommend that you upgrade your slash package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRob Holland discovered several programming errors in WordNet, an\nelectronic lexical database of the English language. These flaws could\nallow arbitrary code execution when used with untrusted input, for\nexample when WordNet is in use as a back end for a web application.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1:2.1-4+etch1.
\nFor the testing distribution (lenny), these problems have been fixed in\nversion 1:3.0-11+lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1:3.0-12.
\nWe recommend that you upgrade your wordnet package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in freetype,\na FreeType 2 font engine, which could allow the execution of arbitrary\ncode.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nAn integer overflow allows context-dependent attackers to execute\n arbitrary code via a crafted set of values within the Private\n dictionary table in a Printer Font Binary (PFB) file.
The handling of an invalid number of axes
field in the PFB file could\n trigger the freeing of arbitrary memory locations, leading to\n memory corruption.
Multiple off-by-one errors allowed the execution of arbitrary code\n via malformed tables in PFB files, or invalid SHC instructions in\n TTF files.
For the stable distribution (etch), these problems have been fixed in version\n2.2.1-5+etch3.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.3.6-1.
\nWe recommend that you upgrade your freetype package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that may\nlead to a denial of service or leak sensitive data. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nTobias Klein reported a locally exploitable data leak in the\n snd_seq_oss_synth_make_info() function. This may allow local users\n to gain access to sensitive information.
Zoltan Sogor discovered a coding error in the VFS that allows local users\n to exploit a kernel memory leak resulting in a denial of service.
Eugene Teo reported an integer overflow in the DCCP subsystem that\n may allow remote attackers to cause a denial of service in the form\n of a kernel panic.
Eugene Teo reported a missing bounds check in the SCTP subsystem.\n By exploiting an integer overflow in the SCTP_AUTH_KEY handling code,\n remote attackers may be able to cause a denial of service in the form\n of a kernel panic.
Kel Modderman reported an issue in the tmpfs filesystem that allows\n local users to crash a system by triggering a kernel BUG() assertion.
Alexey Dobriyan discovered an off-by-one-error in the iov_iter_advance\n function which can be exploited by local users to crash a system,\n resulting in a denial of service.
Vlad Yasevich reported several NULL pointer reference conditions in\n the SCTP subsystem that can be triggered by entering sctp-auth codepaths\n when the AUTH feature is inactive. This may allow attackers to cause\n a denial of service condition via a system panic.
Johann Dahm and David Richter reported an issue in the nfsd subsystem\n that may allow remote attackers to cause a denial of service via a\n buffer overflow.
For the stable distribution (etch), these problems have been fixed in\nversion 2.6.24-6~etchnhalf.5.
\nWe recommend that you upgrade your linux-2.6.24 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities have been identified in git-core, the core of\nthe git distributed revision control system. Improper path length\nlimitations in git's diff and grep functions, in combination with\nmaliciously crafted repositories or changes, could enable a stack\nbuffer overflow and potentially the execution of arbitrary code.
\nThe Common Vulnerabilities and Exposures project identifies this\nvulnerability as CVE-2008-3546.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.4.4.4-2.1+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.5.6.5-1.
\nWe recommend that you upgrade your git-core packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that the signal handler implementing the login\ntimeout in Debian's version of the OpenSSH server uses functions which\nare not async-signal-safe, leading to a denial of service\nvulnerability (CVE-2008-4109).
\nThe problem was originally corrected in OpenSSH 4.4p1 (CVE-2006-5051),\nbut the patch backported to the version released with etch was\nincorrect.
\nSystems affected by this issue suffer from lots of zombie sshd\nprocesses. Processes stuck with a \"[net]\" process title have also been\nobserved. Over time, a sufficient number of processes may accumulate\nsuch that further login attempts are impossible. Presence of these\nprocesses does not indicate active exploitation of this vulnerability.\nIt is possible to trigger this denial of service condition by accident.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 4.3p2-9etch3.
\nFor the unstable distribution (sid) and the testing distribution\n(lenny), this problem has been fixed in version 4.6p1-1.
\nWe recommend that you upgrade your openssh packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that twiki, a web based collaboration platform,\ndidn't properly sanitize the image parameter in its configuration script.\nThis could allow remote users to execute arbitrary commands upon the\nsystem, or read any files which were readable by the webserver user.
\nFor the stable distribution (etch), this problem has been fixed in version\n1:4.0.5-9.1etch1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your twiki package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSimon Willison discovered that in Django, a Python web framework, the\nfeature to retain HTTP POST data during user reauthentication allowed\na remote attacker to perform unauthorized modification of data through\ncross site request forgery. This is possible regardless of the Django\nplugin to prevent cross site request forgery being enabled. The Common\nVulnerabilities and Exposures project identifies this issue as\nCVE-2008-3909.
\nIn this update the affected feature is disabled; this is in accordance\nwith upstream's preferred solution for this situation.
\nThis update takes the opportunity to also include a relatively minor\ndenial of service attack in the internationalisation framework, known\nas CVE-2007-5712.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.95.1-1etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.0-1.
\nWe recommend that you upgrade your python-django package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in phpMyAdmin, a\ntool to administrate MySQL databases over the web. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nRemote authenticated users could execute arbitrary code on the\n host running phpMyAdmin through manipulation of a script parameter.
Cross site scripting through the setup script was possible in\n rare circumstances.
Protection has been added against remote websites loading phpMyAdmin\n into a frameset.
Cross site request forgery allowed remote attackers to create a new\n database, but not perform any other action on it.
For the stable distribution (etch), these problems have been fixed in\nversion 4:2.9.1.1-8.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4:2.11.8.1-2.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nWill Drewry discovered that Horde allows remote attackers to send\nan email with a crafted MIME attachment filename attribute to perform\ncross site scripting.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 3.1.3-4etch4.
\nFor the testing distribution (lenny), this problem has been fixed in\nversion 3.2.1+debian0-2+lenny1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your horde3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDmitry E. Oboukhov discovered that the \"to-upgrade\" plugin of Feta,\na simpler interface to APT, dpkg, and other Debian package tools\ncreates temporary files insecurely, which may lead to local denial\nof service through symlink attacks.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.4.15+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.4.16+nmu1.
\nWe recommend that you upgrade your feta package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFelipe Andres Manzano discovered that mplayer, a multimedia player, is\nvulnerable to several integer overflows in the Real video stream\ndemuxing code. These flaws could allow an attacker to cause a denial\nof service (a crash) or potentially execution of arbitrary code by\nsupplying a maliciously crafted video file.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.0~rc1-12etch5.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.0~rc2-18.
\nWe recommend that you upgrade your mplayer packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local/remote vulnerabilities have been discovered in lighttpd,\na fast webserver with minimal memory footprint.
\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nA memory leak in the http_request_parse function could be used by\n remote attackers to cause lighttpd to consume memory, and cause a\n denial of service attack.
Inconsistant handling of URL patterns could lead to the disclosure\n of resources a server administrator did not anticipate when using\n rewritten URLs.
Upon filesystems which don't handle case-insensitive paths differently\n it might be possible that unanticipated resources could be made available\n by mod_userdir.
For the stable distribution (etch), these problems have been fixed in version\n1.4.13-4etch11.
\nFor the unstable distribution (sid), these problems will be fixed shortly.
\nWe recommend that you upgrade your lighttpd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA weakness has been discovered in squid, a caching proxy server. The\nflaw was introduced upstream in response to CVE-2007-6239, and\nannounced by Debian in DSA-1482-1. The flaw involves an\nover-aggressive bounds check on an array resize, and could be\nexploited by an authorized client to induce a denial of service\ncondition against squid.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2.6.5-6etch2.
\nWe recommend that you upgrade your squid packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in PHP, a server-side,\nHTML-embedded scripting language. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nBuffer overflow in the imageloadfont function allows a denial\n of service or code execution through a crafted font file.
Buffer overflow in the memnstr function allows a denial of\n service or code execution via a crafted delimiter parameter\n to the explode function.
Denial of service is possible in the FastCGI module by a\n remote attacker by making a request with multiple dots\n before the extension.
For the stable distribution (etch), these problems have been fixed in\nversion 5.2.0-8+etch13.
\nFor the testing (lenny) and unstable distribution (sid), these problems\nhave been fixed in version 5.2.6-4.
\nWe recommend that you upgrade your php5 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDmitry E. Oboukhov discovered that the test.alert script used in one of the\nalert functions in mon, a system to monitor hosts or services and alert\nabout problems, creates temporary files insecurely, which may lead to a local\ndenial of service through symlink attacks.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.99.2-9+etch2.
\nFor the testing (lenny) and unstable distribution (sid), this problem has\nbeen fixed in version 0.99.2-13.
\nWe recommend that you upgrade your mon package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel web\nbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nJustin Schuh, Tom Cross and Peter Williams discovered a buffer\n overflow in the parser for UTF-8 URLs, which may lead to the\n execution of arbitrary code.
moz_bug_r_a4
discovered that the same-origin check in\n nsXMLDocument::OnChannelRedirect() could by bypassed.
moz_bug_r_a4
discovered that several vulnerabilities in\n feedWriter could lead to Chrome privilege escalation.
Paul Nickerson discovered that an attacker could move windows\n during a mouse click, resulting in unwanted action triggered by\n drag-and-drop.
moz_bug_r_a4
discovered a vulnerability which can result in\n Chrome privilege escalation through XPCNativeWrappers.
moz_bug_r_a4
discovered a vulnerability which can result in\n Chrome privilege escalation through XPCNativeWrappers.
Olli Pettay and moz_bug_r_a4
discovered a Chrome privilege\n escalation vulnerability in XSLT handling.
Jesse Ruderman discovered a crash in the layout engine, which might\n allow the execution of arbitrary code.
Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine Labour\n discovered crashes in the Javascript engine, which might allow the\n execution of arbitrary code.
Dave Reed discovered that some Unicode byte order marks are\n stripped from Javascript code before execution, which can result in\n code being executed, which were otherwise part of a quoted string.
Gareth Heyes discovered that some Unicode surrogate characters are\n ignored by the HTML parser.
Boris Zbarsky discovered that resource: URLs allow directory\n traversal when using URL-encoded slashes.
Georgi Guninski discovered that resource: URLs could bypass local\n access restrictions.
Billy Hoffman discovered that the XBM decoder could reveal\n uninitialised memory.
For the stable distribution (etch), these problems have been fixed in\nversion 2.0.0.17-0etch1. Packages for hppa will be provided later.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.0.3 of iceweasel and 1.9.0.3-1 of xulrunner.
\nWe recommend that you upgrade your iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nCameron Hotchkies discovered that the OpenLDAP server slapd, a free\nimplementation of the Lightweight Directory Access Protocol, could be\ncrashed by sending malformed ASN1 requests.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.3.30-5+etch2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.10-3 of the openldap package.
\nWe recommend that you upgrade your openldap2.3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the interpreter for\nthe Ruby language, which may lead to denial of service and other\nsecurity problems. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nKeita Yamaguchi discovered that several safe level restrictions\n are insufficiently enforced.
Christian Neukirchen discovered that the WebRick module uses\n inefficient algorithms for HTTP header splitting, resulting in\n denial of service through resource exhaustion.
It was discovered that the dl module doesn't perform taintness\n checks.
Luka Treiber and Mitja Kolsek discovered that recursively nested\n XML entities can lead to denial of service through resource\n exhaustion in rexml.
Tanaka Akira discovered that the resolv module uses sequential\n transaction IDs and a fixed source port for DNS queries, which\n makes it more vulnerable to DNS spoofing attacks.
For the stable distribution (etch), these problems have been fixed in\nversion 1.8.5-4etch3. Packages for arm will be provided later.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.8.7.72-1.
\nWe recommend that you upgrade your ruby1.8 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the interpreter for\nthe Ruby language, which may lead to denial of service and other\nsecurity problems. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nKeita Yamaguchi discovered that several safe level restrictions\n are insufficiently enforced.
Christian Neukirchen discovered that the WebRick module uses\n inefficient algorithms for HTTP header splitting, resulting in\n denial of service through resource exhaustion.
It was discovered that the dl module doesn't perform taintness\n checks.
Luka Treiber and Mitja Kolsek discovered that recursively nested\n XML entities can lead to denial of service through resource\n exhaustion in rexml.
Tanaka Akira discovered that the resolv module uses sequential\n transaction IDs and a fixed source port for DNS queries, which\n makes it more vulnerable to DNS spoofing attacks.
For the stable distribution (etch), these problems have been fixed in\nversion 1.9.0+20060609-1etch3. Packages for arm will be provided later.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.2-6.
\nWe recommend that you upgrade your ruby1.9 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nJoe Jin reported a local denial of service vulnerability that\n allows system users to trigger an oops due to an improperly\n initialized data structure.
Jan Kratochvil reported a local denial of service vulnerability in\n the ptrace interface for the s390 architecture. Local users can\n trigger an invalid pointer dereference, leading to a system panic.
Eugene Teo reported an integer overflow in the DCCP subsystem that\n may allow remote attackers to cause a denial of service in the\n form of a kernel panic.
Eugene Teo reported a lack of capability checks in the kernel\n driver for Granch SBNI12 leased line adapters (sbni), allowing\n local users to perform privileged operations.
The S_ISUID/S_ISGID bits were not being cleared during an inode\n splice, which, under certain conditions, can be exploited by local\n users to obtain the privileges of a group for which they are not a\n member. Mark Fasheh reported this issue.
David Watson reported an issue in the open()/creat() system calls\n which, under certain conditions, can be exploited by local users\n to obtain the privileges of a group for which they are not a\n member.
A coding error in the splice subsystem allows local users to\n attempt to unlock a page structure that has not been locked,\n resulting in a system crash.
For the stable distribution (etch), this problem has been fixed in\nversion 2.6.18.dfsg.1-22etch3.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that libxml2, the GNOME XML library, didn't correctly\nhandle long entity names. This could allow the execution of arbitrary\ncode via a malicious XML file.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.6.27.dfsg-5.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.6.32.dfsg-4.
\nWe recommend that you upgrade your libxml2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service, privilege escalation or a leak of\nsensitive data. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nJan Kratochvil reported a local denial of service vulnerability in\n the ptrace interface for the s390 architecture. Local users can\n trigger an invalid pointer dereference, leading to a system panic.
Eugene Teo reported a lack of capability checks in the kernel\n driver for Granch SBNI12 leased line adapters (sbni), allowing\n local users to perform privileged operations.
Olaf Kirch discovered an issue with the i915 driver that may allow\n local users to cause memory corruption by use of an ioctl with\n insufficient privilege restrictions.
Eugene Teo discovered two issues in the SCTP subsystem which allow\n local users to obtain access to sensitive memory when the\n SCTP-AUTH extension is enabled.
For the stable distribution (etch), these problems have been fixed in\nversion 2.6.24-6~etchnhalf.6.
\nWe recommend that you upgrade your linux-2.6.24 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the Common UNIX\nPrinting System. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that insufficient bounds checking in the SGI\n image filter may lead to the execution of arbitrary code.
It was discovered that an integer overflow in the Postscript\n conversion tool texttops
may lead to the execution of arbitrary\n code.
It was discovered that insufficient bounds checking in the HPGL\n filter may lead to the execution of arbitrary code.
For the stable distribution (etch), these problems have been fixed in\nversion 1.2.7-4etch5.
\nFor the unstable distribution (sid) and the upcoming stable distribution\n(lenny), these problems have been fixed in version 1.3.8-1lenny2 of\nthe source package cups.
\nWe recommend that you upgrade your cupsys package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDmitry E. Oboukhov discovered that the qemu-make-debian-root script in qemu,\nfast processor emulator, creates temporary files insecurely, which may lead\nto a local denial of service through symlink attacks.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.8.2-4etch2.
\nFor the testing (lenny) and unstable distribution (sid), this problem has\nbeen fixed in version 0.9.1-6.
\nWe recommend that you upgrade your qemu package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nColin Walters discovered that the dbus_signature_validate function in\ndbus, a simple interprocess messaging system, is prone to a denial of\nservice attack.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.0.2-1+etch2.
\nFor the testing distribution (lenny) and unstable distribution (sid)\nthis problem will be fixed soon.
\nWe recommend that you upgrade your dbus package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Kaminsky discovered that libspf2, an implementation of the Sender\nPolicy Framework (SPF) used by mail servers for mail filtering, handles\nmalformed TXT records incorrectly, leading to a buffer overflow\ncondition (CVE-2008-2469).
\nNote that the SPF configuration template in Debian's Exim configuration\nrecommends to use libmail-spf-query-perl, which does not suffer from\nthis issue.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.2.5-4+etch1.
\nFor the testing distribution (lenny), this problem has been fixed in\nversion 1.2.5.dfsg-5+lenny1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your libspf2 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral denial-of-service vulnerabilities have been discovered in\nthe ClamAV anti-virus toolkit:
\nInsufficient checking for out-of-memory conditions results in null\npointer dereferences (CVE-2008-3912).
\nIncorrect error handling logic leads to memory leaks (CVE-2008-3913)\nand file descriptor leaks (CVE-2008-3914).
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.90.1dfsg-4etch15.
\nFor the unstable distribution (sid) and the testing distribution\n(lenny), these problems have been fixed in version 0.94.dfsg-1.
\nWe recommend that you upgrade your clamav package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the OpenOffice.org\noffice suite:
\nThe SureRun Security team discovered a bug in the WMF file parser\n that can be triggered by manipulated WMF files and can lead to\n heap overflows and arbitrary code execution.
An anonymous researcher working with the iDefense discovered a bug\n in the EMF file parser that can be triggered by manipulated EMF\n files and can lead to heap overflows and arbitrary code execution.
For the stable distribution (etch) these problems have been fixed in\nversion 2.0.4.dfsg.2-7etch6.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 2.4.1-12.
\nFor the experimental distribution these problems have been fixed in\nversion 3.0.0~rc3-1.
\nWe recommend that you upgrade your OpenOffice.org package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA symlink traversal vulnerability was discovered in MySQL, a\nrelational database server. The weakness could permit an attacker\nhaving both CREATE TABLE access to a database and the ability to\nexecute shell commands on the database server to bypass MySQL access\ncontrols, enabling them to write to tables in databases to which they\nwould not ordinarily have access.
\nThe Common Vulnerabilities and Exposures project identifies this\nvulnerability as CVE-2008-4098. Note that a closely aligned issue,\nidentified as CVE-2008-4097, was prevented by the update announced in\nDSA-1608-1. This new update supersedes that fix and mitigates both\npotential attack vectors.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.0.32-7etch8.
\nWe recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in NET SNMP, a suite of\nSimple Network Management Protocol applications. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nWes Hardaker reported that the SNMPv3 HMAC verification relies on\n the client to specify the HMAC length, which allows spoofing of\n authenticated SNMPv3 packets.
John Kortink reported a buffer overflow in the __snprint_value\n function in snmp_get causing a denial of service and potentially\n allowing the execution of arbitrary code via a large OCTETSTRING\n in an attribute value pair (AVP).
It was reported that an integer overflow in the\n netsnmp_create_subtree_cache function in agent/snmp_agent.c allows\n remote attackers to cause a denial of service attack via a crafted\n SNMP GETBULK request.
For the stable distribution (etch), these problems has been fixed in\nversion 5.2.3-7etch4.
\nFor the testing distribution (lenny) and unstable distribution (sid)\nthese problems have been fixed in version 5.4.1~dfsg-11.
\nWe recommend that you upgrade your net-snmp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that ekg, a console Gadu Gadu client performs\ninsufficient input sanitising in the code to parse contact descriptions,\nwhich may result in denial of service.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1:1.7~rc2-1etch2.
\nFor the unstable distribution (sid) and the upcoming stable distribution\n(lenny), this problem has been fixed in version 1:1.8~rc1-2 of libgadu.
\nWe recommend that you upgrade your ekg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a heap overflow in the CDDB retrieval code of\nlibcdaudio, a library for controlling a CD-ROM when playing audio CDs,\nmay result in the execution of arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.99.12p2-2+etch1. A package for hppa will be provided later.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), this problem has been fixed in version 0.99.12p2-7.
\nWe recommend that you upgrade your libcdaudio packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the GNOME XML library.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nDrew Yao discovered that missing input sanitising in the\n xmlBufferResize() function may lead to an infinite loop,\n resulting in denial of service.
Drew Yao discovered that an integer overflow in the\n xmlSAX2Characters() function may lead to denial of service or\n the execution of arbitrary code.
For the stable distribution (etch), these problems have been fixed in\nversion 2.6.27.dfsg-6.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), these problems have been fixed in\nversion 2.6.32.dfsg-5.
\nWe recommend that you upgrade your libxml2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the interpreter for the\nPython language. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nDavid Remahl discovered several integer overflows in the\n stringobject, unicodeobject, bufferobject, longobject,\n tupleobject, stropmodule, gcmodule, and mmapmodule modules.
Justin Ferguson discovered that incorrect memory allocation in\n the unicode_resize() function can lead to buffer overflows.
Several integer overflows were discovered in various Python core\n modules.
Several integer overflows were discovered in the PyOS_vsnprintf()\n function.
For the stable distribution (etch), these problems have been fixed in\nversion 2.4.4-3+etch2.
\nFor the unstable distribution (sid) and the upcoming stable\ndistribution (lenny), these problems have been fixed in\nversion 2.4.5-5.
\nWe recommend that you upgrade your python2.4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSteve Kemp discovered that hf, an amateur-radio protocol suite using\na soundcard as a modem, insecurely tried to execute an external command\nwhich could lead to the elevation of privileges for local users.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.7.3-4etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.8-8.1.
\nWe recommend that you upgrade your hf package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nJustin Schuh, Tom Cross and Peter Williams discovered a buffer\n overflow in the parser for UTF-8 URLs, which may lead to the\n execution of arbitrary code.
\"moz_bug_r_a4\" discovered that the same-origin check in\n nsXMLDocument::OnChannelRedirect() could by bypassed.
\"moz_bug_r_a4\" discovered that several vulnerabilities in\n feedWriter could lead to Chrome privilege escalation.
Paul Nickerson discovered that an attacker could move windows\n during a mouse click, resulting in unwanted action triggered by\n drag-and-drop.
\"moz_bug_r_a4\" discovered a vulnerability which can result in\n Chrome privilege escalation through XPCNativeWrappers.
\"moz_bug_r_a4\" discovered a vulnerability which can result in\n Chrome privilege escalation through XPCNativeWrappers.
Olli Pettay and \"moz_bug_r_a4\" discovered a Chrome privilege\n escalation vulnerability in XSLT handling.
Jesse Ruderman discovered a crash in the layout engine, which might\n allow the execution of arbitrary code.
Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine Labour\n discovered crashes in the Javascript engine, which might allow the\n execution of arbitrary code.
Dave Reed discovered that some Unicode byte order marks are\n stripped from Javascript code before execution, which can result in\n code being executed, which were otherwise part of a quoted string.
Gareth Heyes discovered that some Unicode surrogate characters are\n ignored by the HTML parser.
Boris Zbarsky discovered that resource: URls allow directory\n traversal when using URL-encoded slashes.
Georgi Guninski discovered that resource: URLs could bypass local\n access restrictions.
Billy Hoffman discovered that the XBM decoder could reveal\n uninitialised memory.
Liu Die Yu discovered an information leak through local shortcut\n files.
Georgi Guninski, Michal Zalewski and Chris Evan discovered that\n the canvas element could be used to bypass same-origin\n restrictions.
It was discovered that insufficient checks in the Flash plugin glue\n code could lead to arbitrary code execution.
Jesse Ruderman discovered that a programming error in the\n window.__proto__.__proto__ object could lead to arbitrary code\n execution.
It was discovered that crashes in the layout engine could lead to\n arbitrary code execution.
It was discovered that crashes in the Javascript engine could lead to\n arbitrary code execution.
Justin Schuh discovered that a buffer overflow in http-index-format\n parser could lead to arbitrary code execution.
It was discovered that a crash in the nsFrameManager might lead to\n the execution of arbitrary code.
\"moz_bug_r_a4\" discovered that the same-origin check in\n nsXMLHttpRequest::NotifyEventListeners() could be bypassed.
Collin Jackson discovered that the -moz-binding property bypasses\n security checks on codebase principals.
Chris Evans discovered that quote characters were improperly\n escaped in the default namespace of E4X documents.
For the stable distribution (etch), these problems have been fixed in\nversion 1.8.0.15~pre080614h-0etch1. Packages for mips will be provided\nlater.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), these problems have been fixed in version 1.9.0.4-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Enscript, a converter\nfrom ASCII text to Postscript, HTML or RTF. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nUlf Harnhammer discovered that a buffer overflow may lead to\n the execution of arbitrary code.
Kees Cook and Tomas Hoger discovered that several buffer\n overflows may lead to the execution of arbitrary code.
For the stable distribution (etch), these problems have been fixed in\nversion 1.6.4-11.1.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), these problems have been fixed in version 1.6.4-13.
\nWe recommend that you upgrade your enscript package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel\nwebbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nJustin Schuh discovered that a buffer overflow in the http-index-format\n parser could lead to arbitrary code execution.
Liu Die Yu discovered an information leak through local shortcut\n files.
Georgi Guninski, Michal Zalewski and Chris Evan discovered that\n the canvas element could be used to bypass same-origin\n restrictions.
It was discovered that insufficient checks in the Flash plugin glue\n code could lead to arbitrary code execution.
Jesse Ruderman discovered that a programming error in the\n window.__proto__.__proto__ object could lead to arbitrary code\n execution.
It was discovered that crashes in the layout engine could lead to\n arbitrary code execution.
It was discovered that crashes in the Javascript engine could lead to\n arbitrary code execution.
It was discovered that a crash in the nsFrameManager might lead to\n the execution of arbitrary code.
moz_bug_r_a4
discovered that the same-origin check in\n nsXMLHttpRequest::NotifyEventListeners() could be bypassed.
Collin Jackson discovered that the -moz-binding property bypasses\n security checks on codebase principals.
Chris Evans discovered that quote characters were improperly\n escaped in the default namespace of E4X documents.
For the stable distribution (etch), these problems have been fixed in\nversion 2.0.0.18-0etch1.
\nFor the upcoming stable distribution (lenny) and the unstable distribution\n(sid), these problems have been fixed in version 3.0.4-1 of iceweasel\nand version 1.9.0.4-1 of xulrunner. Packages for arm and mips will be\nprovided soon.
\nWe recommend that you upgrade your iceweasel package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJulien Danjou and Peter De Wachter discovered that a buffer overflow\nin the XPM loader of Imlib2, a powerful image loading and rendering\nlibrary, might lead to arbitrary code execution.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.3.0.0debian1-4+etch2.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), this problem has been fixed in version 1.4.0-1.2.
\nWe recommend that you upgrade your imlib2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in network traffic\nanalyzer Wireshark. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nThe GSM SMS dissector is vulnerable to denial of service.
The PANA and KISMET dissectors are vulnerable to denial of service.
The RMI dissector could disclose system memory.
The packet reassembling module is vulnerable to denial of service.
The zlib uncompression module is vulnerable to denial of service.
The Bluetooth ACL dissector is vulnerable to denial of service.
The PRP and MATE dissectors are vulnerable to denial of service.
The Q931 dissector is vulnerable to denial of service.
For the stable distribution (etch), these problems have been fixed in\nversion 0.99.4-5.etch.3.
\nFor the upcoming stable distribution (lenny), these problems have been\nfixed in version 1.0.2-3+lenny2.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your wireshark packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJavier Fernandez-Sanguino Pena discovered that updatejail, a component\nof the chroot maintenance tool Jailer, creates a predictable temporary\nfile name, which may lead to local denial of service through a symlink\nattack.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.4-9+etch1.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), this problem has been fixed in version 0.4-10.
\nWe recommend that you upgrade your jailer package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMasako Oono discovered that phpMyAdmin, a web-based administration\ninterface for MySQL, insufficiently sanitises input allowing a\nremote attacker to gather sensitive data through cross site scripting,\nprovided that the user uses the Internet Explorer web browser.
\nThis update also fixes a regression introduced in DSA 1641, that\nbroke changing of the language and encoding in the login screen.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 4:2.9.1.1-9.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4:2.11.8.1-3.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDmitry E. Oboukhov discovered that flamethrower creates predictable temporary\nfilenames, which may lead to a local denial of service through a symlink\nattack.
\nFor the stable distribution (etch), this problem has been fixed in version\n0.1.8-1+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.1.8-2.
\nWe recommend that you upgrade your flamethrower package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn integer overflow has been discovered in the image validation code\nof cupsys, the Common UNIX Printing System. An attacker could trigger\nthis bug by supplying a malicious graphic that could lead to the\nexecution of arbitrary code.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.2.7-4etch6.
\nFor testing distribution (lenny) this issue will be fixed soon.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.3.8-1lenny4.
\nWe recommend that you upgrade your cupsys packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Szabo rediscovered a vulnerability in the File::Path::rmtree\nfunction of Perl. It was possible to exploit a race condition to create\nsetuid binaries in a directory tree or remove arbitrary files when a\nprocess is deleting this tree. This issue was originally known as\nCVE-2005-0448 and CVE-2004-0452, which were addressed by DSA-696-1 and\nDSA-620-1. Unfortunately, they were reintroduced later.
\nFor the stable distribution (etch), these problems have been fixed in\nversion 5.8.8-7etch5.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 5.10.0-18 and will migrate to the testing distribution (lenny)\nshortly.
\nWe recommend that you upgrade your perl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMorgan Todd discovered a cross-site scripting vulnerability in awstats,\na log file analyzer, involving the \"config\" request parameter (and\npossibly others; CVE-2008-3714).
\nFor the stable distribution (etch), this problem has been fixed in version\n6.5+dfsg-1+etch1.
\nThe unstable (sid) and testing (lenny) distribution will be fixed soon.
\nWe recommend that you upgrade your awstats package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMoritz Jodeit discovered that ClamAV, an anti-virus solution, suffers\nfrom an off-by-one-error in its VBA project file processing, leading to\na heap-based buffer overflow and potentially arbitrary code execution\n(CVE-2008-5050).
\nIlja van Sprundel discovered that ClamAV contains a denial of service\ncondition in its JPEG file processing because it does not limit the\nrecursion depth when processing JPEG thumbnails (CVE-2008-5314).
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.90.1dfsg-4etch16.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.94.dfsg.2-1.
\nThe testing distribution (lenny) will be fixed soon.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nEugene Teo reported a local DoS issue in the ext2 and ext3\n filesystems. Local users who have been granted the privileges\n necessary to mount a filesystem would be able to craft a corrupted\n filesystem that causes the kernel to output error messages in an\n infinite loop.
Milos Szeredi reported that the usage of splice() on files opened\n with O_APPEND allows users to write to the file at arbitrary\n offsets, enabling a bypass of possible assumed semantics of the\n O_APPEND flag.
Vlad Yasevich reported an issue in the SCTP subsystem that may\n allow remote users to cause a local DoS by triggering a kernel\n oops.
Wei Yongjun reported an issue in the SCTP subsystem that may allow\n remote users to cause a local DoS by triggering a kernel panic.
Eric Sesterhenn reported a local DoS issue in the hfsplus\n filesystem. Local users who have been granted the privileges\n necessary to mount a filesystem would be able to craft a corrupted\n filesystem that causes the kernel to overrun a buffer, resulting\n in a system oops or memory corruption.
Eric Sesterhenn reported a local DoS issue in the hfsplus\n filesystem. Local users who have been granted the privileges\n necessary to mount a filesystem would be able to craft a corrupted\n filesystem that results in a kernel oops due to an unchecked\n return value.
Eric Sesterhenn reported a local DoS issue in the hfs filesystem.\n Local users who have been granted the privileges necessary to\n mount a filesystem would be able to craft a filesystem with a\n corrupted catalog name length, resulting in a system oops or\n memory corruption.
Andrea Bittau reported a DoS issue in the unix socket subsystem\n that allows a local user to cause memory corruption, resulting in\n a kernel panic.
Johannes Berg reported a remote DoS issue in the libertas wireless\n driver, which can be triggered by a specially crafted beacon/probe\n response.
Al Viro reported race conditions in the inotify subsystem that may\n allow local users to acquire elevated privileges.
Dann Frazier reported a DoS condition that allows local users to\n cause the out of memory handler to kill off privileged processes\n or trigger soft lockups due to a starvation issue in the unix\n socket subsystem.
For the stable distribution (etch), these problems have been fixed in\nversion 2.6.24-6~etchnhalf.7.
\nWe recommend that you upgrade your linux-2.6.24 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIvan Markovic discovered that SquirrelMail, a webmail application, did not\nsufficiently sanitise incoming HTML email, allowing an attacker to perform\ncross site scripting through sending a malicious HTML email.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.4.9a-3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.4.15-4.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nMultiple buffer overflows involving HTTP header and playlist parsing\nhave been discovered in streamripper (CVE-2007-4337, CVE-2008-4829).\n
\n\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.61.27-1+etch1.\n
\n\nFor the unstable distribution (sid) and the testing distribution\n(lenny), these problems have been fixed in version 1.63.5-2.\n
\n\nWe recommend that you upgrade your streamripper package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been found in lcms, a library and set of\ncommandline utilities for image color management. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nInadequate enforcement of fixed-length buffer limits allows an\n attacker to overflow a buffer on the stack, potentially enabling\n the execution of arbitrary code when a maliciously-crafted\n image is opened.
An integer sign error in reading image gamma data could allow an\n attacker to cause an under-sized buffer to be allocated for\n subsequent image data, with unknown consequences potentially\n including the execution of arbitrary code if a maliciously-crafted\n image is opened.
For the stable distribution (etch), these problems have been fixed in\nversion 1.15-1.1+etch1.
\nFor the upcoming stable distribution (lenny), and the unstable\ndistribution (sid), these problems are fixed in version 1.17.dfsg-1.
\nWe recommend that you upgrade your lcms packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been found in uw-imap, an IMAP\nimplementation. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that several buffer overflows can be triggered via a\nlong folder extension argument to the tmail or dmail program. This\ncould lead to arbitrary code execution (CVE-2008-5005).
\nIt was discovered that a NULL pointer dereference could be triggered by\na malicious response to the QUIT command leading to a denial of service\n(CVE-2008-5006).
\nFor the stable distribution (etch), these problems have been fixed in\nversion 2002edebian1-13.1+etch1.
\nFor the unstable distribution (sid) and the testing distribution\n(lenny), these problems have been fixed in version 2007d~dfsg-1.
\nWe recommend that you upgrade your uw-imap packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA buffer overflow has been discovered in the HTTP parser of the No-IP.com\nDynamic DNS update client, which may result in the execution of arbitrary\ncode.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.1.1-4+etch1.
\nFor the upcoming stable distribution (lenny) and the unstable distribution\n(sid), this problem has been fixed in version 2.1.7-11.
\nWe recommend that you upgrade your no-ip package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nTavis Ormandy reported a local DoS and potential privilege\n escalation in the Virtual Dynamic Shared Objects (vDSO)\n implementation.
Eugene Teo reported a local DoS issue in the ext2 and ext3\n filesystems. Local users who have been granted the privileges\n necessary to mount a filesystem would be able to craft a corrupted\n filesystem that causes the kernel to output error messages in an\n infinite loop.
Milos Szeredi reported that the usage of splice() on files opened\n with O_APPEND allows users to write to the file at arbitrary\n offsets, enabling a bypass of possible assumed semantics of the\n O_APPEND flag.
Vlad Yasevich reported an issue in the SCTP subsystem that may\n allow remote users to cause a local DoS by triggering a kernel\n oops.
Eric Sesterhenn reported a local DoS issue in the hfsplus\n filesystem. Local users who have been granted the privileges\n necessary to mount a filesystem would be able to craft a corrupted\n filesystem that causes the kernel to overrun a buffer, resulting\n in a system oops or memory corruption.
Eric Sesterhenn reported a local DoS issue in the hfsplus\n filesystem. Local users who have been granted the privileges\n necessary to mount a filesystem would be able to craft a corrupted\n filesystem that results in a kernel oops due to an unchecked\n return value.
Eric Sesterhenn reported a local DoS issue in the hfs filesystem.\n Local users who have been granted the privileges necessary to\n mount a filesystem would be able to craft a filesystem with a\n corrupted catalog name length, resulting in a system oops or\n memory corruption.
Andrea Bittau reported a DoS issue in the unix socket subsystem\n that allows a local user to cause memory corruption, resulting in\n a kernel panic.
Hugo Dias reported a DoS condition in the ATM subsystem that can\n be triggered by a local user by calling the svc_listen function\n twice on the same socket and reading /proc/net/atm/*vc.
Al Viro reported race conditions in the inotify subsystem that may\n allow local users to acquire elevated privileges.
Dann Frazier reported a DoS condition that allows local users to\n cause the out of memory handler to kill off privileged processes\n or trigger soft lockups due to a starvation issue in the unix\n socket subsystem.
For the stable distribution (etch), this problem has been fixed in\nversion 2.6.18.dfsg.1-23etch1.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nNote: Debian 'etch' includes linux kernel packages based upon both the\n2.6.18 and 2.6.24 linux releases. All known security issues are\ncarefully tracked against both packages and both packages will receive\nsecurity updates until security support for Debian 'etch'\nconcludes. However, given the high frequency at which low-severity\nsecurity issues are discovered in the kernel and the resource\nrequirements of doing an update, lower severity 2.6.18 and 2.6.24\nupdates will typically release in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo SQL injection vulnerabilities have been found in courier-authlib,\nthe courier authentification library. The MySQL database interface used\ninsufficient escaping mechanisms when constructing SQL statements,\nleading to SQL injection vulnerabilities if certain charsets are used\n(CVE-2008-2380). A similar issue affects the PostgreSQL database\ninterface (CVE-2008-2667).
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.58-4+etch2.
\nFor the testing distribution (lenny) and the unstable distribution\n(sid), these problems have been fixed in version 0.61.0-1+lenny1.
\nWe recommend that you upgrade your courier-authlib packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMaksymilian Arciemowicz of securityreason.com reported that ProFTPD is\nvulnerable to cross-site request forgery (CSRF) attacks and executes\narbitrary FTP commands via a long ftp:// URI that leverages an\nexisting session from the FTP client implementation in a web browser.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 1.3.0-19etch2 and in version 1.3.1-15~bpo40+1 for backports.
\nFor the testing (lenny) and unstable (sid) distributions this problem\nhas been fixed in version 1.3.1-15.
\nWe recommend that you upgrade your proftpd-dfsg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo denial of service conditions were discovered in avahi, a Multicast\nDNS implementation.
\nHuge Dias discovered that the avahi daemon aborts with an assert error\nif it encounters a UDP packet with source port 0 (CVE-2008-5081).
\nIt was discovered that the avahi daemon aborts with an assert error if\nit receives an empty TXT record over D-Bus (CVE-2007-3372).
\nFor the stable distribution (etch), these problems have been fixed in\nversion 0.6.16-3etch2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.6.23-3.
\nWe recommend that you upgrade your avahi packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Moodle, an online\ncourse management system. The following issues are addressed in this\nupdate, ranging from cross site scripting to remote code execution.
\nVarious cross site scripting issues in the Moodle codebase\n(CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432,\nMSA-08-0021, MDL-8849, MDL-12793, MDL-11414, MDL-14806,\nMDL-10276).
\nVarious cross site request forgery issues in the Moodle codebase\n(CVE-2008-3325, MSA-08-0023).
\nPrivilege escalation bugs in the Moodle codebase (MSA-08-0001, MDL-7755).
\nSQL injection issue in the hotpot module (MSA-08-0010).
\nAn embedded copy of Smarty had several vulnerabilities\n(CVE-2008-4811, CVE-2008-4810).\nAn embedded copy of Snoopy was vulnerable to cross site scripting\n(CVE-2008-4796).\nAn embedded copy of Kses was vulnerable to cross site scripting\n(CVE-2008-1502).
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.6.3-2+etch1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.8.2.dfsg-2.
\nWe recommend that you upgrade your moodle (1.6.3-2+etch1) package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nIt was discovered that php-xajax, a library to develop Ajax\napplications, did not sufficiently sanitise URLs, which allows attackers\nto perform cross-site scripting attacks by using malicious URLs.\n
\n\nFor the stable distribution (etch) this problem has been fixed in\nversion 0.2.4-2+etch1.\n
\n\nFor the testing (lenny) and unstable (sid) distributions this problem\nhas been fixed in version 0.2.5-1.\n
\n\nWe recommend that you upgrade your php-xajax package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\n\nSeveral remote vulnerabilities have been discovered in phpPgAdmin, a tool\nto administrate PostgreSQL database over the web. The Common\nVulnerabilities and Exposures project identifies the following problems:\n
\n\n Cross-site scripting vulnerability allows remote attackers to inject\n arbitrary web script or HTML via the server parameter.\n
\n Cross-site scripting vulnerability allows remote attackers to inject\n arbitrary web script or HTML via PHP_SELF.\n
\n Directory traversal vulnerability allows remote attackers to read\n arbitrary files via _language parameter.\n
\nFor the stable distribution (etch), these problems have been fixed in\nversion 4.0.1-3.1etch2.\n
\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.2.1-1.1.\n
\n\nWe recommend that you upgrade your phppgadmin package.\n
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Szabo discovered that xterm, a terminal emulator for the X Window\nSystem, places arbitrary characters into the input buffer when\ndisplaying certain crafted escape sequences (CVE-2008-2383).
\nAs an additional precaution, this security update also disables font\nchanging, user-defined keys, and X property changes through escape\nsequences.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 222-1etch3.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your xterm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe regular expression engine of Ruby, a scripting language, contains a\nmemory leak which can be triggered remotely under certain circumstances,\nleading to a denial of service condition (CVE-2008-3443).
\nIn addition, this security update addresses a regression in the REXML\nXML parser of the ruby1.8 package; the regression was introduced in\nDSA-1651-1.
\nFor the stable distribution (etch), this problem has been fixed in version\n1.8.5-4etch4 of the ruby1.8 package, and version 1.9.0+20060609-1etch4\nof the ruby1.9 package.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.8.7.72-1 of the ruby1.8 package. The ruby1.9 package will be\nfixed soon.
\nWe recommend that you upgrade your Ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Icedove\nmail client, an unbranded version of the Thunderbird mail client. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nJustin Schuh, Tom Cross and Peter Williams discovered a buffer\n overflow in the parser for UTF-8 URLs, which may lead to the execution\n of arbitrary code. (MFSA 2008-37)
It was discovered that crashes in the Javascript engine could\n potentially lead to the execution of arbitrary code. (MFSA 2008-20)
\"moz_bug_r_a4\" discovered that the same-origin check in\n nsXMLDocument::OnChannelRedirect() could be bypassed. (MFSA 2008-38)
\"moz_bug_r_a4\" discovered a vulnerability which can result in\n Chrome privilege escalation through XPCNativeWrappers. (MFSA 2008-41)
\"moz_bug_r_a4\" discovered a vulnerability which can result in\n Chrome privilege escalation through XPCNativeWrappers. (MFSA 2008-41)
Olli Pettay and \"moz_bug_r_a4\" discovered a Chrome privilege\n escalation vulnerability in XSLT handling. (MFSA 2008-41)
Jesse Ruderman discovered a crash in the layout engine, which might\n allow the execution of arbitrary code. (MFSA 2008-42)
Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine Labour\n discovered crashes in the Javascript engine, which might allow the\n execution of arbitrary code. (MFSA 2008-42)
Dave Reed discovered that some Unicode byte order marks are\n stripped from Javascript code before execution, which can result in\n code being executed, which were otherwise part of a quoted string.\n (MFSA 2008-43)
It was discovered that a directory traversal allows attackers to\n read arbitrary files via a certain character. (MFSA 2008-44)
It was discovered that a directory traversal allows attackers to\n bypass security restrictions and obtain sensitive information.\n (MFSA 2008-44)
It was discovered that a buffer overflow could be triggered via a\n long header in a news article, which could lead to arbitrary code\n execution. (MFSA 2008-46)
Liu Die Yu and Boris Zbarsky discovered an information leak through\n local shortcut files. (MFSA 2008-47, MFSA 2008-59)
Georgi Guninski, Michal Zalewski and Chris Evan discovered that\n the canvas element could be used to bypass same-origin\n restrictions. (MFSA 2008-48)
Jesse Ruderman discovered that a programming error in the\n window.__proto__.__proto__ object could lead to arbitrary code\n execution. (MFSA 2008-50)
It was discovered that crashes in the layout engine could lead to\n arbitrary code execution. (MFSA 2008-52)
It was discovered that crashes in the Javascript engine could lead to\n arbitrary code execution. (MFSA 2008-52)
It was discovered that a crash in the nsFrameManager might lead to\n the execution of arbitrary code. (MFSA 2008-55)
\"moz_bug_r_a4\" discovered that the same-origin check in\n nsXMLHttpRequest::NotifyEventListeners() could be bypassed.\n (MFSA 2008-56)
Chris Evans discovered that quote characters were improperly\n escaped in the default namespace of E4X documents. (MFSA 2008-58)
Jesse Ruderman discovered that the layout engine is vulnerable to\n DoS attacks that might trigger memory corruption and an integer\n overflow. (MFSA 2008-60)
Boris Zbarsky discovered that an information disclosure attack could\n be performed via XBL bindings. (MFSA 2008-61)
Marius Schilder discovered that it is possible to obtain sensible\n data via a XMLHttpRequest. (MFSA 2008-64)
Chris Evans discovered that it is possible to obtain sensible data\n via a JavaScript URL. (MFSA 2008-65)
Chip Salzenberg discovered possible phishing attacks via URLs with\n leading whitespaces or control characters. (MFSA 2008-66)
It was discovered that it is possible to perform cross-site scripting\n attacks via an XBL binding to an \"unloaded document.\" (MFSA 2008-68)
It was discovered that it is possible to run arbitrary JavaScript\n with chrome privileges via unknown vectors. (MFSA 2008-68)
For the stable distribution (etch) these problems have been fixed in\nversion 1.5.0.13+1.5.0.15b.dfsg1+prepatch080614i-0etch1. Packages for\ns390 will be provided later.
\nFor the upcoming stable distribution (lenny) these problems will be\nfixed soon.
\nFor the unstable (sid) distribution these problems have been fixed in\nversion 2.0.0.19-1.
\nWe recommend that you upgrade your icedove packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Iceape an\nunbranded version of the Seamonkey internet suite. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nJustin Schuh, Tom Cross and Peter Williams discovered a buffer\n overflow in the parser for UTF-8 URLs, which may lead to the\n execution of arbitrary code. (MFSA 2008-37)
It was discovered that a buffer overflow in MIME decoding can lead\n to the execution of arbitrary code. (MFSA 2008-26)
It was discovered that missing boundary checks on a reference\n counter for CSS objects can lead to the execution of arbitrary code.\n (MFSA 2008-34)
Devon Hubbard, Jesse Ruderman and Martijn Wargers discovered\n crashes in the layout engine, which might allow the execution of\n arbitrary code. (MFSA 2008-21)
Igor Bukanov, Jesse Ruderman and Gary Kwong discovered crashes in\n the Javascript engine, which might allow the execution of arbitrary\n code. (MFSA 2008-21)
\"moz_bug_r_a4\" discovered several cross-site scripting vulnerabilities.\n (MFSA 2008-22)
Collin Jackson and Adam Barth discovered that Javascript code\n could be executed in the context or signed JAR archives. (MFSA 2008-23)
\"moz_bug_r_a4\" discovered that XUL documements can escalate\n privileges by accessing the pre-compiled \"fastload\" file.\n (MFSA 2008-24)
\"moz_bug_r_a4\" discovered that missing input sanitising in the\n mozIJSSubScriptLoader.loadSubScript() function could lead to the\n execution of arbitrary code. Iceape itself is not affected, but\n some addons are. (MFSA 2008-25)
Claudio Santambrogio discovered that missing access validation in\n DOM parsing allows malicious web sites to force the browser to\n upload local files to the server, which could lead to information\n disclosure. (MFSA 2008-27)
Daniel Glazman discovered that a programming error in the code for\n parsing .properties files could lead to memory content being\n exposed to addons, which could lead to information disclosure.\n (MFSA 2008-29)
Masahiro Yamada discovered that file URLs in directory listings\n were insufficiently escaped. (MFSA 2008-30)
John G. Myers, Frank Benkstein and Nils Toedtmann discovered that\n alternate names on self-signed certificates were handled\n insufficiently, which could lead to spoofings of secure connections.\n (MFSA 2008-31)
It was discovered that URL shortcut files could be used to bypass the\n same-origin restrictions. This issue does not affect current Iceape,\n but might occur with additional extensions installed. (MFSA 2008-32)
Greg McManus discovered a crash in the block reflow code, which might\n allow the execution of arbitrary code. (MFSA 2008-33)
Billy Rios discovered that passing an URL containing a pipe symbol\n to Iceape can lead to Chrome privilege escalation. (MFSA 2008-35)
\"moz_bug_r_a4\" discovered that the same-origin check in\n nsXMLDocument::OnChannelRedirect() could be bypassed. (MFSA 2008-38)
\"moz_bug_r_a4\" discovered that several vulnerabilities in\n feedWriter could lead to Chrome privilege escalation. (MFSA 2008-39)
Paul Nickerson discovered that an attacker could move windows\n during a mouse click, resulting in unwanted action triggered by\n drag-and-drop. (MFSA 2008-40)
\"moz_bug_r_a4\" discovered a vulnerability which can result in\n Chrome privilege escalation through XPCNativeWrappers. (MFSA 2008-41)
\"moz_bug_r_a4\" discovered a vulnerability which can result in\n Chrome privilege escalation through XPCNativeWrappers. (MFSA 2008-41)
Olli Pettay and \"moz_bug_r_a4\" discovered a Chrome privilege\n escalation vulnerability in XSLT handling. (MFSA 2008-41)
Jesse Ruderman discovered a crash in the layout engine, which might\n allow the execution of arbitrary code. (MFSA 2008-42)
Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine Labour\n discovered crashes in the Javascript engine, which might allow the\n execution of arbitrary code. (MFSA 2008-42)
Dave Reed discovered that some Unicode byte order marks are\n stripped from Javascript code before execution, which can result in\n code being executed, which were otherwise part of a quoted string.\n (MFSA 2008-43)
Boris Zbarsky discovered that resource: URLs allow directory\n traversal when using URL-encoded slashes. (MFSA 2008-44)
Georgi Guninski discovered that resource: URLs could bypass local\n access restrictions. (MFSA 2008-44)
Billy Hoffman discovered that the XBM decoder could reveal\n uninitialised memory. (MFSA 2008-45)
It was discovered that a buffer overflow could be triggered via a\n long header in a news article, which could lead to arbitrary code\n execution. (MFSA 2008-46)
Georgi Guninski, Michal Zalewski and Chris Evan discovered that\n the canvas element could be used to bypass same-origin\n restrictions. (MFSA 2008-48)
It was discovered that insufficient checks in the Flash plugin glue\n code could lead to arbitrary code execution. (MFSA 2008-49)
Jesse Ruderman discovered that a programming error in the\n window.__proto__.__proto__ object could lead to arbitrary code\n execution. (MFSA 2008-50)
It was discovered that crashes in the layout engine could lead to\n arbitrary code execution. (MFSA 2008-52)
Justin Schuh discovered that a buffer overflow in http-index-format\n parser could lead to arbitrary code execution. (MFSA 2008-54)
It was discovered that a crash in the nsFrameManager might lead to\n the execution of arbitrary code. (MFSA 2008-55)
\"moz_bug_r_a4\" discovered that the same-origin check in\n nsXMLHttpRequest::NotifyEventListeners() could be bypassed.\n (MFSA 2008-56)
Chris Evans discovered that quote characters were improperly\n escaped in the default namespace of E4X documents. (MFSA 2008-58)
Liu Die Yu discovered an information leak through local shortcut\n files. (MFSA 2008-59)
Jesse Ruderman discovered that the layout engine is vulnerable to\n DoS attacks that might trigger memory corruption and an integer\n overflow. (MFSA 2008-60)
Boris Zbarsky discovered that an information disclosure attack could\n be performed via XBL bindings. (MFSA 2008-61)
Marius Schilder discovered that it is possible to obtain sensible\n data via a XMLHttpRequest. (MFSA 2008-64)
Chris Evans discovered that it is possible to obtain sensible data\n via a JavaScript URL. (MFSA 2008-65)
Chip Salzenberg discovered possible phishing attacks via URLs with\n leading whitespaces or control characters. (MFSA 2008-66)
It was discovered that it is possible to perform cross-site scripting\n attacks via an XBL binding to an \"unloaded document.\" (MFSA 2008-68)
It was discovered that it is possible to run arbitrary JavaScript\n with chrome privileges via unknown vectors. (MFSA 2008-68)
For the stable distribution (etch) these problems have been fixed in\nversion 1.0.13~pre080614i-0etch1.
\nFor the upcoming stable distribution (lenny) these problems\nwill be fixed soon.
\nFor the unstable (sid) distribution these problems have been fixed in\nversion 1.1.14-1.
\nWe recommend that you upgrade your iceape packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that GForge, a collaborative development tool,\ninsufficiently sanitises some input allowing a remote attacker to\nperform SQL injection.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 4.5.14-22etch10.
\nFor the testing (lenny) and unstable distribution (sid), this problem\nhas been fixed in version 4.7~rc2-7.
\nWe recommend that you upgrade your gforge package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn array index error in zaptel, a set of drivers for telephony hardware,\ncould allow users to crash the system or escalate their privileges by\noverwriting kernel memory (CVE-2008-5396).
\nFor the stable distribution (etch), this problem has been fixed in version\n1.2.11.dfsg-1+etch1.
\nFor the unstable distribution (sid) and the testing distribution\n(lenny), this problem has been fixed in version 1.4.11~dfsg-3.
\nWe recommend that you upgrade your zaptel package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Lasso, a library for Liberty Alliance and SAML\nprotocols performs incorrect validation of the return value of OpenSSL's\nDSA_verify() function.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.6.5-3+etch1.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), this problem has been fixed in version 2.2.1-2.
\nWe recommend that you upgrade your lasso package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that OpenSSL does not properly verify DSA signatures\non X.509 certificates due to an API misuse, potentially leading to the\nacceptance of incorrect X.509 certificates as genuine (CVE-2008-5077).
\nFor the stable distribution (etch), this problem has been fixed in\nversion 0.9.8c-4etch4 of the openssl package, and version\n0.9.7k-3.1etch2 of the openssl097 package.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.9.8g-15.
\nThe testing distribution (lenny) will be fixed soon.
\nWe recommend that you upgrade your OpenSSL packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that NTP, an implementation of the Network Time\nProtocol, does not properly check the result of an OpenSSL function\nfor verifying cryptographic signatures, which may ultimately lead to\nthe acceptance of unauthenticated time information. (Note that\ncryptographic authentication of time servers is often not enabled in\nthe first place.)
\nFor the stable distribution (etch), this problem has been fixed in\nversion 4.2.2.p4+dfsg-2etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 4.2.4p4+dfsg-8.
\nThe testing distribution (lenny) will be fixed soon.
\nWe recommend that you upgrade your ntp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that BIND, an implementation of the DNS protocol\nsuite, does not properly check the result of an OpenSSL function which\nis used to verify DSA cryptographic signatures. As a result,\nincorrect DNS resource records in zones protected by DNSSEC could be\naccepted as genuine.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 9.3.4-2etch4.
\nFor the unstable distribution (sid) and the testing distribution\n(lenny), this problem will be fixed soon.
\nWe recommend that you upgrade your BIND packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nJesse Ruderman discovered that the layout engine is vulnerable to\n DoS attacks that might trigger memory corruption and an integer\n overflow. (MFSA 2008-60)
Boris Zbarsky discovered that an information disclosure attack could\n be performed via XBL bindings. (MFSA 2008-61)
Marius Schilder discovered that it is possible to obtain sensible\n data via a XMLHttpRequest. (MFSA 2008-64)
Chris Evans discovered that it is possible to obtain sensible data\n via a JavaScript URL. (MFSA 2008-65)
Chip Salzenberg discovered possible phishing attacks via URLs with\n leading whitespaces or control characters. (MFSA 2008-66)
It was discovered that it is possible to perform cross-site scripting\n attacks via an XBL binding to an \"unloaded document.\" (MFSA 2008-68)
It was discovered that it is possible to run arbitrary JavaScript\n with chrome privileges via unknown vectors. (MFSA 2008-68)
For the stable distribution (etch) these problems have been fixed in\nversion 1.8.0.15~pre080614i-0etch1.
\nFor the testing distribution (lenny) and the unstable distribution (sid)\nthese problems have been fixed in version 1.9.0.5-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that netatalk, an implementation of the AppleTalk\nsuite, is affected by a command injection vulnerability when processing\nPostScript streams via papd. This could lead to the execution of\narbitrary code. Please note that this only affects installations that are\nconfigured to use a pipe command in combination with wildcard symbols\nsubstituted with values of the printed job.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 2.0.3-4+etch1.
\nFor the upcoming stable distribution (lenny) this problem has been fixed\nin version 2.0.3-11+lenny1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.0.4~beta2-1.
\nWe recommend that you upgrade your netatalk package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTobias Klein discovered that integer overflows in the code the Amarok\nmedia player uses to parse Audible files may lead to the execution of\narbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.4.4-4etch1. Updated packages for sparc and arm will be\nprovided later.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), this problem has been fixed in version 1.4.10-2.
\nWe recommend that you upgrade your amarok packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel web\nbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nJesse Ruderman discovered that the layout engine is vulnerable to\n DoS attacks that might trigger memory corruption and an integer\n overflow. (MFSA 2008-60)
Boris Zbarsky discovered that an information disclosure attack could\n be performed via XBL bindings. (MFSA 2008-61)
It was discovered that attackers could run arbitrary JavaScript with\n chrome privileges via vectors related to the feed preview.\n (MFSA 2008-62)
Marius Schilder discovered that it is possible to obtain sensible\n data via a XMLHttpRequest. (MFSA 2008-64)
Chris Evans discovered that it is possible to obtain sensible data\n via a JavaScript URL. (MFSA 2008-65)
Chip Salzenberg discovered possible phishing attacks via URLs with\n leading whitespaces or control characters. (MFSA 2008-66)
Kojima Hajime and Jun Muto discovered that escaped null characters\n were ignored by the CSS parser and could lead to the bypass of\n protection mechanisms (MFSA 2008-67)
It was discovered that it is possible to perform cross-site scripting\n attacks via an XBL binding to an \"unloaded document.\" (MFSA 2008-68)
It was discovered that it is possible to run arbitrary JavaScript\n with chrome privileges via unknown vectors. (MFSA 2008-68)
moz_bug_r_a4 discovered that the session-restore feature does not\n properly sanitise input leading to arbitrary injections. This issue\n could be used to perform an XSS attack or run arbitrary JavaScript\n with chrome privileges. (MFSA 2008-69)
For the stable distribution (etch) these problems have been fixed in\nversion 2.0.0.19-0etch1.
\nFor the testing distribution (lenny) and the unstable distribution (sid)\nthese problems have been fixed in version 3.0.5-1. Please note iceweasel\nin Lenny links dynamically against xulrunner.
\nWe recommend that you upgrade your iceweasel package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that gitweb, the web interface for the Git version\ncontrol system, contained several vulnerabilities:
\nRemote attackers could use crafted requests to execute shell commands on\nthe web server, using the snapshot generation and pickaxe search\nfunctionality (CVE-2008-5916).
\nLocal users with write access to the configuration of a Git repository\nserved by gitweb could cause gitweb to execute arbitrary shell commands\nwith the permission of the web server (CVE-2008-5516, CVE-2008-5517).
\nFor the stable distribution (etch), these problems have been fixed in\nversion 1.4.4.4-4+etch1.
\nFor the unstable distribution (sid) and testing distribution (lenny),\nthe remote shell command injection issue (CVE-2008-5516) has been fixed\nin version 1.5.6-1. The other issue will be fixed soon.
\nWe recommend that you upgrade your Git packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPaul Szabo discovered that login, the system login tool, did not\ncorrectly handle symlinks while setting up tty permissions. If a local\nattacker were able to gain control of the system utmp file, they could\ncause login to change the ownership and permissions on arbitrary files,\nleading to a root privilege escalation.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 4.0.18.1-7+etch1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 4.1.1-6.
\nWe recommend that you upgrade your shadow package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSpike Spiegel discovered a stack-based buffer overflow in gmetad, the\nmeta-daemon for the ganglia cluster monitoring toolkit, which could be\ntriggered via a request with long path names and might enable\narbitrary code execution.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.5.7-3.1etch1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.5.7-5.
\nFor the testing distribution (lenny), this problem will be fixed soon.
\nWe recommend that you upgrade your ganglia-monitor-core packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remotely exploitable vulnerabilities have been discovered in the\nTYPO3 web content management framework. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nChris John Riley discovered that the TYPO3-wide used encryption key is\n generated with an insufficiently random seed resulting in low entropy\n which makes it easier for attackers to crack this key.
Marcus Krause discovered that TYPO3 is not invalidating a supplied session\n on authentication which allows an attacker to take over a victims\n session via a session fixation attack.
Multiple cross-site scripting vulnerabilities allow remote attackers to\n inject arbitrary web script or HTML via various arguments and user supplied\n strings used in the indexed search system extension, adodb extension test\n scripts or the workspace module.
Mads Olesen discovered a remote command injection vulnerability in\n the indexed search system extension which allows attackers to\n execute arbitrary code via a crafted file name which is passed\n unescaped to various system tools that extract file content for\n the indexing.
Because of CVE-2009-0255, please make sure that besides installing\nthis update, you also create a new encryption key after the\ninstallation.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 4.0.2+debian-7.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.2.5-1.
\nWe recommend that you upgrade your TYPO3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the \"Probe Request\" packet\nparser of the Ralinktech wireless drivers might lead to remote denial of\nservice or the execution of arbitrary code.
\nPlease note that you need to rebuild your driver from the source\npackage in order to set this update into effect. Detailed\ninstructions can be found in /usr/share/doc/rt2400-source/README.Debian
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.2.2+cvs20060620-4+etch1.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), this problem has been fixed in version\n1.2.2+cvs20080623-3.
\nWe recommend that you upgrade your rt2400 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the \"Probe Request\"\npacket parser of the Ralinktech wireless drivers might lead to\nremote denial of service or the execution of arbitrary code.
\nPlease note that you need to rebuild your driver from the source\npackage in order to set this update into effect. Detailed\ninstructions can be found in /usr/share/doc/rt2500-source/README.Debian
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.1.0+cvs20060620-3+etch1.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), this problem has been fixed in version\n1:1.1.0-b4+cvs20080623-3.
\nWe recommend that you upgrade your rt2500 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that an integer overflow in the \"Probe Request\" packet\nparser of the Ralinktech wireless drivers might lead to remote denial of\nservice or the execution of arbitrary code.
\nPlease note that you need to rebuild your driver from the source\npackage in order to set this update into effect. Detailed\ninstructions can be found in /usr/share/doc/rt2570-source/README.Debian
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.1.0+cvs20060620-3+etch1.
\nFor the upcoming stable distribution (lenny) and the unstable\ndistribution (sid), this problem has been fixed in version\n1.1.0+cvs20080623-2.
\nWe recommend that you upgrade your rt2570 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the AttachFile action in moin, a python clone of\nWikiWiki, is prone to cross-site scripting attacks (CVE-2009-0260).\nAnother cross-site scripting vulnerability was discovered in the\nantispam feature (CVE-2009-0312).
\nFor the stable distribution (etch) these problems have been fixed in\nversion 1.5.3-1.2etch2.
\nFor the testing (lenny) distribution these problems have been fixed in\nversion 1.7.1-3+lenny1.
\nFor the unstable (sid) distribution these problems have been fixed in\nversion 1.8.1-1.1.
\nWe recommend that you upgrade your moin packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that xvnc4viewer, a virtual network computing client\nsoftware for X, is prone to an integer overflow via a malicious\nencoding value that could lead to arbitrary code execution.
\nFor the stable distribution (etch) this problem has been fixed in\nversion 4.1.1+X4.3.0-21+etch1.
\nFor the unstable (sid) distribution this problem has been fixed in\nversion 4.1.1+X4.3.0-31.
\nFor the testing (lenny) distribution this problem will be fixed soon.
\nWe recommend that you upgrade your vnc4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Cornelius discovered a buffer overflow in devil, a cross-platform\nimage loading and manipulation toolkit, which could be triggered via a\ncrafted Radiance RGBE file. This could potentially lead to the execution\nof arbitrary code.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.6.7-5+etch1.
\nFor the testing distribution (lenny), this problem has been fixed in\nversion 1.6.8-rc2-3+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.7.5-4.
\nWe recommend that you upgrade your devil package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the core client for the BOINC distributed\ncomputing infrastructure performs incorrect validation of the return\nvalues of OpenSSL's RSA functions.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 5.4.11-4+etch1.
\nFor the upcoming stable distribution (lenny), this problem has been\nfixed in version 6.2.14-3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 6.2.14-3.
\nWe recommend that you upgrade your boinc packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMartin von Gagern discovered that GNUTLS, an implementation of the\nTLS/SSL protocol, handles verification of X.509 certificate chains\nincorrectly if a self-signed certificate is configured as a trusted\ncertificate. This could cause clients to accept forged server\ncertificates as genuine. (CVE-2008-4989)
\nIn addition, this update tightens the checks for X.509v1 certificates\nwhich causes GNUTLS to reject certain certificate chains it accepted\nbefore. (In certificate chain processing, GNUTLS does not recognize\nX.509v1 certificates as valid unless explicitly requested by the\napplication.)
\nFor the stable distribution (etch), this problem has been fixed in\nversion 1.4.4-3+etch3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.2-3 of the gnutls26 package.
\nWe recommend that you upgrade your gnutls13 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the TYPO3 web\ncontent management framework.
\nMarcus Krause and Michael Stucki from the TYPO3 security team\ndiscovered that the jumpUrl mechanism discloses secret hashes enabling\na remote attacker to bypass access control by submitting the correct\nvalue as a URL parameter and thus being able to read the content of\narbitrary files.
\nJelmer de Hen and Dmitry Dulepov discovered multiple cross-site\nscripting vulnerabilities in the backend user interface allowing\nremote attackers to inject arbitrary web script or HTML.
\nAs it is very likely that your encryption key has been exposed we\nstrongly recommend to change your encryption key via the install tool\nafter installing the update.
\nFor the stable distribution (etch) these problems have been fixed in\nversion 4.0.2+debian-8.
\nFor the testing distribution (lenny) these problems have been fixed in\nversion 4.2.5-1+lenny1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.2.6-1.
\nWe recommend that you upgrade your typo3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral local vulnerabilities have been discovered in the PAM module\nfor MIT Kerberos. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nRuss Allbery discovered that the Kerberos PAM module parsed\n configuration settings from environment variables when run from a\n setuid context. This could lead to local privilege escalation if\n an attacker points a setuid program using PAM authentication to a\n Kerberos setup under her control.
Derek Chan discovered that the Kerberos PAM module allows\n reinitialisation of user credentials when run from a setuid\n context, resulting in potential local denial of service by\n overwriting the credential cache file or to privilege escalation.
For the stable distribution (etch), these problems have been fixed in\nversion 2.6-1etch1.
\nFor the upcoming stable distribution (lenny), these problems have been\nfixed in version 3.11-4.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your libpam-krb5 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDerek Chan discovered that the PAM module for the Heimdal Kerberos\nimplementation allows reinitialisation of user credentials when run\nfrom a setuid context, resulting in potential local denial of service\nby overwriting the credential cache file or to local privilege\nescalation.
\nFor the stable distribution (etch), this problem has been fixed in\nversion 2.5-1etch1.
\nFor the upcoming stable distribution (lenny), this problem has been\nfixed in version 3.10-2.1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your libpam-heimdal package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Brooks discovered that phpMyAdmin, a tool to administrate MySQL\nover the web, performs insufficient input sanitising allowing a user\nassisted remote attacker to execute code on the webserver.
\nFor the stable distribution (etch), this problem has been fixed in version\n2.9.1.1-10.
\nFor the testing distribution (lenny) and unstable distribution (sid), this\nproblem has been fixed in version 2.11.8.1-5.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Moodle, an online\ncourse management system. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nIt was discovered that the information stored in the log tables\n was not properly sanitized, which could allow attackers to inject\n arbitrary web code.
It was discovered that certain input via the \"Login as\" function\n was not properly sanitised leading to the injection of arbitrary\n web script.
Dmitry E. Oboukhov discovered that the SpellCheker plugin creates\n temporary files insecurely, allowing a denial of service attack.\n Since the plugin was unused, it is removed in this update.
For the stable distribution (etch) these problems have been fixed in\nversion 1.6.3-2+etch2.
\nFor the testing (lenny) distribution these problems have been fixed in\nversion 1.8.2.dfsg-3+lenny1.
\nFor the unstable (sid) distribution these problems have been fixed in\nversion 1.8.2.dfsg-4.
\nWe recommend that you upgrade your moodle package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBas van Schaik discovered that WebSVN, a tool to view Subversion\nrepositories over the web, did not properly restrict access to private\nrepositories, allowing a remote attacker to read significant parts of\ntheir content.
\nThe old stable distribution (etch) is not affected by this problem.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0-4+lenny1.
\nFor the unstable distribution (sid), this problem has also been fixed in\nversion 2.0-4+lenny1.
\nWe recommend that you upgrade your websvn package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMike Wiacek discovered that a buffer overflow in the ARC2 implementation\nof Python Crypto, a collection of cryptographic algorithms and protocols\nfor Python allows denial of service and potentially the execution of\narbitrary code.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0.1+dfsg1-2.3+lenny0.
\nDue to a technical limitation in the Debian archive management scripts\nthe update for the old stable distribution (etch) cannot be released\nsynchronously. It will be fixed in version 2.0.1+dfsg1-1.2+etch0 soon.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your python-crypto package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo SQL injection vulnerabilities have been found in proftpd, a\nvirtual-hosting FTP daemon. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nShino discovered that proftpd is prone to an SQL injection\n vulnerability via the use of certain characters in the username.
TJ Saunders discovered that proftpd is prone to an SQL injection\n vulnerability due to insufficient escaping mechanisms, when\n multybite character encodings are used.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.3.1-17lenny1.
\nFor the oldstable distribution (etch), these problems will be fixed\nsoon.
\nFor the testing distribution (squeeze), these problems will be fixed\nsoon.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.3.2-1.
\nWe recommend that you upgrade your proftpd-dfsg package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that dkim-milter, an implementation of the DomainKeys\nIdentified Mail protocol, may crash during DKIM verification if it\nencounters a specially-crafted or revoked public key record in DNS.
\nThe old stable distribution (etch) does not contain dkim-milter packages.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.6.0.dfsg-1+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.6.0.dfsg-2.
\nWe recommend that you upgrade your dkim-milter packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in gst-plugins-bad0.10, a\ncollection of various GStreamer plugins. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nTobias Klein discovered a buffer overflow in the quicktime stream\n\tdemuxer (qtdemux), which could potentially lead to the execution of\n\tarbitrary code via crafted .mov files.
Tobias Klein discovered an array index error in the quicktime stream\n\tdemuxer (qtdemux), which could potentially lead to the execution of\n\tarbitrary code via crafted .mov files.
Tobias Klein discovered a buffer overflow in the quicktime stream\n\tdemuxer (qtdemux) similar to the issue reported in CVE-2009-0386, which\n\tcould also lead to the execution of arbitrary code via crafted .mov\n\tfiles.
For the oldstable distribution (etch), these problems have been fixed in\nversion 0.10.3-3.1+etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.10.8-4.1~lenny1 of gst-plugins-good0.10, since the affected\nplugin has been moved there. The fix was already included in the lenny\nrelease.
\nFor the unstable distribution (sid) and the testing distribution\n(squeeze), these problems have been fixed in version 0.10.8-4.1 of\ngst-plugins-good0.10.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe security update for proftpd-dfsg in DSA-1727-1 caused a regression\nwith the postgresql backend. This update corrects the flaw. Also it was\ndiscovered that the oldstable distribution (etch) is not affected by the\nsecurity issues. For reference the original advisory follows.
\nTwo SQL injection vulnerabilities have been found in proftpd, a\nvirtual-hosting FTP daemon. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nShino discovered that proftpd is prone to an SQL injection vulnerability\n\tvia the use of certain characters in the username.
TJ Saunders discovered that proftpd is prone to an SQL injection\n\tvulnerability due to insufficient escaping mechanisms, when multybite\n\tcharacter encodings are used.
The oldstable distribution (etch) is not affected by these problems.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.3.1-17lenny2.
\nFor the testing distribution (squeeze), these problems will be fixed\nsoon.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.3.2-1.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAnders Kaseorg discovered that ndiswrapper suffers from buffer overflows\nvia specially crafted wireless network traffic, due to incorrectly\nhandling long ESSIDs. This could lead to the execution of arbitrary\ncode.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.28-1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.53-2, which was already included in the lenny release.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.53-2.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJoshua Morin, Mikko Varpiola and Jukka Taimisto discovered an assertion\nerror in squid3, a full featured Web Proxy cache, which could lead to\na denial of service attack.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 3.0.PRE5-5+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.0.STABLE8-3, which was already included in the lenny release.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 3.0.STABLE8-3.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in vim, an enhanced vi editor.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nJan Minar discovered that vim did not properly sanitise inputs\n before invoking the execute or system functions inside vim\n scripts. This could lead to the execution of arbitrary code.
Jan Minar discovered that the tar plugin of vim did not properly\n sanitise the filenames in the tar archive or the name of the\n archive file itself, making it prone to arbitrary code execution.
Jan Minar discovered that the zip plugin of vim did not properly\n sanitise the filenames in the zip archive or the name of the\n archive file itself, making it prone to arbitrary code execution.
Jan Minar discovered that the netrw plugin of vim did not properly\n sanitise the filenames or directory names it is given. This could\n lead to the execution of arbitrary code.
Ben Schmidt discovered that vim did not properly escape characters\n when performing keyword or tag lookups. This could lead to the\n execution of arbitrary code.
For the oldstable distribution (etch), these problems have been fixed in\nversion 1:7.0-122+1etch5.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1:7.1.314-3+lenny1, which was already included in the lenny\nrelease.
\nFor the testing distribution (squeeze), these problems have been fixed\nin version 1:7.1.314-3+lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2:7.2.010-1.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nb.badrignans discovered that OpenSC, a set of smart card utilities,\ncould stores private data on a smart card without proper access\nrestrictions.
\nOnly blank cards initialised with OpenSC are affected by this problem.\nThis update only improves creating new private data objects, but cards\nalready initialised with such private data objects need to be\nmodified to repair the access control conditions on such cards.\nInstructions for a variety of situations can be found at the OpenSC\nweb site: http://www.opensc-project.org/security.html
\nThe oldstable distribution (etch) is not affected by this problem.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.11.4-5+lenny1.
\nFor the unstable distribution (sid), this problem wil be fixed soon.
\nWe recommend that you upgrade your opensc package and recreate any\nprivate data objects stored on your smart cards.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that znc, an IRC proxy/bouncer, does not properly\nsanitize input contained in configuration change requests to the\nwebadmin interface. This allows authenticated users to elevate their\nprivileges and indirectly execute arbitrary commands (CVE-2009-0759).
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 0.045-3+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.058-2+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.066-1.
\nWe recommend that you upgrade your znc packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that mahara, an electronic portfolio, weblog, and\nresume builder, is prone to cross-site scripting attacks, which allows\nthe injection of arbitrary Java or HTML code.
\nThe oldstable distribution (etch) does not contain mahara.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.4-4+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your mahara package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security issues have been discovered in wesnoth, a fantasy\nturn-based strategy game. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nDaniel Franke discovered that the wesnoth server is prone to a denial of\nservice attack when receiving special crafted compressed data.
Daniel Franke discovered that the sandbox implementation for the python\nAIs can be used to execute arbitrary python code on wesnoth clients. In\norder to prevent this issue, the python support has been disabled. A\ncompatibility patch was included, so that the affected campagne is still\nworking properly.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.4.4-2+lenny1.
\nFor the oldstable distribution (etch), these problems have been fixed\nin version 1.2-5.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 1.4.7-4.
\nWe recommend that you upgrade your wesnoth packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDavid Kierznowski discovered that libcurl, a multi-protocol file transfer\nlibrary, when configured to follow URL redirects automatically, does not\nquestion the new target location. As libcurl also supports file:// and\nscp:// URLs - depending on the setup - an untrusted server could use that\nto expose local files, overwrite local files or even execute arbitrary\ncode via a malicious URL redirect.
\nThis update introduces a new option called CURLOPT_REDIR_PROTOCOLS which by\ndefault does not include the scp and file protocol handlers.
\nFor the oldstable distribution (etch) this problem has been fixed in\nversion 7.15.5-1etch2.
\nFor the stable distribution (lenny) this problem has been fixed in\nversion 7.18.2-8lenny2.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 7.18.2-8.1.
\nWe recommend that you upgrade your curl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that mldonkey, a client for several P2P\nnetworks, allows attackers to download arbitrary files using crafted\nrequests to the HTTP console.
\nThe old stable distribution (etch) is not affected by this problem.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.9.5-2+lenny1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your mldonkey packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that yaws, a high performance HTTP 1.1 webserver, is\nprone to a denial of service attack via a request with a large HTTP\nheader.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.77-3+lenny1.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.65-4etch1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.80-1.
\nWe recommend that you upgrade your yaws package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJesus Olmos Gonzalez discovered that an integer overflow in the PSI\nJabber client may lead to remote denial of service.
\nThe old stable distribution (etch) is not affected.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.11-9.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.12.1-1.
\nWe recommend that you upgrade your psi package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAlan Rad Pop discovered that libsndfile, a library to read and write\nsampled audio data, is prone to an integer overflow. This causes a\nheap-based buffer overflow when processing crafted CAF description\nchunks possibly leading to arbitrary code execution.
\nFor the oldstable distribution (etch) this problem has been fixed in\nversion 1.0.16-2+etch1.
\nFor the stable distribution (lenny) this problem has been fixed in\nversion 1.0.17-4+lenny1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 1.0.19-1.
\nWe recommend that you upgrade your libsndfile packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo buffer overflows have been found in the GIF image parsing code of\nTk, a cross-platform graphical toolkit, which could lead to the execution\nof arbitrary code. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that libtk-img is prone to a buffer overflow via\nspecially crafted multi-frame interlaced GIF files.
It was discovered that libtk-img is prone to a buffer overflow via\nspecially crafted GIF files with certain subimage sizes.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.3-release-7+lenny1.
\nFor the oldstable distribution (etch), these problems have been fixed in\nversion 1.3-15etch3.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 1.3-release-8.
\nWe recommend that you upgrade your libtk-img packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSebastien Helleu discovered that an error in the handling of color codes\nin the weechat IRC client could cause an out-of-bounds read of an internal\ncolor array. This can be used by an attacker to crash user clients\nvia a crafted PRIVMSG command.
\nThe weechat version in the oldstable distribution (etch) is not affected\nby this problem.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.2.6-1+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.2.6.1-1.
\nWe recommend that you upgrade your weechat packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security issues have been discovered in lcms, a color management\nlibrary. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nChris Evans discovered that lcms is affected by a memory leak, which\ncould result in a denial of service via specially crafted image files.
Chris Evans discovered that lcms is prone to several integer overflows\nvia specially crafted image files, which could lead to the execution of\narbitrary code.
Chris Evans discovered the lack of upper-bounds check on sizes leading\nto a buffer overflow, which could be used to execute arbitrary code.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.17.dfsg-1+lenny1.
\nFor the oldstable distribution (etch), these problems have been fixed\nin version 1.15-1.1+etch2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed soon.
\nWe recommend that you upgrade your lcms packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo security issues have been discovered in ghostscript, the GPL\nGhostscript PostScript/PDF interpreter. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nJan Lieskovsky discovered multiple integer overflows in the ICC library,\nwhich allow the execution of arbitrary code via crafted ICC profiles in\nPostScript files with embedded images.
Jan Lieskovsky discovered insufficient upper-bounds checks on certain\nvariable sizes in the ICC library, which allow the execution of\narbitrary code via crafted ICC profiles in PostScript files with\nembedded images.
For the stable distribution (lenny), these problems have been fixed in\nversion 8.62.dfsg.1-3.2lenny1.
\nFor the oldstable distribution (etch), these problems have been fixed\nin version 8.54.dfsg.1-5etch2. Please note that the package in oldstable\nis called gs-gpl.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed soon.
\nWe recommend that you upgrade your ghostscript/gs-gpl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDiego Petten\u00f2 discovered that glib2.0, the GLib library of C routines,\nhandles large strings insecurely via its Base64 encoding functions. This\ncould possible lead to the execution of arbitrary code.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.16.6-1+lenny1.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.12.4-2+etch1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.20.0-1.
\nWe recommend that you upgrade your glib2.0 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that libsoup, an HTTP library implementation in C,\nhandles large strings insecurely via its Base64 encoding functions. This\ncould possibly lead to the execution of arbitrary code.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.2.98-2+etch1.
\nThe stable distribution (lenny) is not affected by this issue.
\nThe testing distribution (squeeze) and the unstable distribution (sid)\nare not affected by this issue.
\nWe recommend that you upgrade your libsoup packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nChristian Borntraeger discovered an issue effecting the alpha,\n mips, powerpc, s390 and sparc64 architectures that allows local\n users to cause a denial of service or potentially gain elevated\n privileges.
Vegard Nossum discovered a memory leak in the keyctl subsystem\n that allows local users to cause a denial of service by consuming\n all of kernel memory.
Wei Yongjun discovered a memory overflow in the SCTP\n implementation that can be triggered by remote users.
Duane Griffin provided a fix for an issue in the eCryptfs\n subsystem which allows local users to cause a denial of service\n (fault or memory corruption).
Pavel Roskin provided a fix for an issue in the dell_rbu driver\n that allows a local user to cause a denial of service (oops) by\n reading 0 bytes from a sysfs entry.
Clement LECIGNE discovered a bug in the sock_getsockopt function\n that may result in leaking sensitive kernel memory.
Roel Kluin discovered inverted logic in the skfddi driver that\n permits local, unprivileged users to reset the driver statistics.
Peter Kerwien discovered an issue in the ext4 filesystem that\n allows local users to cause a denial of service (kernel oops)\n during a resize operation.
Sami Liedes reported an issue in the ext4 filesystem that allows\n local users to cause a denial of service (kernel oops) when\n accessing a specially crafted corrupt filesystem.
David Maciejak reported an issue in the ext4 filesystem that\n allows local users to cause a denial of service (kernel oops) when\n mounting a specially crafted corrupt filesystem.
David Maciejak reported an additional issue in the ext4 filesystem\n that allows local users to cause a denial of service (kernel oops)\n when mounting a specially crafted corrupt filesystem.
For the oldstable distribution (etch), these problems, where applicable,\nwill be fixed in future updates to linux-2.6 and linux-2.6.24.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.6.26-13lenny2.
\nWe recommend that you upgrade your linux-2.6 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in libpng, a library for\nreading and writing PNG files. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nThe png_handle_tRNS function allows attackers to cause a denial of service\n (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.
Certain chunk handlers allow attackers to cause a denial of service (crash)\n via crafted pCAL, sCAL, tEXt, iTXt, and ztXT chunking in PNG images, which\n trigger out-of-bounds read operations.
libpng allows context-dependent attackers to cause a denial of service\n (crash) and possibly execute arbitrary code via a PNG file with zero\n length \"unknown\" chunks, which trigger an access of uninitialized\n memory.
The png_check_keyword might allow context-dependent attackers to set the\n value of an arbitrary memory location to zero via vectors involving\n creation of crafted PNG files with keywords.
A memory leak in the png_handle_tEXt function allows context-dependent\n attackers to cause a denial of service (memory exhaustion) via a crafted\n PNG file.
libpng allows context-dependent attackers to cause a denial of service\n (application crash) or possibly execute arbitrary code via a crafted PNG\n file that triggers a free of an uninitialized pointer in (1) the\n png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit\n gamma tables.
For the old stable distribution (etch), these problems have been fixed\nin version 1.2.15~beta5-1+etch2.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.2.27-2+lenny2. (Only CVE-2008-5907, CVE-2008-5907 and\nCVE-2009-0040 affect the stable distribution.)
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.2.35-1.
\nWe recommend that you upgrade your libpng packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nMartijn Wargers, Jesse Ruderman and Josh Soref discovered crashes\n in the layout engine, which might allow the execution of arbitrary\n code.
Jesse Ruderman discovered crashes in the layout engine, which\n might allow the execution of arbitrary code.
Gary Kwong, and Timothee Groleau discovered crashes in the\n Javascript engine, which might allow the execution of arbitrary code.
Gary Kwong discovered crashes in the Javascript engine, which\n might allow the execution of arbitrary code.
It was discovered that incorrect memory management in the DOM\n element handling may lead to the execution of arbitrary code.
Georgi Guninski discovered a violation of the same-origin policy\n through RDFXMLDataSource and cross-domain redirects.
As indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.
\nFor the stable distribution (lenny), these problems have been fixed\nin version 1.9.0.7-0lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.7-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nWilfried Goesgens discovered that WebCit, the web-based user interface\nfor the Citadel groupware system, contains a format string\nvulnerability in the mini_calendar component, possibly allowing\narbitrary code execution (CVE-2009-0364).
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 7.37-dfsg-7.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 7.38b-dfsg-2.
\nWe recommend that you upgrade your webcit packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAs indicated in the Etch release notes, security support for the\nIceweasel version in the oldstable distribution (Etch) needed to be\nstopped before the end of the regular security maintenance life cycle.
\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.
\nOn a side note, please note that the Debian stable/Lenny version of\nIceweasel - the unbranded version of the Firefox browser - links\ndynamically against the Xulrunner library. As such, most of the\nvulnerabilities found in Firefox need only be fixed in the Xulrunner\npackage and don't require updates to the Iceweasel package any longer.
\nIt was discovered that roundup, an issue tracker with a command-line,\nweb and email interface, allows users to edit resources in\nunauthorized ways, including granting themselves admin rights.
\nThis update introduces stricter access checks, actually enforcing the\nconfigured permissions and roles. This means that the configuration\nmay need updating. In addition, user registration via the web\ninterface has been disabled; use the program \"roundup-admin\" from the\ncommand line instead.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 1.2.1-10+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.4.4-4+lenny1.
\nWe recommend that you upgrade your roundup package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nErik Sjoelund discovered that a race condition in the stap tool shipped\nby Systemtap, an instrumentation system for Linux 2.6, allows local\nprivilege escalation for members of the stapusr group.
\nThe old stable distribution (etch) isn't affected.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.0.20080705-1+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.0.20090314-2.
\nWe recommend that you upgrade your systemtap package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nSecurity researcher Guido Landi discovered that a XSL stylesheet could\n be used to crash the browser during a XSL transformation. An attacker\n could potentially use this crash to run arbitrary code on a victim's\n computer.
Security researcher Nils reported via TippingPoint's Zero Day Initiative\n that the XUL tree method _moveToEdgeShift was in some cases triggering\n garbage collection routines on objects which were still in use. In such\n cases, the browser would crash when attempting to access a previously\n destroyed object and this crash could be used by an attacker to run\n arbitrary code on a victim's computer.
Note that after installing these updates, you will need to restart any\npackages using xulrunner, typically iceweasel or epiphany.
\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.
\nFor the stable distribution (lenny), these problems have been fixed in version\n1.9.0.7-0lenny2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.8-1
\nWe recommend that you upgrade your xulrunner package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that auth2db, an IDS logger, log viewer and alert\ngenerator, is prone to an SQL injection vulnerability, when used with\nmultibyte character encodings.
\nThe oldstable distribution (etch) doesn't contain auth2db.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.2.5-2+dfsg-1+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.2.5-2+dfsg-1.1.
\nWe recommend that you upgrade your auth2db packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLeigh James discovered that nss-ldapd, an NSS module for using\nLDAP as a naming service, by default creates the configuration file\n/etc/nss-ldapd.conf world-readable which could leak the configured\nLDAP password if one is used for connecting to the LDAP server.
\nThe old stable distribution (etch) doesn't contain nss-ldapd.
\nFor the stable distribution (lenny) this problem has been fixed in\nversion 0.6.7.1.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 0.6.8.
\nWe recommend that you upgrade your nss-ldapd package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nGerd v. Egidy discovered that the Pluto IKE daemon in strongswan, an\nIPSec implementation for linux, is prone to a denial of service attack\nvia a malicious packet.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.8.0+dfsg-1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 4.2.4-5+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your strongswan packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in openswan, an IPSec\nimplementation for linux. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nDmitry E. Oboukhov discovered that the livetest tool is using temporary\nfiles insecurely, which could lead to a denial of service attack.
Gerd v. Egidy discovered that the Pluto IKE daemon in openswan is prone\nto a denial of service attack via a malicious packet.
For the oldstable distribution (etch), this problem has been fixed in\nversion 2.4.6+dfsg.2-1.1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.4.12+dfsg-1.3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your openswan packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChristian J. Eibl discovered that the TeX filter of Moodle, a web-based\ncourse management system, doesn't check user input for certain TeX commands\nwhich allows an attacker to include and display the content of arbitrary system\nfiles.
\nNote that this doesn't affect installations that only use the mimetex\nenvironment.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.6.3-2+etch3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.8.2.dfsg-3+lenny2.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.8.2.dfsg-5.
\nWe recommend that you upgrade your moodle packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that icu, the internal components for Unicode, did\nnot properly sanitise invalid encoded data, which could lead to crosssite scripting attacks.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 3.6-2etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.8.1-3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 4.0.1-1.
\nWe recommend that you upgrade your icu packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that insufficient length validations in the ASN.1\nhandling of the OpenSSL crypto library may lead to denial of service\nwhen processing a manipulated certificate.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 0.9.8c-4etch5 of the openssl package and in version\n0.9.7k-3.1etch3 of the openssl097 package.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.9.8g-15+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.9.8g-16.
\nWe recommend that you upgrade your openssl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Tunapie, a GUI frontend\nto video and radio streams. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nKees Cook discovered that insecure handling of temporary files may\n lead to local denial of service through symlink attacks.
Mike Coleman discovered that insufficient escaping of stream\n URLs may lead to the execution of arbitrary commands if a user\n is tricked into opening a malformed stream URL.
For the old stable distribution (etch), these problems have been fixed\nin version 1.3.1-1+etch2. Due to a technical problem, this update cannot\nbe released synchronously with the stable (lenny) version, but will\nappear soon.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.1.8-2.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your tunapie package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in horde3, the horde web application\nframework. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nGunnar Wrobel discovered a directory traversal vulnerability, which\nallows attackers to include and execute arbitrary local files via the\ndriver parameter in Horde_Image.
It was discovered that an attacker could perform a cross-site scripting\nattack via the contact name, which allows attackers to inject arbitrary\nhtml code. This requires that the attacker has access to create\ncontacts.
It was discovered that the horde XSS filter is prone to a cross-site\nscripting attack, which allows attackers to inject arbitrary html code.\nThis is only exploitable when Internet Explorer is used.
For the oldstable distribution (etch), these problems have been fixed in\nversion 3.1.3-4etch5.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 3.2.2+debian0-2, which was already included in the lenny\nrelease.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 3.2.2+debian0-2.
\nWe recommend that you upgrade your horde3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in the MIT reference implementation\nof Kerberos V5, a system for authenticating users and services on a network.\nThe Common Vulnerabilities and Exposures project identified the following\nproblems:
\nThe Apple Product Security team discovered that the SPNEGO GSS-API mechanism\nsuffers of a missing bounds check when reading a network input buffer which\nresults in an invalid read crashing the application or possibly leaking\ninformation.
Under certain conditions the SPNEGO GSS-API mechanism references a null pointer\nwhich crashes the application using the library.
An incorrect length check inside the ASN.1 decoder of the MIT krb5\nimplementation allows an unauthenticated remote attacker to crash of the kinit\nor KDC program.
Under certain conditions the the ASN.1 decoder of the MIT krb5 implementation\nfrees an uninitialized pointer which could lead to denial of service and\npossibly arbitrary code execution.
For the oldstable distribution (etch), this problem has been fixed in\nversion 1.4.4-7etch7.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.6.dfsg.4~beta1-5lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6.dfsg.4~beta1-13.
\nWe recommend that you upgrade your krb5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that multipathd of multipath-tools, a tool-chain to manage\ndisk multipath device maps, uses insecure permissions on its unix domain\ncontrol socket which enables local attackers to issue commands to multipathd\nprevent access to storage devices or corrupt file system data.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.4.7-1.1etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.4.8-14+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.4.8-15.
\nWe recommend that you upgrade your multipath-tools packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities were discovered in the client part of OpenAFS, a\ndistributed file system.
\nAn attacker with control of a file server or the ability to forge RX\npackets may be able to execute arbitrary code in kernel mode on an\nOpenAFS client, due to a vulnerability in XDR array decoding.
An attacker with control of a file server or the ability to forge RX\npackets may crash OpenAFS clients because of wrongly handled error\nreturn codes in the kernel module.
Note that in order to apply this security update, you must rebuild the\nOpenAFS kernel module. Be sure to also upgrade openafs-modules-source,\nbuild a new kernel module for your system following the instructions in\n/usr/share/doc/openafs-client/README.modules.gz, and then either stop\nand restart openafs-client or reboot the system to reload the kernel\nmodule.
\nFor the old stable distribution (etch), these problems have been fixed\nin version 1.4.2-6etch2.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.4.7.dfsg1-6+lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.4.10+dfsg1-1.
\nWe recommend that you upgrade your openafs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been identified in OpenJDK, an\nimplementation of the Java SE platform.
\nCreation of large, temporary fonts could use up available disk space,\n leading to a denial of service condition.
\nSeveral vulnerabilities existed in the embedded LittleCMS library,\n exploitable through crafted images: a memory leak, resulting in a\n denial of service condition (CVE-2009-0581), heap-based buffer\n overflows, potentially allowing arbitrary code execution\n (CVE-2009-0723, CVE-2009-0733), and a null-pointer dereference,\n leading to denial of service (CVE-2009-0793).
The LDAP server implementation (in com.sun.jdni.ldap) did not properly\n close sockets if an error was encountered, leading to a\n denial-of-service condition.
The LDAP client implementation (in com.sun.jdni.ldap) allowed\n malicious LDAP servers to execute arbitrary code on the client.
The HTTP server implementation (sun.net.httpserver) contained an\n unspecified denial of service vulnerability.
Several issues in Java Web Start have been addressed. The Debian packages\n currently do not support Java Web Start, so these issues are not\n directly exploitable, but the relevant code has been updated\n nevertheless.
For the stable distribution (lenny), these problems have been fixed in\nversion 9.1+lenny2.
\nWe recommend that you upgrade your openjdk-6 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in imp4, a webmail component for\nthe horde framework. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that imp4 suffers from a cross-site scripting (XSS)\nattack via the user field in an IMAP session, which allows attackers to\ninject arbitrary HTML code.
It was discovered that imp4 is prone to several cross-site scripting\n(XSS) attacks via several vectors in the mail code allowing attackers\nto inject arbitrary HTML code.
For the oldstable distribution (etch), these problems have been fixed in\nversion 4.1.3-4etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4.2-4, which was already included in the lenny release.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 4.2-4.
\nWe recommend that you upgrade your imp4 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the ClamAV anti-virus\ntoolkit:
\nAttackers can cause a denial of service (crash) via a crafted EXE\n file that triggers a divide-by-zero error.
Attackers can cause a denial of service (infinite loop) via a\n crafted tar file that causes (1) clamd and (2) clamscan to hang.
(no CVE Id yet)
\nAttackers can cause a denial of service (crash) via a crafted EXE\n file that crashes the UPack unpacker.
For the old stable distribution (etch), these problems have been fixed\nin version 0.90.1dfsg-4etch19.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.94.dfsg.2-1lenny2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.95.1+dfsg-1.
\nWe recommend that you upgrade your clamav packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSebastian Kramer discovered two vulnerabilities in udev, the /dev and\nhotplug management daemon.
\nudev does not check the origin of NETLINK messages, allowing local\n users to gain root privileges.
udev suffers from a buffer overflow condition in path encoding,\n potentially allowing arbitrary code execution.
For the old stable distribution (etch), these problems have been fixed in\nversion 0.105-4etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.125-7+lenny1.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your udev package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the imagetops filter in cups, the Common UNIX\nPrinting System, is prone to an integer overflow when reading malicious\nTIFF images.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.2.7-4etch7.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.3.8-1lenny5.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your cups packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that ejabberd, a distributed, fault-tolerant\nJabber/XMPP server, does not sufficiently sanitise MUC logs, allowing\nremote attackers to perform cross-site scripting (XSS) attacks.
\nThe oldstable distribution (etch) is not affected by this issue.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0.1-6+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.0.5-1.
\nWe recommend that you upgrade your ejabberd packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that php-json-ext, a JSON serialiser for PHP, is\nprone to a denial of service attack, when receiving a malformed string\nvia the json_decode function.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.2.1-3.2+etch1.
\nThe stable distribution (lenny) does not contain a separate php-json-ext\npackage, but includes it in the php5 packages, which will be fixed soon.
\nThe testing distribution (squeeze) and the unstable distribution (sid)\ndo not contain a separate php-json-ext package, but include it in the\nphp5 packages.
\nWe recommend that you upgrade your php-json-ext packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Simple Linux Utility for Resource Management\n(SLURM), a cluster job management and scheduling system, did not drop\nthe supplemental groups. These groups may be system groups with elevated\nprivileges, which may allow a valid SLURM user to gain elevated privileges.
\nThe old stable distribution (etch) does not contain a slurm-llnl package.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.3.6-1lenny3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.15-1.
\nWe recommend that you upgrade your slurm-llnl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter Palfrader discovered that in the Git revision control system,\non some architectures files under /usr/share/git-core/templates/ were\nowned by a non-root user. This allows a user with that uid on the local\nsystem to write to these files and possibly escalate their privileges.
\nThis issue only affects the DEC Alpha and MIPS (big and little endian)\narchitectures.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 1.4.4.4-4+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.5.6.5-3+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6.2.1-1.
\nWe recommend that you upgrade your git-core package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that mahara, an electronic portfolio, weblog, and\nresume builder, is prone to cross-site scripting (XSS) attacks because\nof missing input sanitization of the introduction text field in user\nprofiles and any text field in a user view.
\nThe oldstable distribution (etch) does not contain mahara.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.4-4+lenny2.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.3-1.
\nWe recommend that you upgrade your mahara packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in APT, the well-known dpkg\nfrontend. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nIn time zones where daylight savings time occurs at midnight,\n the apt cron.daily script fails, stopping new security updates\n from being applied automatically.
A repository that has been signed with an expired or revoked\n OpenPGP key would still be considered valid by APT.
For the old stable distribution (etch), these problems have been fixed in\nversion 0.6.46.4-0.1+etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.7.20.2+lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.7.21.
\nWe recommend that you upgrade your apt package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in libdbd-pg-perl, the DBI\ndriver module for PostgreSQL database access (DBD::Pg).
\nA heap-based buffer overflow may allow attackers to execute arbitrary\n code through applications which read rows from the database using the\n pg_getline and getline functions. (More common retrieval methods,\n such as selectall_arrayref and fetchrow_array, are not affected.)
A memory leak in the routine which unquotes BYTEA values returned from\n the database allows attackers to cause a denial of service.
For the old stable distribution (etch), these problems have been fixed\nin version 1.49-2+etch1.
\nFor the stable distribution (lenny) and the unstable distribution (sid),\nthese problems have been fixed in version 2.1.3-1 before the release of\nlenny.
\nWe recommend that you upgrade your libdbd-pg-perl package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in ffmpeg, a multimedia\nplayer, server and encoder. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nIt was discovered that watching a malformed 4X movie file could lead to\nthe execution of arbitrary code.
It was discovered that using a crafted STR file can lead to the\nexecution of arbitrary code.
For the oldstable distribution (etch), these problems have been fixed\nin version 0.cvs20060823-8+etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.svn20080206-17+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 0.svn20080206-16.
\nWe recommend that you upgrade your ffmpeg-debian packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in mplayer, a movie player\nfor Unix-like systems. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nIt was discovered that watching a malformed 4X movie file could lead to\nthe execution of arbitrary code.
It was discovered that multiple buffer overflows could lead to the\nexecution of arbitrary code.
It was discovered that watching a malformed TwinVQ file could lead to\nthe execution of arbitrary code.
For the oldstable distribution (etch), these problems have been fixed\nin version 1.0~rc1-12etch7.
\nFor the stable distribution (lenny), mplayer links against\nffmpeg-debian.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), mplayer links against ffmpeg-debian.
\nWe recommend that you upgrade your mplayer packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities have been identified affecting MySQL, a\nrelational database server, and its associated interactive client\napplication. The Common Vulnerabilities and Exposures project\nidentifies the following two problems:
\nKay Roepke reported that the MySQL server would not properly handle\n an empty bit-string literal in an SQL statement, allowing an\n authenticated remote attacker to cause a denial of service (a crash)\n in mysqld. This issue affects the oldstable distribution (etch), but\n not the stable distribution (lenny).
Thomas Henlich reported that the MySQL commandline client application\n did not encode HTML special characters when run in HTML output mode\n (that is, \"mysql --html ...\"). This could potentially lead to\n cross-site scripting or unintended script privilege escalation if\n the resulting output is viewed in a browser or incorporated into\n a web site.
For the old stable distribution (etch), these problems have been fixed in\nversion 5.0.32-7etch10.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 5.0.51a-24+lenny1.
\nWe recommend that you upgrade your mysql-dfsg-5.0 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy discovered several integer overflows in FreeType, a library\nto process and access font files, resulting in heap- or stack-based\nbuffer overflows leading to application crashes or the execution\nof arbitrary code via a crafted font file.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.2.1-5+etch4.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.3.7-2+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.3.9-4.1.
\nWe recommend that you upgrade your freetype packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Wireshark\nnetwork traffic analyzer, which may lead to denial of service or the\nexecution of arbitrary code. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nA format string vulnerability was discovered in the PROFINET\n dissector.
The dissector for the Check Point High-Availability Protocol\n could be forced to crash.
Malformed Tektronix files could lead to a crash.
The old stable distribution (etch), is only affected by the\nCPHAP crash, which doesn't warrant an update on its own. The fix\nwill be queued up for an upcoming security update or a point release.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.0.2-3+lenny5.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.0.7-1.
\nWe recommend that you upgrade your wireshark packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that acpid, a daemon for delivering ACPI events, is\nprone to a denial of service attack by opening a large number of UNIX\nsockets, which are not closed properly.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.8-1lenny1.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.0.4-5etch1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.0.10-1.
\nWe recommend that you upgrade your acpid packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nBryn M. Reeves reported a denial of service in the NFS filesystem.\n Local users can trigger a kernel BUG() due to a race condition in\n the do_setlk function.
Hugo Dias reported a DoS condition in the ATM subsystem that can\n be triggered by a local user by calling the svc_listen function\n twice on the same socket and reading /proc/net/atm/*vc.
Helge Deller discovered a denial of service condition that allows\n local users on PA-RISC systems to crash a system by attempting to\n unwind a stack containing userspace addresses.
Alan Cox discovered a lack of minimum timeouts on SG_IO requests,\n which allows local users of systems using ATA to cause a denial of\n service by forcing drives into PIO mode.
Vlad Malov reported an issue on 64-bit MIPS systems where a local\n user could cause a system crash by crafing a malicious binary\n which makes o32 syscalls with a number less than 4000.
Zvonimir Rakamaric reported an off-by-one error in the ib700wdt\n watchdog driver which allows local users to cause a buffer\n underflow by making a specially crafted WDIOC_SETTIMEOUT ioctl\n call.
Chris Evans discovered a situation in which a child process can\n send an arbitrary signal to its parent.
Christian Borntraeger discovered an issue effecting the alpha,\n mips, powerpc, s390 and sparc64 architectures that allows local\n users to cause a denial of service or potentially gain elevated\n privileges.
Vegard Nossum discovered a memory leak in the keyctl subsystem\n that allows local users to cause a denial of service by consuming\n all of kernel memory.
Wei Yongjun discovered a memory overflow in the SCTP\n implementation that can be triggered by remote users, permitting\n remote code execution.
Duane Griffin provided a fix for an issue in the eCryptfs\n subsystem which allows local users to cause a denial of service\n (fault or memory corruption).
Pavel Roskin provided a fix for an issue in the dell_rbu driver\n that allows a local user to cause a denial of service (oops) by\n reading 0 bytes from a sysfs entry.
Roel Kluin discovered inverted logic in the skfddi driver that\n permits local, unprivileged users to reset the driver statistics.
Clement LECIGNE discovered a bug in the sock_getsockopt function\n that may result in leaking sensitive kernel memory.
Peter Kerwien discovered an issue in the ext4 filesystem that\n allows local users to cause a denial of service (kernel oops)\n during a resize operation.
Roland McGrath discovered an issue on amd64 kernels that allows\n local users to circumvent system call audit configurations which\n filter based on the syscall numbers or argument details.
Jiri Olsa discovered that a local user can cause a denial of\n service (system hang) using a SHM_INFO shmctl call on kernels\n compiled with CONFIG_SHMEM disabled. This issue does not affect\n prebuilt Debian kernels.
Mikulas Patocka reported an issue in the console subsystem that\n allows a local user to cause memory corruption by selecting a\n small number of 3-byte UTF-8 characters.
Shaohua Li reported an issue in the AGP subsystem that may allow\n local users to read sensitive kernel memory due to a leak of\n uninitialized memory.
Benjamin Gilbert reported a local denial of service vulnerability\n in the KVM VMX implementation that allows local users to trigger\n an oops.
Thomas Pollet reported an overflow in the af_rose implementation\n that allows remote attackers to retrieve uninitialized kernel\n memory that may contain sensitive data.
Oleg Nesterov discovered an issue in the exit_notify function that\n allows local users to send an arbitrary signal to a process by\n running a program that modifies the exit_signal field and then\n uses an exec system call to launch a setuid application.
Daniel Hokka Zakrisson discovered that a kill(-1) is permitted to\n reach processes outside of the current process namespace.
Pavan Naregundi reported an issue in the CIFS filesystem code that\n allows remote users to overwrite memory via a long\n nativeFileSystem field in a Tree Connect response during mount.
For the oldstable distribution (etch), these problems have been fixed in\nversion 2.6.24-6~etchnhalf.8etch1.
\nWe recommend that you upgrade your linux-2.6.24 packages.
\nNote: Debian 'etch' includes linux kernel packages based upon both the\n2.6.18 and 2.6.24 linux releases. All known security issues are\ncarefully tracked against both packages and both packages will receive\nsecurity updates until security support for Debian 'etch'\nconcludes. However, given the high frequency at which low-severity\nsecurity issues are discovered in the kernel and the resource\nrequirements of doing an update, lower severity 2.6.18 and 2.6.24\nupdates will typically release in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Quagga, an IP routing daemon, could no longer\nprocess the Internet routing table due to broken handling of multiple\n4-byte AS numbers in an AS path. If such a prefix is received, the\nBGP daemon crashes with an assert failure, leading to a denial of\nservice.
\nThe old stable distribution (etch) is not affected by this issue.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.99.10-1lenny2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.99.11-2.
\nWe recommend that you upgrade your quagga package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the PHP\u00a05\nhypertext preprocessor. The Common Vulnerabilities and Exposures\nproject identifies the following problems.
\nThe following four vulnerabilities have already been fixed in the stable\n(lenny) version of php5 prior to the release of lenny. This update now\naddresses them for etch (oldstable) as well:
\nThe GENERATE_SEED macro has several problems that make predicting\n generated random numbers easier, facilitating attacks against measures\n that use rand() or mt_rand() as part of a protection.
A buffer overflow in the mbstring extension allows attackers to execute\n arbitrary code via a crafted string containing an HTML entity.
The page_uid and page_gid variables are not correctly set, allowing\n use of some functionality intended to be restricted to root.
Directory traversal vulnerability in the ZipArchive::extractTo function\n allows attackers to write arbitrary files via a ZIP file with a file\n whose name contains .. (dot dot) sequences.
This update also addresses the following three vulnerabilities for both\noldstable (etch) and stable (lenny):
\nCross-site scripting (XSS) vulnerability, when display_errors is enabled,\n allows remote attackers to inject arbitrary web script or HTML.
When running on Apache, PHP allows local users to modify behavior of\n other sites hosted on the same web server by modifying the\n mbstring.func_overload setting within .htaccess, which causes this\n setting to be applied to other virtual hosts on the same server.
The JSON_parser function allows a denial of service (segmentation fault)\n via a malformed string to the json_decode API function.
Furthermore, two updates originally scheduled for the next point update for\noldstable are included in the etch package:
\nLet PHP use the system timezone database instead of the embedded\n timezone database which is out of date.
From the source tarball, the unused 'dbase' module has been removed\n which contained licensing problems.
For the old stable distribution (etch), these problems have been fixed in\nversion 5.2.0+dfsg-8+etch15.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 5.2.6.dfsg.1-1+lenny3.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 5.2.9.dfsg.1-1.
\nWe recommend that you upgrade your php5 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been identified in xpdf, a suite of tools\nfor viewing and converting Portable Document Format (PDF) files.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nMultiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and\n earlier, CUPS 1.3.9 and earlier, and other products allow remote\n attackers to cause a denial of service (crash) via a crafted PDF file,\n related to (1) JBIG2SymbolDict::setBitmap and (2)\n JBIG2Stream::readSymbolDictSeg.
Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and\n earlier, CUPS 1.3.9 and earlier, and other products allow remote\n attackers to cause a denial of service (crash) via a crafted PDF file,\n related to (1) JBIG2Stream::readSymbolDictSeg, (2)\n JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as\n used in Poppler and other products, when running on Mac OS X, has\n unspecified impact, related to \"g*allocn.\"
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and\n earlier, and other products allows remote attackers to cause a denial\n of service (crash) via a crafted PDF file that triggers a free of\n uninitialized memory.
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,\n Poppler before 0.10.6, and other products allows remote attackers to\n cause a denial of service (crash) via a crafted PDF file that triggers\n an out-of-bounds read.
Multiple \"input validation flaws\" in the JBIG2 decoder in Xpdf 3.02pl2\n and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other\n products allow remote attackers to execute arbitrary code via a crafted\n PDF file.
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS\n 1.3.9 and earlier, Poppler before 0.10.6, and other products allows\n remote attackers to execute arbitrary code via a crafted PDF file.
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,\n Poppler before 0.10.6, and other products allows remote attackers to\n execute arbitrary code via a crafted PDF file that triggers a free of\n invalid data.
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,\n Poppler before 0.10.6, and other products allows remote attackers to\n cause a denial of service (crash) via a crafted PDF file that triggers a\n NULL pointer dereference.
Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and\n earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other\n products allow remote attackers to execute arbitrary code via a crafted\n PDF file.
The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and\n earlier, Poppler before 0.10.6, and other products allows remote\n attackers to cause a denial of service (infinite loop and hang) via a\n crafted PDF file.
For the old stable distribution (etch), these problems have been fixed in version\n3.01-9.1+etch6.
\nFor the stable distribution (lenny), these problems have been fixed in version\n3.02-1.4+lenny1.
\nFor the unstable distribution (sid), these problems will be fixed in a\nforthcoming version.
\nWe recommend that you upgrade your xpdf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the AttachFile action in moin, a python clone of\nWikiWiki, is prone to cross-site scripting attacks when renaming\nattachements or performing other sub-actions.
\nThe oldstable distribution (etch) is not vulnerable.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.7.1-3+lenny2.
\nFor the testing (squeeze) distribution and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your moin packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities have been discovered in drupal, a web content\nmanagement system. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\npod.Edge discovered a cross-site scripting vulnerability due that can be\n triggered when some browsers interpret UTF-8 strings as UTF-7 if they\n appear before the generated HTML document defines its Content-Type.\n This allows a malicious user to execute arbitrary javascript in the\n context of the web site if they're allowed to post content.
Moritz Naumann discovered an information disclosure vulnerability. If\n a user is tricked into visiting the site via a specially crafted URL\n and then submits a form (such as the search box) from that page, the\n information in their form submission may be directed to a third-party\n site determined by the URL and thus disclosed to the third party. The\n third party site may then execute a cross-site request forgery attack\n against the submitted form.
The old stable distribution (etch) does not contain drupal and is not\naffected.
\nFor the stable distribution (lenny), these problems have been fixed in version\n6.6-3lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 6.11-1
\nWe recommend that you upgrade your drupal6 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nkpdf, a Portable Document Format (PDF) viewer for KDE, is based on the\nxpdf program and thus suffers from similar flaws to those described in\nDSA-1790.
\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nMultiple buffer overflows in the JBIG2 decoder in kpdf allow\n remote attackers to cause a denial of service (crash) via a\n crafted PDF file, related to (1) JBIG2SymbolDict::setBitmap and\n (2) JBIG2Stream::readSymbolDictSeg.
Multiple integer overflows in the JBIG2 decoder in kpdf allow\n remote attackers to cause a denial of service (crash) via a\n crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg,\n (2) JBIG2Stream::readSymbolDictSeg, and (3)\n JBIG2Stream::readGenericBitmap.
Integer overflow in the JBIG2 decoder in kpdf has unspecified\n impact related to \"g*allocn.\"
The JBIG2 decoder in kpdf allows remote attackers to cause a\n denial of service (crash) via a crafted PDF file that triggers a\n free of uninitialized memory.
The JBIG2 decoder in kpdf allows remote attackers to cause a\n denial of service (crash) via a crafted PDF file that triggers an\n out-of-bounds read.
Multiple \"input validation flaws\" in the JBIG2 decoder in kpdf\n allow remote attackers to execute arbitrary code via a crafted PDF\n file.
Integer overflow in the JBIG2 decoder in kpdf allows remote\n attackers to execute arbitrary code via a crafted PDF file.
The JBIG2 decoder in kpdf allows remote attackers to execute\n arbitrary code via a crafted PDF file that triggers a free of\n invalid data.
The JBIG2 decoder in kpdf allows remote attackers to cause a\n denial of service (crash) via a crafted PDF file that triggers a\n NULL pointer dereference.
Multiple buffer overflows in the JBIG2 MMR decoder in kpdf allow\n remote attackers to execute arbitrary code via a crafted PDF file.
The JBIG2 MMR decoder in kpdf allows remote attackers to cause a\n denial of service (infinite loop and hang) via a crafted PDF file.
The old stable distribution (etch), these problems have been fixed in version\n3.5.5-3etch3.
\nFor the stable distribution (lenny), these problems have been fixed in version\n3.5.9-3+lenny1.
\nFor the unstable distribution (sid), these problems will be fixed\nsoon.
\nWe recommend that you upgrade your kdegraphics packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to denial of service, privilege escalation, or information\nleak. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nBryn M. Reeves reported a denial of service in the NFS filesystem.\n Local users can trigger a kernel BUG() due to a race condition in\n the do_setlk function.
Helge Deller discovered a denial of service condition that allows\n local users on PA-RISC to crash the system by attempting to unwind\n a stack containing userspace addresses.
Vlad Malov reported an issue on 64-bit MIPS where a local user\n could cause a system crash by crafting a malicious binary which\n makes o32 syscalls with a number less than 4000.
Zvonimir Rakamaric reported an off-by-one error in the ib700wdt\n watchdog driver which allows local users to cause a buffer\n underflow by making a specially crafted WDIOC_SETTIMEOUT ioctl\n call.
Flavio Leitner discovered that a local user can cause a denial of\n service by generating large amounts of traffic on a large SMP\n system, resulting in soft lockups.
Chris Evans discovered a situation in which a child process can\n send an arbitrary signal to its parent.
Christian Borntraeger discovered an issue effecting the alpha,\n mips, powerpc, s390 and sparc64 architectures that allows local\n users to cause a denial of service or potentially gain elevated\n privileges.
Vegard Nossum discovered a memory leak in the keyctl subsystem\n that allows local users to cause a denial of service by consuming\n all available kernel memory.
Wei Yongjun discovered a memory overflow in the SCTP\n implementation that can be triggered by remote users, permitting\n remote code execution.
Pavel Roskin provided a fix for an issue in the dell_rbu driver\n that allows a local user to cause a denial of service (oops) by\n reading 0 bytes from a sysfs entry.
Roel Kluin discovered inverted logic in the skfddi driver that\n permits local, unprivileged users to reset the driver statistics.
Clement LECIGNE discovered a bug in the sock_getsockopt function\n that may result in leaking sensitive kernel memory.
Roland McGrath discovered an issue on amd64 kernels that allows\n local users to circumvent system call audit configurations which\n filter based on the syscall numbers or argument details.
Jiri Olsa discovered that a local user can cause a denial of\n service (system hang) using a SHM_INFO shmctl call on kernels\n compiled with CONFIG_SHMEM disabled. This issue does not affect\n prebuilt Debian kernels.
Shaohua Li reported an issue in the AGP subsystem that may allow\n local users to read sensitive kernel memory due to a leak of\n uninitialized memory.
Thomas Pollet reported an overflow in the af_rose implementation\n that allows remote attackers to retrieve uninitialized kernel\n memory that may contain sensitive data.
Trond Myklebust reported an issue in the encode_lookup() function\n in the nfs server subsystem that allows local users to cause a\n denial of service (oops in encode_lookup()) by use of a long\n filename.
Oleg Nesterov discovered an issue in the exit_notify function that\n allows local users to send an arbitrary signal to a process by\n running a program that modifies the exit_signal field and then\n uses an exec system call to launch a setuid application.
Pavan Naregundi reported an issue in the CIFS filesystem code that\n allows remote users to overwrite memory via a long\n nativeFileSystem field in a Tree Connect response during mount.
For the oldstable distribution (etch), this problem has been fixed in\nversion 2.6.18.dfsg.1-24etch2.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Kaltenbrunner discovered that ldns, a library and set of utilities\nto facilitate DNS programming, did not correctly implement a buffer\nboundary check in its RR DNS record parser. This weakness could enable\noverflow of a heap buffer if a maliciously-crafted record is parsed,\npotentially allowing the execution of arbitrary code. The scope of\ncompromise will vary with the context in which ldns is used, and could\npresent either a local or remote attack vector.
\nThe old stable distribution (etch) is not affected by this issue.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.4.0-1+lenny1.
\nFor the unstable distribution (sid), this problem was fixed in\nversion 1.5.1-1.
\nWe recommend that you upgrade your ldns packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy discovered that the embedded GD library copy in libwmf,\na library to parse windows metafiles (WMF), makes use of a pointer\nafter it was already freed. An attacker using a crafted WMF file can\ncause a denial of service or possibly the execute arbitrary code via\napplications using this library.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.2.8.4-2+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.2.8.4-6+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.2.8.4-6.1.
\nWe recommend that you upgrade your libwmf packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nMoxie Marlinspike discovered that Unicode box drawing characters inside of\n internationalised domain names could be used for phishing attacks.
Olli Pettay, Martijn Wargers, Mats Palmgren, Oleg Romashin, Jesse Ruderman\n and Gary Kwong reported crashes in the layout engine, which might\n allow the execution of arbitrary code.
Olli Pettay, Martijn Wargers, Mats Palmgren, Oleg Romashin, Jesse Ruderman\n and Gary Kwong reported crashes in the layout engine, which might\n allow the execution of arbitrary code.
Igor Bukanov and Bob Clary discovered crashes in the Javascript engine,\n which might allow the execution of arbitrary code.
Igor Bukanov and Bob Clary discovered crashes in the Javascript engine,\n which might allow the execution of arbitrary code.
Daniel Veditz discovered that the Content-Disposition: header is ignored\n within the jar: URI scheme.
Gregory Fleischer discovered that the same-origin policy for Flash files\n is inproperly enforced for files loaded through the view-source scheme,\n which may result in bypass of cross-domain policy restrictions.
Cefn Hoile discovered that sites, which allow the embedding of third-party\n stylesheets are vulnerable to cross-site scripting attacks through XBL\n bindings.
\"moz_bug_r_a4\" discovered bypasses of the same-origin policy in the\n XMLHttpRequest Javascript API and the XPCNativeWrapper.
Paolo Amadini discovered that incorrect handling of POST data when\n saving a web site with an embedded frame may lead to information disclosure.
It was discovered that Iceweasel allows Refresh: headers to redirect\n to Javascript URIs, resulting in cross-site scripting.
For the stable distribution (lenny), these problems have been fixed\nin version 1.9.0.9-0lenny2.
\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.9-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nWill Drewry discovered that pango, a system for layout and rendering of\ninternationalized text, is prone to an integer overflow via long\nglyphstrings. This could cause the execution of arbitrary code when\ndisplaying crafted data through an application using the pango library.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.14.8-5+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.20.5-3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.24-1.
\nWe recommend that you upgrade your pango1.0 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the QEMU processor\nemulator. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIan Jackson discovered that range checks of file operations on\n emulated disk devices were insufficiently enforced.
It was discovered that an error in the format auto detection of\n removable media could lead to the disclosure of files in the\n host system.
A buffer overflow has been found in the emulation of the Cirrus\n graphics adaptor.
For the old stable distribution (etch), these problems have been fixed in\nversion 0.8.2-4etch3.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.9.1-10lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 0.9.1+svn20081101-1.
\nWe recommend that you upgrade your qemu packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service, privilege escalation or a sensitive\nmemory leak. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nChris Evans discovered a situation in which a child process can\n send an arbitrary signal to its parent.
Roland McGrath discovered an issue on amd64 kernels that allows\n local users to circumvent system call audit configurations which\n filter based on the syscall numbers or argument details.
Roland McGrath discovered an issue on amd64 kernels with\n CONFIG_SECCOMP enabled. By making a specially crafted syscall,\n local users can bypass access restrictions.
Jiri Olsa discovered that a local user can cause a denial of\n service (system hang) using a SHM_INFO shmctl call on kernels\n compiled with CONFIG_SHMEM disabled. This issue does not affect\n prebuilt Debian kernels.
Mikulas Patocka reported an issue in the console subsystem that\n allows a local user to cause memory corruption by selecting a\n small number of 3-byte UTF-8 characters.
Igor Zhbanov reported that nfsd was not properly dropping\n CAP_MKNOD, allowing users to create device nodes on file systems\n exported with root_squash.
Dan Carpenter reported a coding issue in the selinux subsystem\n that allows local users to bypass certain networking checks when\n running with compat_net=1.
Shaohua Li reported an issue in the AGP subsystem they may allow\n local users to read sensitive kernel memory due to a leak of\n uninitialized memory.
Benjamin Gilbert reported a local denial of service vulnerability\n in the KVM VMX implementation that allows local users to trigger\n an oops.
Thomas Pollet reported an overflow in the af_rose implementation\n that allows remote attackers to retrieve uninitialized kernel\n memory that may contain sensitive data.
Oleg Nesterov discovered an issue in the exit_notify function that\n allows local users to send an arbitrary signal to a process by\n running a program that modifies the exit_signal field and then\n uses an exec system call to launch a setuid application.
Daniel Hokka Zakrisson discovered that a kill(-1) is permitted to\n reach processes outside of the current process namespace.
Pavan Naregundi reported an issue in the CIFS filesystem code that\n allows remote users to overwrite memory via a long\n nativeFileSystem field in a Tree Connect response during mount.
For the oldstable distribution (etch), these problems, where applicable,\nwill be fixed in future updates to linux-2.6 and linux-2.6.24.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.6.26-15lenny2.
\nWe recommend that you upgrade your linux-2.6 and user-mode-linux packages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in NTP, the Network\nTime Protocol reference implementation. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nA buffer overflow in ntpq allow a remote NTP server to create a\n denial of service attack or to execute arbitrary code via a crafted\n response.
A buffer overflow in ntpd allows a remote attacker to create a\n denial of service attack or to execute arbitrary code when the\n autokey functionality is enabled.
For the old stable distribution (etch), these problems have been fixed in\nversion 4.2.2.p4+dfsg-2etch3.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4.2.4p4+dfsg-8lenny2.
\nThe unstable distribution (sid) will be fixed soon.
\nWe recommend that you upgrade your ntp package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in SquirrelMail,\na webmail application. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nCross site scripting was possible through a number of pages which\n allowed an attacker to steal sensitive session data.
Code injection was possible when SquirrelMail was configured to\n use the map_yp_alias function to authenticate users. This is not\n the default.
It was possible to hijack an active user session by planting a\n specially crafted cookie into the user's browser.
Specially crafted HTML emails could use the CSS positioning feature\n to place email content over the SquirrelMail user interface, allowing\n for phishing.
For the old stable distribution (etch), these problems have been fixed in\nversion 1.4.9a-5.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.4.15-4+lenny2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.4.19-1.
\nWe recommend that you upgrade your squirrelmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIlja van Sprundel discovered that a buffer overflow in NSD, an authoritative\nname service daemon, allowed to crash the server by sending a crafted packet,\ncreating a denial of service.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 2.3.6-1+etch1 of the nsd package.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.3.7-1.1+lenny1 of the nsd package and version 3.0.7-3.lenny2\nof the nsd3 package.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.3.7-3 for nsd; nsd3 will be fixed soon.
\nWe recommend that you upgrade your nsd or nsd3 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in racoon, the Internet Key\nExchange daemon of ipsec-tools. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nNeil Kettle discovered a NULL pointer dereference on crafted fragmented packets\nthat contain no payload. This results in the daemon crashing which can be used\nfor denial of service attacks.
Various memory leaks in the X.509 certificate authentication handling and the\nNAT-Traversal keepalive implementation can result in memory exhaustion and\nthus denial of service.
For the oldstable distribution (etch), this problem has been fixed in\nversion 0.6.6-3.1etch3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.7.1-1.3+lenny2.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:0.7.1-1.5.
\nWe recommend that you upgrade your ipsec-tools packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Pidgin, a graphical\nmulti-protocol instant messaging client. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nA buffer overflow in the Jabber file transfer code may lead to\n denial of service or the execution of arbitrary code.
Memory corruption in an internal library may lead to denial of\n service.
The patch provided for the security issue tracked as CVE-2008-2927\n - integer overflows in the MSN protocol handler - was found to be\n incomplete.
The old stable distribution (etch) is affected under the source package\nname gaim. However, due to build problems the updated packages couldn't\nbe released along with the stable version. It will be released once the\nbuild problem is resolved.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.4.3-4lenny2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.5.6-1.
\nWe recommend that you upgrade your pidgin packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMatt Murphy discovered that cscope, a source code browsing tool, does not\nverify the length of file names sourced in include statements, which may\npotentially lead to the execution of arbitrary code through specially\ncrafted source code files.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 15.6-6+lenny1.
\nDue to a technical limitation in the Debian archive management scripts\nthe update for the old stable distribution (etch) cannot be released\nsynchronously. It will be fixed in version 15.6-2+etch1 soon.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your cscope package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJames Ralston discovered that the sasl_encode64() function of cyrus-sasl2,\na free library implementing the Simple Authentication and Security Layer,\nsuffers from a missing null termination in certain situations. This causes\nseveral buffer overflows in situations where cyrus-sasl2 itself requires\nthe string to be null terminated which can lead to denial of service or\narbitrary code execution.
\nImportant notice (Quoting from US-CERT):\nWhile this patch will fix currently vulnerable code, it can cause\nnon-vulnerable existing code to break. Here's a function prototype from\ninclude/saslutil.h to clarify my explanation:
\n/* base64 encode\n* in -- input data\n* inlen -- input data length\n* out -- output buffer (will be NUL terminated)\n* outmax -- max size of output buffer\n* result:\n* outlen -- gets actual length of output buffer (optional)\n*\n* Returns SASL_OK on success, SASL_BUFOVER if result won't fit\n*/\nLIBSASL_API int sasl_encode64(const char *in, unsigned inlen,\nchar *out, unsigned outmax,\nunsigned *outlen);\n
Assume a scenario where calling code has been written in such a way that it\ncalculates the exact size required for base64 encoding in advance, then\nallocates a buffer of that exact size, passing a pointer to the buffer into\nsasl_encode64() as *out. As long as this code does not anticipate that the\nbuffer is NUL-terminated (does not call any string-handling functions like\nstrlen(), for example) the code will work and it will not be vulnerable.
\nOnce this patch is applied, that same code will break because sasl_encode64()\nwill begin to return SASL_BUFOVER.
\nFor the oldstable distribution (etch), this problem has been fixed\nin version 2.1.22.dfsg1-8+etch1 of cyrus-sasl2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.1.22.dfsg1-23+lenny1 of cyrus-sasl2 and cyrus-sasl2-heimdal.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.1.23.dfsg1-1 of cyrus-sasl2 and cyrus-sasl2-heimdal.
\nWe recommend that you upgrade your cyrus-sasl2/cyrus-sasl2-heimdal packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarkus Petrux discovered a cross-site scripting vulnerability in the\ntaxonomy module of drupal6, a fully-featured content management\nframework. It is also possible that certain browsers using the UTF-7\nencoding are vulnerable to a different cross-site scripting\nvulnerability.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 6.6-3lenny2.
\nThe oldstable distribution (etch) does not contain drupal6.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 6.11-1.1.
\nWe recommend that you upgrade your drupal6 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service, or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nFrank Filz discovered that local users may be able to execute\n files without execute permission when accessed via an nfs4 mount.
Jeff Layton and Suresh Jayaraman fixed several buffer overflows in\n the CIFS filesystem which allow remote servers to cause memory\n corruption.
Jan Beulich discovered an issue in Xen where local guest users may\n cause a denial of service (oops).
This update also fixes a regression introduced by the fix for\nCVE-2009-1184\nin 2.6.26-15lenny3. This prevents a boot time panic on systems with SELinux\nenabled.
\nFor the oldstable distribution (etch), these problems, where\napplicable, will be fixed in future updates to linux-2.6 and\nlinux-2.6.24.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.6.26-15lenny3.
\nWe recommend that you upgrade your linux-2.6 and user-mode-linux\npackages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAn information disclosure flaw was found in mod_jk, the Tomcat Connector\nmodule for Apache. If a buggy client included the \"Content-Length\" header\nwithout providing request body data, or if a client sent repeated\nrequests very quickly, one client could obtain a response intended for\nanother client.
\nThe oldstable distribution (etch), this problem has been fixed in\nversion 1:1.2.18-3etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1:1.2.26-2+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1:1.2.26-2.1.
\nWe recommend that you upgrade your libapache-mod-jk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAnibal Sacco discovered that cups, a general printing system for UNIX\nsystems, suffers from null pointer dereference because of its handling\nof two consecutive IPP packets with certain tag attributes that are\ntreated as IPP_TAG_UNSUPPORTED tags. This allows unauthenticated attackers\nto perform denial of service attacks by crashing the cups daemon.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.2.7-4+etch8 of cupsys.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.3.8-1+lenny6 of cups.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your cups/cupsys packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nApr-util, the Apache Portable Runtime Utility library, is used by\nApache 2.x, Subversion, and other applications. Two denial of service\nvulnerabilities have been found in apr-util:
\n\"kcope\" discovered a flaw in the handling of internal XML entities in\nthe apr_xml_* interface that can be exploited to use all available\nmemory. This denial of service can be triggered remotely in the Apache\nmod_dav and mod_dav_svn modules. (No CVE id yet)
Matthew Palmer discovered an underflow flaw in the\napr_strmatch_precompile function that can be exploited to cause a\ndaemon crash. The vulnerability can be triggered (1) remotely in\nmod_dav_svn for Apache if the \"SVNMasterURI\" directive is in use, (2)\nremotely in mod_apreq2 for Apache or other applications using\nlibapreq2, or (3) locally in Apache by a crafted \".htaccess\" file.\n
Other exploit paths in other applications using apr-util may exist.
\nIf you use Apache, or if you use svnserve in standalone mode, you need\nto restart the services after you upgraded the libaprutil1 package.
\nThe oldstable distribution (etch), these problems have been fixed in\nversion 1.2.7+dfsg-2+etch2.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.2.12+dfsg-8+lenny2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed soon.
\nWe recommend that you upgrade your apr-util packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in evolution-data-server, the\ndatabase backend server for the evolution groupware suite. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nIt was discovered that evolution-data-server is prone to integer\noverflows triggered by large base64 strings.
Joachim Breitner discovered that S/MIME signatures are not verified\nproperly, which can lead to spoofing attacks.
It was discovered that NTLM authentication challenge packets are not\nvalidated properly when using the NTLM authentication method, which\ncould lead to an information disclosure or a denial of service.
For the oldstable distribution (etch), these problems have been fixed in\nversion 1.6.3-5etch2.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.22.3-1.1+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 2.26.1.1-1.
\nWe recommend that you upgrade your evolution-data-server packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been found in libsndfile, a library to read\nand write sampled audio data. The Common Vulnerabilities and Exposures\nproject identified the following problems:
\nTobias Klein discovered that the VOC parsing routines suffer of a heap-based\nbuffer overflow which can be triggered by an attacker via a crafted VOC\nheader.
The vendor discovered that the AIFF parsing routines suffer of a heap-based\nbuffer overflow similar to CVE-2009-1788 which can be triggered by an attacker\nvia a crafted AIFF header.
In both cases the overflowing data is not completely attacker controlled but\nstill leads to application crashes or under some circumstances might still\nlead to arbitrary code execution.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.0.16-2+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.17-4+lenny2.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.0.20-1.
\nWe recommend that you upgrade your libsndfile packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Rasterbar Bittorrent library performed\ninsufficient validation of path names specified in torrent files, which\ncould lead to denial of service by overwriting files.
\nThe old stable distribution (etch) doesn't include libtorrent-rasterbar.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.13.1-2+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.14.4-1.
\nWe recommend that you upgrade your libtorrent-rasterbar package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Apache web server did not properly handle\nthe \"Options=\" parameter to the AllowOverride directive:
\nIn the stable distribution (lenny), local users could (via .htaccess)\nenable script execution in Server Side Includes even in configurations\nwhere the AllowOverride directive contained only\nOptions=IncludesNoEXEC.
In the oldstable distribution (etch), local users could (via\n.htaccess) enable script execution in Server Side Includes and CGI\nscript execution in configurations where the AllowOverride directive\ncontained any \"Options=\" value.
The oldstable distribution (etch), this problem has been fixed in\nversion 2.2.3-4+etch8.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.2.9-10+lenny3.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed in version 2.2.11-6.
\nThis advisory also provides updated apache2-mpm-itk packages which\nhave been recompiled against the new apache2 packages (except for the\ns390 architecture where updated packages will follow shortly).
\nWe recommend that you upgrade your apache2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Brooks discovered that ctorrent, a text-mode bittorrent client,\ndoes not verify the length of file paths in torrent files. An attacker\ncan exploit this via a crafted torrent that contains a long file path to\nexecute arbitrary code with the rights of the user opening the file.
\nThe oldstable distribution (etch) does not contain ctorrent.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.3.4-dnh3.2-1+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.4-dnh3.2-1.1.
\nWe recommend that you upgrade your ctorrent packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLaurent Almeras and Guillaume Smet have discovered a possible SQL\ninjection vulnerability and cross-site scripting vulnerabilities in\ngforge, a collaborative development tool. Due to insufficient input\nsanitising, it was possible to inject arbitrary SQL statements and use\nseveral parameters to conduct cross-site scripting attacks.
\nFor the stable distribution (lenny), these problem have been fixed in\nversion 4.7~rc2-7lenny1.
\nThe oldstable distribution (etch), these problems have been fixed in\nversion 4.5.14-22etch11.
\nFor the testing distribution (squeeze), these problems will be fixed\nsoon.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.7.3-2.
\nWe recommend that you upgrade your gforge packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in vlc, a multimedia player\nand streamer. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nDrew Yao discovered that multiple integer overflows in the MP4 demuxer,\nReal demuxer and Cinepak codec can lead to the execution of arbitrary\ncode.
Drew Yao discovered that the Cinepak codec is prone to a memory\ncorruption, which can be triggered by a crafted Cinepak file.
Luigi Auriemma discovered that it is possible to execute arbitrary code\nvia a long subtitle in an SSA file.
It was discovered that vlc is prone to a search path vulnerability,\nwhich allows local users to perform privilege escalations.
Alin Rad Pop discovered that it is possible to execute arbitrary code\nwhen opening a WAV file containing a large fmt chunk.
P\u0131nar Yanarda\u011f discovered that it is possible to execute arbitrary code\nwhen opening a crafted mmst link.
Tobias Klein discovered that it is possible to execute arbitrary code\nwhen opening a crafted .ty file.
Tobias Klein discovered that it is possible to execute arbitrary code\nwhen opening an invalid CUE image file with a crafted header.
For the oldstable distribution (etch), these problems have been fixed\nin version 0.8.6-svn20061012.debian-5.1+etch3.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.8.6.h-4+lenny2, which was already included in the lenny\nrelease.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 0.8.6.h-5.
\nWe recommend that you upgrade your vlc packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nSeveral issues in the browser engine have been discovered, which can\nresult in the execution of arbitrary code. (MFSA 2009-24)
It is possible to execute arbitrary code via vectors involving \"double\nframe construction.\" (MFSA 2009-24)
Jesse Ruderman and Adam Hauner discovered a problem in the JavaScript\nengine, which could lead to the execution of arbitrary code.\n(MFSA 2009-24)
Pavel Cvrcek discovered a potential issue leading to a spoofing attack\non the location bar related to certain invalid unicode characters.\n(MFSA 2009-25)
Gregory Fleischer discovered that it is possible to read arbitrary\ncookies via a crafted HTML document. (MFSA 2009-26)
Shuo Chen, Ziqing Mao, Yi-Min Wang and Ming Zhang reported a potential\nman-in-the-middle attack, when using a proxy due to insufficient checks\non a certain proxy response. (MFSA 2009-27)
Jakob Balle and Carsten Eiram reported a race condition in the\nNPObjWrapper_NewResolve function that can be used to execute arbitrary\ncode. (MFSA 2009-28)
moz_bug_r_a4 discovered that it is possible to execute arbitrary\nJavaScript with chrome privileges due to an error in the\ngarbage-collection implementation. (MFSA 2009-29)
Adam Barth and Collin Jackson reported a potential privilege escalation\nwhen loading a file::resource via the location bar. (MFSA 2009-30)
Wladimir Palant discovered that it is possible to bypass access\nrestrictions due to a lack of content policy check, when loading a\nscript file into a XUL document. (MFSA 2009-31)
moz_bug_r_a4 reported that it is possible for scripts from page content\nto run with elevated privileges and thus potentially executing arbitrary\ncode with the object's chrome privileges. (MFSA 2009-32)
For the stable distribution (lenny), these problems have been fixed in\nversion 1.9.0.11-0lenny1.
\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.
\nFor the testing distribution (squeeze), these problems will be fixed\nsoon.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.11-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSam Hocevar discovered that amule, a client for the eD2k and Kad\nnetworks, does not properly sanitise the filename, when using the\npreview function. This could lead to the injection of arbitrary commands\npassed to the video player.
\nThe oldstable distribution (etch) is not affected by this issue.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.2.1-1+lenny2.
\nFor the testing distribution (squeeze) this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.2.5-1.1.
\nWe recommend that you upgrade your amule packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that mahara, an electronic portfolio, weblog, and resume\nbuilder is prone to several cross-site scripting attacks, which allow an\nattacker to inject arbitrary HTML or script code and steal potential sensitive\ndata from other users.
\nThe oldstable distribution (etch) does not contain mahara.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.4-4+lenny3.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.5-1.
\nWe recommend that you upgrade your mahara packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Samba, a SMB/CIFS file,\nprint, and login server. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nThe smbclient utility contains a formatstring vulnerability where\n commands dealing with file names treat user input as format strings\n to asprintf.
In the smbd daemon, if a user is trying to modify an access control\n list (ACL) and is denied permission, this deny may be overridden if\n the parameter \"dos filemode\" is set to \"yes\" in the smb.conf and the\n user already has write access to the file.
The old stable distribution (etch) is not affected by these problems.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 3.2.5-4lenny6.
\nThe unstable distribution (sid), which is only affected by CVE-2009-1888,\nwill be fixed soon.
\nWe recommend that you upgrade your samba package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in phpMyAdmin, a tool\nto administer MySQL over the web. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nCross site scripting vulnerability in the export page allow for an\n attacker that can place crafted cookies with the user to inject\n arbitrary web script or HTML.
Static code injection allows for a remote attacker to inject arbitrary\n code into phpMyAdmin via the setup.php script. This script is in Debian\n under normal circumstances protected via Apache authentication.\n However, because of a recent worm based on this exploit, we are patching\n it regardless, to also protect installations that somehow still expose\n the setup.php script.
For the old stable distribution (etch), these problems have been fixed in\nversion 2.9.1.1-11.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.11.8.1-5+lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.1.3.1-1.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the statuswml.cgi script of nagios, a monitoring\nand management system for hosts, services and networks, is prone to a\ncommand injection vulnerability. Input to the ping and traceroute parameters\nof the script is not properly validated which allows an attacker to execute\narbitrary shell commands by passing a crafted value to these parameters.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.6-2+etch3 of nagios2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.0.6-4~lenny2 of nagios3.
\nFor the testing distribution (squeeze), this problem has been fixed in\nversion 3.0.6-5 of nagios3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.0.6-5 of nagios3.
\nWe recommend that you upgrade your nagios2/nagios3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in eggdrop, an advanced IRC\nrobot. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered that eggdrop is vulnerable to a buffer overflow, which\ncould result in a remote user executing arbitrary code. The previous DSA\n(DSA-1448-1) did not fix the issue correctly.
It was discovered that eggdrop is vulnerable to a denial of service\nattack, that allows remote attackers to cause a crash via a crafted\nPRIVMSG.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.6.19-1.1+lenny1.
\nFor the old stable distribution (etch), these problems have been fixed in\nversion 1.6.18-1etch2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6.19-1.2
\nWe recommend that you upgrade your eggdrop package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that ipplan, a web-based IP address manager and\ntracker, does not sufficiently escape certain input parameters, which\nallows remote attackers to conduct cross-site scripting attacks.
\nThe oldstable distribution (etch) does not contain ipplan.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 4.86a-7+lenny1.
\nFor the testing distribution (squeeze) this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 4.91a-1.1.
\nWe recommend that you upgrade your ipplan packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the ocsinventory-agent which is part of the\nocsinventory suite, a hardware and software configuration indexing service,\nis prone to an insecure perl module search path. As the agent is started\nvia cron and the current directory (/ in this case) is included in the\ndefault perl module path the agent scans every directory on the system\nfor its perl modules. This enables an attacker to execute arbitrary code\nvia a crafted ocsinventory-agent perl module placed on the system.
\nThe oldstable distribution (etch) does not contain ocsinventory-agent.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1:0.0.9.2repack1-4lenny1.
\nFor the testing distribution (squeeze), this problem has been fixed in\nversion 1:0.0.9.2repack1-5
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:0.0.9.2repack1-5.
\nWe recommend that you upgrade your ocsinventory-agent packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that sork-passwd-h3, a Horde3 module for users to\nchange their password, is prone to a cross-site scripting attack via the\nbackend parameter.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 3.0-2+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.0-2+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.1-1.1.
\nWe recommend that you upgrade your sork-passwd-h3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Icedove\nmail client, an unbranded version of the Thunderbird mail client. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nThe execution of arbitrary code might be possible via a crafted PNG file\nthat triggers a free of an uninitialized pointer in (1) the png_read_png\nfunction, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.\n(MFSA 2009-10)
It is possible to execute arbitrary code via vectors related to the\nlayout engine. (MFSA 2009-01)
It is possible to execute arbitrary code via vectors related to the\nJavaScript engine. (MFSA 2009-01)
Bjoern Hoehrmann and Moxie Marlinspike discovered a possible spoofing\nattack via Unicode box drawing characters in internationalized domain\nnames. (MFSA 2009-15)
Memory corruption and assertion failures have been discovered in the\nlayout engine, leading to the possible execution of arbitrary code.\n(MFSA 2009-07)
The layout engine allows the execution of arbitrary code in vectors\nrelated to nsCSSStyleSheet::GetOwnerNode, events, and garbage\ncollection. (MFSA 2009-07)
The JavaScript engine is prone to the execution of arbitrary code via\nseveral vectors. (MFSA 2009-07)
The layout engine allows the execution of arbitrary code via vectors\nrelated to gczeal. (MFSA 2009-07)
Georgi Guninski discovered that it is possible to obtain xml data via\nan issue related to the nsIRDFService. (MFSA 2009-09)
The browser engine is prone to a possible memory corruption via several\nvectors. (MFSA 2009-14)
The browser engine is prone to a possible memory corruption via the\nnsSVGElement::BindToTree function. (MFSA 2009-14)
Gregory Fleischer discovered that it is possible to bypass the Same\nOrigin Policy when opening a Flash file via the view-source: scheme.\n(MFSA 2009-17)
The possible arbitrary execution of code was discovered via vectors\ninvolving \"double frame construction.\" (MFSA 2009-24)
Several issues were discovered in the browser engine as used by icedove,\nwhich could lead to the possible execution of arbitrary code.\n(MFSA 2009-24)
Shuo Chen, Ziqing Mao, Yi-Min Wang and Ming Zhang reported a potential\nman-in-the-middle attack, when using a proxy due to insufficient checks\non a certain proxy response. (MFSA 2009-27)
moz_bug_r_a4 discovered that it is possible to execute arbitrary\nJavaScript with chrome privileges due to an error in the\ngarbage collection implementation. (MFSA 2009-29)
moz_bug_r_a4 reported that it is possible for scripts from page content\nto run with elevated privileges and thus potentially executing arbitrary\ncode with the object's chrome privileges. (MFSA 2009-32)
Bernd Jendrissek discovered a potentially exploitable crash when viewing\na multipart/alternative mail message with a text/enhanced part.\n(MFSA 2009-33)
For the stable distribution (lenny), these problems have been fixed in\nversion 2.0.0.22-0lenny1.
\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported mail client.
\nFor the testing (squeeze) distribution these problems will be fixed soon.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.0.0.22-1.
\nWe recommend that you upgrade your icedove packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMatthew Dempsky discovered that Daniel J. Bernstein's djbdns, a Domain\nName System server, does not constrain offsets in the required manner,\nwhich allows remote attackers with control over a third-party subdomain\nserved by tinydns and axfrdns, to trigger DNS responses containing\narbitrary records via crafted zone data for this subdomain.
\nThe old stable distribution (etch) does not contain djbdns.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.05-4+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.05-5.
\nWe recommend that you upgrade your djbdns package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTielei Wang discovered that CamlImages, an open source image processing\nlibrary, suffers from several integer overflows which may lead to a\npotentially exploitable heap overflow and result in arbitrary code\nexecution.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 2.20-8+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.2.0-4+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.0.1-2.
\nWe recommend that you upgrade your camlimages package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in ISC's DHCP\nimplementation:
\nIt was discovered that dhclient does not properly handle overlong\nsubnet mask options, leading to a stack-based buffer overflow and\npossible arbitrary code execution.
Christoph Biedl discovered that the DHCP server may terminate when\nreceiving certain well-formed DHCP requests, provided that the server\nconfiguration mixes host definitions using \"dhcp-client-identifier\"\nand \"hardware ethernet\". This vulnerability only affects the lenny\nversions of dhcp3-server and dhcp3-server-ldap.
For the old stable distribution (etch), these problems have been fixed\nin version 3.0.4-13+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.1.1-6+lenny2.
\nFor the unstable distribution (sid), these problems will be fixed\nsoon.
\nWe recommend that you upgrade your dhcp3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA denial of service flaw was found in the Apache mod_proxy module when\nit was used as a reverse proxy. A remote attacker could use this flaw\nto force a proxy process to consume large amounts of CPU time. This\nissue did not affect Debian 4.0 \"etch\".
A denial of service flaw was found in the Apache mod_deflate module.\nThis module continued to compress large files until compression was\ncomplete, even if the network connection that requested the content\nwas closed before compression completed. This would cause mod_deflate\nto consume large amounts of CPU if mod_deflate was enabled for a large\nfile. A similar flaw related to HEAD requests for compressed content\nwas also fixed.
The oldstable distribution (etch), these problems have been fixed in\nversion 2.2.3-4+etch9.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.2.9-10+lenny4.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed in version 2.2.11-7.
\nThis advisory also provides updated apache2-mpm-itk packages which\nhave been recompiled against the new apache2 packages.
\nUpdated packages for the s390 and mipsel architectures are not\nincluded yet. They will be released as soon as they become available.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the library for the\nTag Image File Format (TIFF). The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nIt was discovered that malformed TIFF images can lead to a crash\n in the decompression code, resulting in denial of service.
Andrea Barisani discovered several integer overflows, which\n can lead to the execution of arbitrary code if malformed\n images are passed to the rgb2ycbcr or tiff2rgba tools.
For the old stable distribution (etch), these problems have been fixed\nin version 3.8.2-7+etch3.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 3.8.2-11.2.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your tiff packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nVinny Guido discovered that multiple input sanitising vulnerabilities\nin Fckeditor, a rich text web editor component, may lead to the\nexecution of arbitrary code.
\nThe old stable distribution (etch) doesn't contain fckeditor.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1:2.6.2-1lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:2.6.4.1-1.
\nWe recommend that you upgrade your fckeditor package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the dbus_signature_validate function in\ndbus, a simple interprocess messaging system, is prone to a denial of\nservice attack. This issue was caused by an incorrect fix for\nDSA-1658-1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.2.1-5+lenny1.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.0.2-1+etch3.
\nPackages for ia64 and s390 will be released once they are available.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.2.14-1.
\nWe recommend that you upgrade your dbus packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTavis Ormandy and Julien Tinnes discovered that the pulseaudio daemon\ndoes not drop privileges before re-executing itself, enabling local\nattackers to increase their privileges.
\nThe old stable distribution (etch) is not affected by this issue.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.9.10-3+lenny1.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your pulseaudio packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that gst-plugins-good0.10, the GStreamer plugins\nfrom the \"good\" set, are prone to an integer overflow, when processing\na large PNG file. This could lead to the execution of arbitrary code.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.10.8-4.1~lenny2.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.10.4-4+etch1.
\nPackages for the s390 and hppa architectures will be released once they\nare available.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 0.10.15-2.
\nWe recommend that you upgrade your gst-plugins-good0.10 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nMartijn Wargers, Arno Renevier, Jesse Ruderman, Olli Pettay and Blake\nKaplan discovered several issues in the browser engine that could\npotentially lead to the execution of arbitrary code. (MFSA 2009-34)
monarch2020 reported an integer overflow in a base64 decoding function.\n(MFSA 2009-34)
Christophe Charron reported a possibly exploitable crash occurring when\nmultiple RDF files were loaded in a XUL tree element. (MFSA 2009-34)
Yongqian Li reported that an unsafe memory condition could be created by\nspecially crafted document. (MFSA 2009-34)
Peter Van der Beken, Mike Shaver, Jesse Ruderman, and Carsten Book\ndiscovered several issues in the JavaScript engine that could possibly\nlead to the execution of arbitrary JavaScript. (MFSA 2009-34)
Attila Suszter discovered an issue related to a specially crafted Flash\nobject, which could be used to run arbitrary code. (MFSA 2009-35)
PenPal discovered that it is possible to execute arbitrary code via a\nspecially crafted SVG element. (MFSA 2009-37)
Blake Kaplan discovered a flaw in the JavaScript engine that might allow\nan attacker to execute arbitrary JavaScript with chrome privileges.\n(MFSA 2009-39)
moz_bug_r_a4 discovered an issue in the JavaScript engine that could be\nused to perform cross-site scripting attacks. (MFSA 2009-40)
For the stable distribution (lenny), these problems have been fixed in\nversion 1.9.0.12-0lenny1.
\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.
\nFor the testing distribution (squeeze), these problems will be fixed\nsoon.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.12-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that git-daemon which is part of git-core, a popular\ndistributed revision control system, is vulnerable to denial of service\nattacks caused by a programming mistake in handling requests containing\nextra unrecognized arguments which results in an infinite loop. While\nthis is no problem for the daemon itself as every request will spawn a\nnew git-daemon instance, this still results in a very high CPU consumption\nand might lead to denial of service conditions.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.4.4.4-4+etch3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.5.6.5-3+lenny2.
\nFor the testing distribution (squeeze), this problem has been fixed in\nversion 1:1.6.3.3-1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:1.6.3.3-1.
\nWe recommend that you upgrade your git-core packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the OpenEXR image\nlibrary, which can lead to the execution of arbitrary code. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nDrew Yao discovered integer overflows in the preview and\n compression code.
Drew Yao discovered that an uninitialised pointer could be freed\n in the decompression code.
A buffer overflow was discovered in the compression code.
For the old stable distribution (etch), these problems have been fixed\nin version 1.2.2-4.3+etch2.
\nFor the stable distribution (lenny), these problems have been fixed\nin version 1.6.1-3+lenny3.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your openexr packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that squid3, a high-performance proxy caching server for\nweb clients, is prone to several denial of service attacks. Due to incorrect\nbounds checking and insufficient validation while processing response and\nrequest data an attacker is able to crash the squid daemon via crafted\nrequests or responses.
\nThe squid package in the oldstable distribution (etch) is not affected\nby this problem.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.0.STABLE8-3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution (sid),\nthis problem will be fixed soon.
\nWe recommend that you upgrade your squid3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nNeil Horman discovered a missing fix from the e1000 network driver.\n A remote user may cause a denial of service by way of a kernel panic\n triggered by specially crafted frame sizes.
Michael Tokarev discovered an issue in the r8169 network driver.\n Remote users on the same LAN may cause a denial of service by way\n of a kernel panic triggered by receiving a large size frame.
Frank Filz discovered that local users may be able to execute\n files without execute permission when accessed via an nfs4 mount.
Jeff Layton and Suresh Jayaraman fixed several buffer overflows in\n the CIFS filesystem which allow remote servers to cause memory\n corruption.
Julien Tinnes and Tavis Ormandy reported an issue in the Linux\n personality code. Local users can take advantage of a setuid\n binary that can either be made to dereference a NULL pointer or\n drop privileges and return control to the user. This allows a\n user to bypass mmap_min_addr restrictions which can be exploited\n to execute arbitrary code.
Mikulas Patocka discovered an issue in sparc64 kernels that allows\n local users to cause a denial of service (crash) by reading the\n /proc/iomem file.
Miklos Szeredi reported an issue in the ocfs2 filesystem. Local\n users can create a denial of service (filesystem deadlock) using\n a particular sequence of splice system calls.
Ramon de Carvalho Valle discovered two issues with the eCryptfs\n layered filesystem using the fsfuzzer utility. A local user with\n permissions to perform an eCryptfs mount may modify the contents\n of a eCryptfs file, overflowing the stack and potentially gaining\n elevated privileges.
For the stable distribution (etch), these problems have been fixed in\nversion 2.6.24-6~etchnhalf.8etch2.
\nWe recommend that you upgrade your linux-2.6.24 packages.
\nNote: Debian 'etch' includes linux kernel packages based upon both the\n2.6.18 and 2.6.24 linux releases. All known security issues are\ncarefully tracked against both packages and both packages will receive\nsecurity updates until security support for Debian 'etch'\nconcludes. However, given the high frequency at which low-severity\nsecurity issues are discovered in the kernel and the resource\nrequirements of doing an update, lower severity 2.6.18 and 2.6.24\nupdates will typically release in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service, or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nJulien Tinnes and Tavis Ormandy reported an issue in the Linux\n personality code. Local users can take advantage of a setuid\n binary that can either be made to dereference a NULL pointer or\n drop privileges and return control to the user. This allows a\n user to bypass mmap_min_addr restrictions which can be exploited\n to execute arbitrary code.
Matt T. Yourst discovered an issue in the kvm subsystem. Local\n users with permission to manipulate /dev/kvm can cause a denial\n of service (hang) by providing an invalid cr3 value to the\n KVM_SET_SREGS call.
Ramon de Carvalho Valle discovered two issues with the eCryptfs\n layered filesystem using the fsfuzzer utility. A local user with\n permissions to perform an eCryptfs mount may modify the contents\n of a eCryptfs file, overflowing the stack and potentially gaining\n elevated privileges.
For the stable distribution (lenny), these problems have been fixed in\nversion 2.6.26-17lenny1.
\nFor the oldstable distribution (etch), these problems, where\napplicable, will be fixed in updates to linux-2.6 and linux-2.6.24.
\nWe recommend that you upgrade your linux-2.6 and user-mode-linux\npackages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMatt T. Yourst discovered an issue in the kvm subsystem. Local\nusers with permission to manipulate /dev/kvm can cause a denial\nof service (hang) by providing an invalid cr3 value to the\nKVM_SET_SREGS call.
\nFor the stable distribution (lenny), these problems have been fixed\nin version 72+dfsg-5~lenny2.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your kvm packages, and rebuild any kernel\nmodules you have built from a kvm-source package version.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the BIND DNS server terminates when processing a\nspecially crafted dynamic DNS update. This vulnerability affects all\nBIND servers which serve at least one DNS zone authoritatively, as a\nmaster, even if dynamic updates are not enabled. The default Debian\nconfiguration for resolvers includes several authoritative zones, too,\nso resolvers are also affected by this issue unless these zones have\nbeen removed.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 9.3.4-2etch5.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 9.5.1.dfsg.P3-1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:9.6.1.dfsg.P1-1.
\nWe recommend that you upgrade your bind9 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that znc, an IRC proxy, did not properly process\ncertain DCC requests, allowing attackers to upload arbitrary files.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 0.045-3+etch3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.058-2+lenny3.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.074-1.
\nWe recommend that you upgrade your znc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the W3C XML Signature recommendation contains a\nprotocol-level vulnerability related to HMAC output truncation. This\nupdate implements the proposed workaround in the C++ version of the\nApache implementation of this standard, xml-security-c, by preventing\ntruncation to output strings shorter than 80 bits or half of the\noriginal HMAC output, whichever is greater.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 1.2.1-3+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.4.0-3+lenny2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.4.0-4.
\nWe recommend that you upgrade your xml-security-c packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in libmodplug, the shared\nlibraries for mod music based on ModPlug. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nIt was discovered that libmodplug is prone to an integer overflow when\nprocessing a MED file with a crafted song comment or song name.
It was discovered that libmodplug is prone to a buffer overflow in the\nPATinst function, when processing a long instrument name.
For the oldstable distribution (etch), these problems have been fixed in\nversion 1:0.7-5.2+etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1:0.8.4-1+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 1:0.8.7-1.
\nWe recommend that you upgrade your libmodplug packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that gst-plugins-bad0.10, the GStreamer plugins from\nthe \"bad\" set, is prone to an integer overflow when processing a MED\nfile with a crafted song comment or song name.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.10.3-3.1+etch3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.10.7-2+lenny2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), gst-plugins-bad0.10 links against libmodplug.
\nWe recommend that you upgrade your gst-plugins-bad0.10 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that fetchmail, a full-featured remote mail retrieval\nand forwarding utility, is vulnerable to the \"Null Prefix Attacks Against\nSSL/TLS Certificates\" recently published at the Blackhat conference.\nThis allows an attacker to perform undetected man-in-the-middle attacks\nvia a crafted ITU-T X.509 certificate with an injected null byte in the\nsubjectAltName or Common Name fields.
\nNote, as a fetchmail user you should always use strict certificate\nvalidation through either these option combinations:\n sslcertck ssl sslproto ssl3 (for service on SSL-wrapped ports)\nor\n sslcertck sslproto tls1 (for STARTTLS-based services)
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 6.3.6-1etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 6.3.9~rc2-4+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 6.3.9~rc2-6.
\nWe recommend that you upgrade your fetchmail packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRonald Volgers discovered that memcached, a high-performance memory object\ncaching system, is vulnerable to several heap-based buffer overflows due\nto integer conversions when parsing certain length attributes. An\nattacker can use this to execute arbitrary code on the system running\nmemcached (on etch with root privileges).
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.1.12-1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.2.2-1+lenny1.
\nFor the testing (squeeze) and unstable (sid) distribution , this problem\nwill be fixed soon.
\nWe recommend that you upgrade your memcached packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMatt Lewis discovered that the memory management code in the Apache\nPortable Runtime (APR) library does not guard against a wrap-around\nduring size computations. This could cause the library to return a\nmemory area which smaller than requested, resulting a heap overflow\nand possibly arbitrary code execution.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 1.2.7-9 of the apr package, and version 1.2.7+dfsg-2+etch3 of\nthe apr-util package.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.2.12-5+lenny1 of the apr package and version 1.2.12-5+lenny1\nof the apr-util package.
\nFor the unstable distribution (sid), this problem will be fixed soon.
\nWe recommend that you upgrade your APR packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMatt Lewis discovered that Subversion performs insufficient input\nvalidation of svndiff streams. Malicious servers could cause heap\noverflows in clients, and malicious clients with commit access could\ncause heap overflows in servers, possibly leading to arbitrary code\nexecution in both cases.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 1.4.2dfsg1-3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.5.1dfsg1-4.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6.4dfsg-1.
\nWe recommend that you upgrade your Subversion packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the Debian Mantis package, a web based bug\ntracking system, installed the database credentials in a file with\nworld-readable permissions onto the local filesystem. This allows\nlocal users to acquire the credentials used to control the Mantis\ndatabase.
\nThis updated package corrects this problem for new installations and\nwill carefully try to update existing ones. Administrators can check\nthe permissions of the file /etc/mantis/config_db.php to see if they\nare safe for their environment.
\nThe old stable distribution (etch) does not contain a mantis package.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.1.6+dfsg-2lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.8+dfsg-2.
\nWe recommend that you upgrade your mantis package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTielei Wang discovered that CamlImages, an open source image processing\nlibrary, suffers from several integer overflows which may lead to a\npotentially exploitable heap overflow and result in arbitrary code\nexecution. This advisory addresses issues with the reading of JPEG and\nGIF Images, while DSA 1832-1\naddressed the issue with PNG images.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.20-8+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1:2.2.0-4+lenny2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1:3.0.1-3.
\nWe recommend that you upgrade your camlimages package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the imagemagick image\nmanipulation programs which can lead to the execution of arbitrary code,\nexposure of sensitive information or cause DoS. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nMultiple integer overflows in XInitImage function in xwd.c for\n ImageMagick, allow user-assisted remote attackers to cause a denial of\n service (crash) or obtain sensitive information via crafted images with\n large or negative values that trigger a buffer overflow. It only affects\n the oldstable distribution (etch).
Multiple integer overflows allow remote attackers to execute arbitrary\n code via a crafted DCM image, or the colors or comments field in a\n crafted XWD image. It only affects the oldstable distribution (etch).
A crafted image file can trigger an infinite loop in the ReadDCMImage\n function or in the ReadXCFImage function. It only affects the oldstable\n distribution (etch).
Multiple integer overflows allow context-dependent attackers to execute\n arbitrary code via a crafted .dcm, .dib, .xbm, .xcf, or .xwd image file,\n which triggers a heap-based buffer overflow. It only affects the\n oldstable distribution (etch).
Off-by-one error allows context-dependent attackers to execute arbitrary\n code via a crafted image file, which triggers the writing of a '\\0'\n character to an out-of-bounds address. It affects only the oldstable\n distribution (etch).
A sign extension error allows context-dependent attackers to execute\n arbitrary code via a crafted width value in an image file, which\n triggers an integer overflow and a heap-based buffer overflow. It\n affects only the oldstable distribution (etch).
The load_tile function in the XCF coder allows user-assisted remote\n attackers to cause a denial of service or possibly execute arbitrary\n code via a crafted .xcf file that triggers an out-of-bounds heap write.\n It affects only to oldstable (etch).
Heap-based buffer overflow in the PCX coder allows user-assisted remote\n attackers to cause a denial of service or possibly execute arbitrary\n code via a crafted .pcx file that triggers incorrect memory allocation\n for the scanline array, leading to memory corruption. It affects only to\n oldstable (etch).
Integer overflow allows remote attackers to cause a denial of service\n (crash) and possibly execute arbitrary code via a crafted TIFF file,\n which triggers a buffer overflow.
For the old stable distribution (etch), these problems have been fixed in\nversion 7:6.2.4.5.dfsg1-0.15+etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 7:6.3.7.9.dfsg2-1~lenny3.
\nFor the upcoming stable distribution (squeeze) and the unstable\ndistribution (sid), these problems have been fixed in version\n7:6.5.1.0-1.1.
\nWe recommend that you upgrade your imagemagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRauli Kaksonen, Tero Rontti and Jukka Taimisto discovered several\nvulnerabilities in libxml2, a library for parsing and handling XML data\nfiles, which can lead to denial of service conditions or possibly arbitrary\ncode execution in the application using the library. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nAn XML document with specially-crafted Notation or Enumeration attribute\ntypes in a DTD definition leads to the use of a pointers to memory areas\nwhich have already been freed.
Missing checks for the depth of ELEMENT DTD definitions when parsing\nchild content can lead to extensive stack-growth due to a function\nrecursion which can be triggered via a crafted XML document.
For the oldstable distribution (etch), this problem has been fixed in\nversion 2.6.27.dfsg-6+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.6.32.dfsg-5+lenny1.
\nFor the testing (squeeze) and unstable (sid) distribution, this problem\nwill be fixed soon.
\nWe recommend that you upgrade your libxml2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Ruby. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nThe return value from the OCSP_basic_verify function was not checked\n properly, allowing continued use of a revoked certificate.
An issue in parsing BigDecimal numbers can result in a\n denial-of-service condition (crash).
The following matrix identifies fixed versions:
\n| \u00a0 | ruby1.8 | ruby1.9 |
|---|---|---|
| oldstable (etch) | 1.8.5-4etch5 | 1.9.0+20060609-1etch5 |
| stable (lenny) | 1.8.7.72-3lenny1 | 1.9.0.2-9lenny1 |
| unstable (sid) | 1.8.7.173-1 | (soon) |
We recommend that you upgrade your Ruby packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRauli Kaksonen, Tero Rontti and Jukka Taimisto discovered several\nvulnerabilities in libxml, a library for parsing and handling XML data\nfiles, which can lead to denial of service conditions or possibly arbitrary\ncode execution in the application using the library. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nAn XML document with specially-crafted Notation or Enumeration attribute\ntypes in a DTD definition leads to the use of a pointers to memory areas\nwhich have already been freed.
Missing checks for the depth of ELEMENT DTD definitions when parsing\nchild content can lead to extensive stack-growth due to a function\nrecursion which can be triggered via a crafted XML document.
For the oldstable distribution (etch), this problem has been fixed in\nversion 1.8.17-14+etch1.
\nThe stable (lenny), testing (squeeze) and unstable (sid) distribution\ndo not contain libxml anymore but libxml2 for which DSA-1859-1 has been\nreleased.
\nWe recommend that you upgrade your libxml packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in the Linux kernel that may lead\nto privilege escalation. The Common Vulnerabilities and Exposures project\nidentifies the following problem:
\nTavis Ormandy and Julien Tinnes discovered an issue with how the\n sendpage function is initialized in the proto_ops structure.\n Local users can exploit this vulnerability to gain elevated\n privileges.
For the oldstable distribution (etch), this problem will be fixed in\nupdates to linux-2.6 and linux-2.6.24.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.6.26-17lenny2.
\nWe recommend that you upgrade your linux-2.6 and user-mode-linux\npackages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the zope,\na feature-rich web application server written in python, that could\nlead to arbitrary code execution in the worst case. The Common\nVulnerabilities and Exposures project identified the following problems:
\nDue to a programming error an authorization method in the StorageServer\ncomponent of ZEO was not used as an internal method. This allows a\nmalicious client to bypass authentication when connecting to a ZEO server\nby simply calling this authorization method.
The ZEO server doesn't restrict the callables when unpickling data received\nfrom a malicious client which can be used by an attacker to execute\narbitrary python code on the server by sending certain exception pickles.\nThis also allows an attacker to import any importable module as ZEO is\nimporting the module containing a callable specified in a pickle to test\nfor a certain flag.
The update also limits the number of new object ids a client can request\nto 100 as it would be possible to consume huge amounts of resources by\nrequesting a big batch of new object ids. No CVE id has been assigned to\nthis.
The oldstable distribution (etch), this problem has been fixed in\nversion 2.9.6-4etch2 of zope2.9.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.10.6-1+lenny1 of zope2.10.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.10.9-1 of zope2.10.
\nWe recommend that you upgrade your zope2.10/zope2.9 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA vulnerability has been discovered in the Linux kernel that may lead\nto privilege escalation. The Common Vulnerabilities and Exposures\nproject identifies the following problem:
\nTavis Ormandy and Julien Tinnes discovered an issue with how the\n sendpage function is initialized in the proto_ops structure.\n Local users can exploit this vulnerability to gain elevated\n privileges.
For the oldstable distribution (etch), this problem has been fixed in\nversion 2.6.24-6~etchnhalf.8etch3.
\nWe recommend that you upgrade your linux-2.6.24 packages.
\nNote: Debian 'etch' includes linux kernel packages based upon both the\n2.6.18 and 2.6.24 linux releases. All known security issues are\ncarefully tracked against both packages and both packages will receive\nsecurity updates until security support for Debian 'etch'\nconcludes. However, given the high frequency at which low-severity\nsecurity issues are discovered in the kernel and the resource\nrequirements of doing an update, lower severity 2.6.18 and 2.6.24\nupdates will typically release in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to denial of service or privilege escalation. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nNeil Horman discovered a missing fix from the e1000 network\n driver. A remote user may cause a denial of service by way of a\n kernel panic triggered by specially crafted frame sizes.
Michael Tokarev discovered an issue in the r8169 network driver.\n Remote users on the same LAN may cause a denial of service by way\n of a kernel panic triggered by receiving a large size frame.
Frank Filz discovered that local users may be able to execute\n files without execute permission when accessed via an nfs4 mount.
Jeff Layton and Suresh Jayaraman fixed several buffer overflows in\n the CIFS filesystem which allow remote servers to cause memory\n corruption.
Tavis Ormandy and Julien Tinnes discovered an issue with how the\n sendpage function is initialized in the proto_ops structure.\n Local users can exploit this vulnerability to gain elevated\n privileges.
For the oldstable distribution (etch), this problem has been fixed in\nversion 2.6.18.dfsg.1-24etch3.
\nThe following matrix lists additional packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch.24etch3 |
| user-mode-linux | 2.6.18-1um-2etch.24etch3 |
We recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo security issues have been discovered in kdegraphics, the graphics\napps from the official KDE release. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nIt was discovered that the KSVG animation element implementation suffers\nfrom a null pointer dereference flaw, which could lead to the execution\nof arbitrary code.
It was discovered that the KSVG animation element implementation is\nprone to a use-after-free flaw, which could lead to the execution of\narbitrary code.
For the oldstable distribution (etch), these problems have been fixed\nin version 4:3.5.5-3etch4.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4:3.5.9-3+lenny2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 4:4.0.
\nWe recommend that you upgrade your kdegraphics packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security issues have been discovered in kdelibs, core libraries\nfrom the official KDE release. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nIt was discovered that there is a use-after-free flaw in handling\ncertain DOM event handlers. This could lead to the execution of\narbitrary code, when visiting a malicious website.
It was discovered that there could be an uninitialised pointer when\nhandling a Cascading Style Sheets (CSS) attr function call. This could\nlead to the execution of arbitrary code, when visiting a malicious\nwebsite.
It was discovered that the JavaScript garbage collector does not handle\nallocation failures properly, which could lead to the execution of\narbitrary code when visiting a malicious website.
For the oldstable distribution (etch), these problems have been fixed\nin version 4:3.5.5a.dfsg.1-8etch2.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4:3.5.10.dfsg.1-0lenny2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed soon.
\nWe recommend that you upgrade your kdelibs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral security issues have been discovered in kde4libs, core libraries\nfor all KDE 4 applications. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nIt was discovered that there is a use-after-free flaw in handling\ncertain DOM event handlers. This could lead to the execution of\narbitrary code, when visiting a malicious website.
It was discovered that there could be an uninitialised pointer when\nhandling a Cascading Style Sheets (CSS) attr function call. This could\nlead to the execution of arbitrary code, when visiting a malicious\nwebsite.
It was discovered that the JavaScript garbage collector does not handle\nallocation failures properly, which could lead to the execution of\narbitrary code when visiting a malicious website.
The oldstable distribution (etch) does not contain kde4libs.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4:4.1.0-3+lenny1.
\nFor the testing distribution (squeeze), these problems will be fixed\nsoon.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4:4.3.0-1.
\nWe recommend that you upgrade your kde4libs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that curl, a client and library to get files from servers\nusing HTTP, HTTPS or FTP, is vulnerable to the \"Null Prefix Attacks Against\nSSL/TLS Certificates\" recently published at the Blackhat conference. This\nallows an attacker to perform undetected man-in-the-middle attacks via a\ncrafted ITU-T X.509 certificate with an injected null byte in the Common\nName field.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 7.15.5-1etch3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 7.18.2-8lenny3.
\nFor the testing (squeeze) and unstable (sid) distribution, this problem\nwill be fixed soon.
\nWe recommend that you upgrade your curl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nFederico Muttis discovered that libpurple, the shared library that adds\nsupport for various instant messaging networks to the pidgin IM client, is\nvulnerable to a heap-based buffer overflow. This issue exists because of\nan incomplete fix for CVE-2008-2927 and CVE-2009-1376. An attacker can\nexploit this by sending two consecutive SLP packets to a victim via MSN.
\nThe first packet is used to create an SLP message object with an offset of\nzero, the second packet then contains a crafted offset which hits the\nvulnerable code originally fixed in CVE-2008-2927 and CVE-2009-1376 and\nallows an attacker to execute arbitrary code.
\nNote: Users with the \"Allow only the users below\" setting are not vulnerable\nto this attack. If you can't install the below updates you may want to\nset this via Tools->Privacy.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.4.3-4lenny3.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.5.9-1.
\nWe recommend that you upgrade your pidgin packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in wordpress, weblog\nmanager. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered that wordpress is prone to an open redirect\nvulnerability which allows remote attackers to conduct phishing atacks.
It was discovered that remote attackers had the ability to trigger an\napplication upgrade, which could lead to a denial of service attack.
It was discovered that wordpress lacks authentication checks in the\nplugin configuration, which might leak sensitive information.
It was discovered that wordpress lacks authentication checks in various\nactions, thus allowing remote attackers to produce unauthorised edits or\nadditions.
It was discovered that the administrator interface is prone to a\ncross-site scripting attack.
It was discovered that remote attackers can gain privileges via certain\ndirect requests.
It was discovered that the _bad_protocol_once function in KSES, as used\nby wordpress, allows remote attackers to perform cross-site scripting\nattacks.
It was discovered that wordpress lacks certain checks around user\ninformation, which could be used by attackers to change the password of\na user.
It was discovered that the get_category_template function is prone to a\ndirectory traversal vulnerability, which could lead to the execution of\narbitrary code.
It was discovered that the _httpsrequest function in the embedded snoopy\nversion is prone to the execution of arbitrary commands via shell\nmetacharacters in https URLs.
It was discovered that wordpress relies on the REQUEST superglobal array\nin certain dangerous situations, which makes it easier to perform\nattacks via crafted cookies.
\nFor the oldstable distribution (etch), these problems have been fixed in\nversion 2.0.10-1etch4.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.5.1-11+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 2.8.3-1.
\nWe recommend that you upgrade your wordpress packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to denial of service, privilege escalation or a leak of\nsensitive memory. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nHerbert Xu discovered an issue in the way UDP tracks corking\n status that could allow local users to cause a denial of service\n (system crash). Tavis Ormandy and Julien Tinnes discovered that\n this issue could also be used by local users to gain elevated\n privileges.
Michael Buesch noticed a typing issue in the eisa-eeprom driver\n for the hppa architecture. Local users could exploit this issue to\n gain access to restricted memory.
Ulrich Drepper noticed an issue in the do_sigalstack routine on\n 64-bit systems. This issue allows local users to gain access to\n potentially sensitive memory on the kernel stack.
Eric Dumazet discovered an issue in the execve path, where the\n clear_child_tid variable was not being properly cleared. Local\n users could exploit this issue to cause a denial of service\n (memory corruption).
Neil Brown discovered an issue in the sysfs interface to md\n devices. When md arrays are not active, local users can exploit\n this vulnerability to cause a denial of service (oops).
For the oldstable distribution (etch), this problem has been fixed in\nversion 2.6.18.dfsg.1-24etch4.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nThe following matrix lists additional source packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch.24etch4 |
| user-mode-linux | 2.6.18-1um-2etch.24etch4 |
MD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJuan Pablo Lopez Yacubian discovered that incorrect handling of invalid\nURLs could be used for spoofing the location bar and the SSL certificate\nstatus of a web page.
\nXulrunner is no longer supported for the old stable distribution (etch).
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.9.0.13-0lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.9.0.13-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Network Security\nService libraries. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nMoxie Marlinspike discovered that a buffer overflow in the regular\n expression parser could lead to the execution of arbitrary code.
Dan Kaminsky discovered that NULL characters in certificate\n names could lead to man-in-the-middle attacks by tricking the user\n into accepting a rogue certificate.
Certificates with MD2 hash signatures are no longer accepted\n since they're no longer considered cryptograhically secure.
The old stable distribution (etch) doesn't contain nss.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 3.12.3.1-0lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.12.3.1-1.
\nWe recommend that you upgrade your nss packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJosh Triplett discovered that the blacklist for potentially harmful TeX\ncode of the teximg module of the Ikiwiki wiki compiler was incomplete,\nresulting in information disclosure.
\nThe old stable distribution (etch) is not affected.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.53.4.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.1415926.
\nWe recommend that you upgrade your ikiwiki package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the TFTP\ncomponent of dnsmasq. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nA buffer overflow in TFTP processing may enable arbitrary code\n execution to attackers which are permitted to use the TFTP service.
Malicious TFTP clients may crash dnsmasq, leading to denial of\n service.
The old stable distribution is not affected by these problems.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.45-1+lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.50-1.
\nWe recommend that you upgrade your dnsmasq packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIn MySQL 4.0.0 through 5.0.83, multiple format string vulnerabilities\nin the dispatch_command() function in libmysqld/sql_parse.cc in mysqld\nallow remote authenticated users to cause a denial of service (daemon\ncrash) and potentially the execution of arbitrary code via format\nstring specifiers in a database name in a COM_CREATE_DB or\nCOM_DROP_DB request.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 5.0.51a-24+lenny2.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 5.0.32-7etch11.
\nWe recommend that you upgrade your mysql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRaphael Geissert discovered that uscan, a program to check for\navailability of new source code versions which is part of the\ndevscripts package, runs Perl code downloaded from potentially\nuntrusted sources to implement its URL and version mangling\nfunctionality. This update addresses this issue by reimplementing the\nrelevant Perl operators without relying on the Perl interpreter,\ntrying to preserve backwards compatibility as much as possible.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 2.9.26etch4.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.10.35lenny6.
\nFor the unstable distribution (sid), this problem will be fixed in\nversion 2.10.54.
\nWe recommend that you upgrade your devscripts package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the software suite for the\nSILC protocol, a network protocol designed to provide end-to-end security\nfor conferencing services. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nAn incorrect format string in sscanf() used in the ASN1 encoder to scan an\nOID value could overwrite a neighbouring variable on the stack as the\ndestination data type is smaller than the source type on 64-bit. On 64-bit\narchitectures this could result in unexpected application behaviour or even\ncode execution in some cases.
Various format string vulnerabilities when handling parsed SILC messages\nallow an attacker to execute arbitrary code with the rights of the victim\nrunning the SILC client via crafted nick names or channel names containing\nformat strings.
An incorrect format string in a sscanf() call used in the HTTP server\ncomponent of silcd could result in overwriting a neighbouring variable on\nthe stack as the destination data type is smaller than the source type on\n64-bit. An attacker could exploit this by using crafted Content-Length\nheader values resulting in unexpected application behaviour or even code\nexecution in some cases.
silc-server doesn't need an update as it uses the shared library provided\nby silc-toolkit. silc-client/silc-toolkit in the oldstable distribution\n(etch) is not affected by this problem.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.1.7-2+lenny1 of silc-toolkit and in version 1.1.4-1+lenny1\nof silc-client.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.10-1 of silc-toolkit and version 1.1-2 of silc-client\n(using libsilc from silc-toolkit since this upload).
\nWe recommend that you upgrade your silc-toolkit/silc-client packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the OpenOffice.org\noffice suite. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nDyon Balding of Secunia Research has discovered a vulnerability,\n which can be exploited by opening a specially crafted Microsoft\n Word document.
\nWhen reading a Microsoft Word document, a bug in the parser of\n sprmTDelete records can result in an integer underflow that may\n lead to heap-based buffer overflows.
\nSuccessful exploitation may allow arbitrary code execution in the\n context of the OpenOffice.org process.
Dyon Balding of Secunia Research has discovered a vulnerability,\n which can be exploited by opening a specially crafted Microsoft\n Word document.
\nWhen reading a Microsoft Word document, a bug in the parser of\n sprmTDelete records can result in heap-based buffer overflows.
\nSuccessful exploitation may allow arbitrary code execution in the\n context of the OpenOffice.org process.
A vulnerability has been discovered in the parser of EMF files of\n OpenOffice/Go-oo 2.x and 3.x that can be triggered by a specially\n crafted document and lead to the execution of arbitrary commands\n the privileges of the user running OpenOffice.org/Go-oo.
\nThis vulnerability does not exist in the packages for oldstable,\n testing and unstable.
For the old stable distribution (etch) these problems have been fixed in\nversion 2.0.4.dfsg.2-7etch7.
\nFor the stable distribution (lenny) these problems have been fixed in\nversion 2.4.1+dfsg-1+lenny3 and higher.
\nFor the unstable (sid) and testing (squeeze) distribution these\nproblems have been fixed in version 3.1.1~ooo310m15-1.
\nWe recommend that you upgrade your Openoffice.org package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the SIEVE component of cyrus-imapd, a highly scalable\nenterprise mail system, is vulnerable to a buffer overflow when processing\nSIEVE scripts. Due to incorrect use of the sizeof() operator an attacker is\nable to pass a negative length to snprintf() calls resulting in large positive\nvalues due to integer conversion. This causes a buffer overflow which can be\nused to elevate privileges to the cyrus system user. An attacker who is able\nto install SIEVE scripts executed by the server is therefore able to read and\nmodify arbitrary email messages on the system.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.2.13-10+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.2.13-14+lenny1.
\nFor the testing (squeeze) and unstable (sid) distribution, this problem\nwill be fixed soon.
\nWe recommend that you upgrade your cyrus-imapd-2.2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that xapian-omega, a CGI interface for searching xapian\ndatabases, is not properly escaping user supplied input when printing\nexceptions. An attacker can use this to conduct cross-site scripting\nattacks via crafted search queries resulting in an exception and steal\npotentially sensitive data from web applications running on the same domain\nor embedding the search engine into a website.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.9.9-1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.7-3+lenny1.
\nFor the testing (squeeze) and unstable (sid) distribution, this problem\nwill be fixed soon.
\nWe recommend that you upgrade your xapian-omega packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in nagios2, a host/service/network\nmonitoring and management system. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nSeveral cross-site scripting issues via several parameters were\ndiscovered in the CGI scripts, allowing attackers to inject arbitrary\nHTML code. In order to cover the different attack vectors, these issues\nhave been assigned CVE-2007-5624, CVE-2007-5803 and CVE-2008-1360.
\nFor the oldstable distribution (etch), these problems have been fixed in\nversion 2.6-2+etch4.
\nThe stable distribution (lenny) does not include nagios2, and nagios3 is\nnot affected by these problems.
\nThe testing distribution (squeeze) and the unstable distribution (sid)\ndo not contain nagios2, and nagios3 is not affected by these problems.
\nWe recommend that you upgrade your nagios2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChris Ries discovered that nginx, a high-performance HTTP server, reverse\nproxy and IMAP/POP3 proxy server, is vulnerable to a buffer underflow when\nprocessing certain HTTP requests. An attacker can use this to execute\narbitrary code with the rights of the worker process (www-data on Debian)\nor possibly perform denial of service attacks by repeatedly crashing\nworker processes via a specially crafted URL in an HTTP request.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.4.13-2+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.6.32-3+lenny2.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.7.61-3.
\nWe recommend that you upgrade your nginx packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nJesse Ruderman discovered crashes in the layout engine, which\n might allow the execution of arbitrary code.
Daniel Holbert, Jesse Ruderman, Olli Pettay and \"toshi\" discovered\n crashes in the layout engine, which might allow the execution of\n arbitrary code.
Josh Soref, Jesse Ruderman and Martin Wargers discovered crashes\n in the layout engine, which might allow the execution of arbitrary\n code.
Jesse Ruderman discovered a crash in the Javascript engine, which\n might allow the execution of arbitrary code.
Carsten Book and \"Taral\" discovered crashes in the layout engine,\n which might allow the execution of arbitrary code.
Jesse Ruderman discovered that the user interface for installing/\n removing PCKS #11 securiy modules wasn't informative enough, which\n might allow social engineering attacks.
It was discovered that incorrect pointer handling in the XUL parser\n could lead to the execution of arbitrary code.
Juan Pablo Lopez Yacubian discovered that incorrent rendering of\n some Unicode font characters could lead to spoofing attacks on\n the location bar.
For the stable distribution (lenny), these problems have been fixed\nin version 1.9.0.14-0lenny1.
\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.0.14-1.
\nFor the experimental distribution, these problems have been fixed in\nversion 1.9.1.3-1.
\nWe recommend that you upgrade your xulrunner package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Iceweasel web\nbrowser, an unbranded version of the Firefox browser. The Common\nVulnerabilities and Exposures project identifies the following problems:
\n\"moz_bug_r_a4\" discovered that a programming error in the FeedWriter\n module could lead to the execution of Javascript code with elevated\n privileges.
Prateek Saxena discovered a cross-site scripting vulnerability in\n the MozSearch plugin interface.
For the stable distribution (lenny), these problems have been fixed in\nversion 3.0.6-3.
\nAs indicated in the Etch release notes, security support for the\nMozilla products in the oldstable distribution needed to be stopped\nbefore the end of the regular Etch security maintenance life cycle.\nYou are strongly encouraged to upgrade to stable or switch to a still\nsupported browser.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.0.14-1.
\nFor the experimental distribution, these problems have been fixed in\nversion 3.5.3-1.
\nWe recommend that you upgrade your iceweasel packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nBrian Mastenbrook discovered that rails, the MVC ruby based framework\ngeared for web application development, is prone to cross-site scripting\nattacks via malformed strings in the form helper.
\nFor the oldstable distribution (etch) security support has been\ndiscontinued. It has been reported that rails in oldstable is unusable\nand several features that are affected by security issues are broken due\nto programming issues. It is highly recommended to upgrade to the\nversion in stable (lenny).
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.1.0-7.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 2.2.3-1.
\nWe recommend that you upgrade your rails packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nCertificates with MD2 hash signatures are no longer accepted by OpenSSL,\nsince they're no longer considered cryptographically secure.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.9.8g-15+lenny5.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 0.9.8c-4etch9 for openssl and version 0.9.7k-3.1etch5 for\nopenssl097.\nThe OpenSSL 0.9.8 update for oldstable (etch) also provides updated\npackages for multiple denial of service vulnerabilities in the\nDatagram Transport Layer Security implementation. These fixes were\nalready provided for Debian stable (Lenny) in a previous point\nupdate. The OpenSSL 0.9.7 package from oldstable (Etch) is not\naffected. (CVE-2009-1377, CVE-2009-1378, CVE-2009-1379,\nCVE-2009-1386 and CVE-2009-1387)
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.9.8k-5.
\nWe recommend that you upgrade your openssl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the ICU unicode library performed incorrect\nprocessing of invalid multibyte sequences, resulting in potential\nbypass of security mechanisms.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 3.6-2etch3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.8.1-3+lenny2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 4.0.1-1.
\nWe recommend that you upgrade your icu packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTielei Wang has discovered an integer overflow in wxWidgets, the wxWidgets\nCross-platform C++ GUI toolkit, which allows the execution of arbitrary\ncode via a crafted JPEG file.
\nFor the oldstable distribution (etch), this problem has been fixed in version\n2.4.5.1.1+etch1 for wxwindows2.4 and version 2.6.3.2.1.5+etch1 for\nwxwidgets2.6.
\nFor the stable distribution (lenny), this problem has been fixed in version\n2.6.3.2.2-3+lenny1 for wxwidgets2.6 and version 2.8.7.1-1.1+lenny1 for\nwxwidgets2.8.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.8.7.1-2 for wxwidgets2.8 and will be fixed soon for\nwxwidgets2.6.
\nWe recommend that you upgrade your wxwidgets packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMarek Grzybowski discovered that changetrack, a program to monitor\nchanges to (configuration) files, is prone to shell command injection\nvia metacharacters in filenames. The behaviour of the program has been\nadjusted to reject all filenames with metacharacters.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 4.3-3+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 4.3-3+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 4.5-2.
\nWe recommend that you upgrade your changetrack packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the SIEVE component of dovecot, a mail server\nthat supports mbox and maildir mailboxes, is vulnerable to a buffer\noverflow when processing SIEVE scripts. This can be used to elevate\nprivileges to the dovecot system user. An attacker who is able to\ninstall SIEVE scripts executed by the server is therefore able to read\nand modify arbitrary email messages on the system.
\nFor the oldstable distribution (etch), this problem has been fixed in version\n1.0.rc15-2etch5.
\nFor the stable distribution (lenny), this problem has been fixed in version\n1:1.0.15-2.3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1:1.2.1-1.
\nWe recommend that you upgrade your dovecot packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the SIEVE component of cyrus-imapd and\nkolab-cyrus-imapd, the Cyrus mail system, is vulnerable to a buffer\noverflow when processing SIEVE scripts.\nThis can be used to elevate privileges to the cyrus system user. An\nattacker who is able to install SIEVE scripts executed by the server is\ntherefore able to read and modify arbitrary email messages on the\nsystem. The update introduced by DSA\n1881-1 was incomplete and the issue has been given an additional CVE id due\nto its complexity.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.2.13-10+etch4 for cyrus-imapd-2.2 and version 2.2.13-2+etch2\nfor kolab-cyrus-imapd.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.2.13-14+lenny3 for cyrus-imapd-2.2, version 2.2.13-5+lenny2\nfor kolab-cyrus-imapd.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.2.13-15 for cyrus-imapd-2.2, and will be fixed soon for\nkolab-cyrus-imapd.
\nWe recommend that you upgrade your cyrus-imapd-2.2 and kolab-cyrus-imapd\npackages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMiroslav Lichvar discovered that newt, a windowing toolkit, is prone to\na buffer overflow in the content processing code, which can lead to the\nexecution of arbitrary code.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.52.2-10+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.52.2-11.3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your newt packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the xmltooling packages,\nas used by Shibboleth:
\nChris Ries discovered that decoding a crafted URL leads to a crash (and\npotentially, arbitrary code execution).
Ian Young discovered that embedded NUL characters in certificate names\nwere not correctly handled, exposing configurations using PKIX trust\nvalidation to impersonation attacks.
Incorrect processing of SAML metadata ignores key usage constraints.\nThis minor issue also needs a correction in the opensaml2 packages,\nwhich will be provided in an upcoming stable point release (and,\nbefore that, via stable-proposed-updates).
For the stable distribution (lenny), these problems have been fixed in\nversion 1.0-2+lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.2.2-1.
\nWe recommend that you upgrade your xmltooling packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the opensaml and\nshibboleth-sp packages, as used by Shibboleth 1.x:
\nChris Ries discovered that decoding a crafted URL leads to a crash\n(and potentially, arbitrary code execution).
Ian Young discovered that embedded NUL characters in certificate names\nwere not correctly handled, exposing configurations using PKIX trust\nvalidation to impersonation attacks.
Incorrect processing of SAML metadata ignored key usage constraints.
For the old stable distribution (etch), these problems have been fixed\nin version 1.3f.dfsg1-2+etch1 of the shibboleth-sp packages, and\nversion 1.1a-2+etch1 of the opensaml packages.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.3.1.dfsg1-3+lenny1 of the shibboleth-sp packages, and\nversion 1.1.1-2+lenny1 of the opensaml packages.
\nThe unstable distribution (sid) does not contain Shibboleth 1.x\npackages.
\nThis update requires restarting the affected services (mainly Apache)\nto become effective.
\nWe recommend that you upgrade your Shibboleth 1.x packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Esser discovered that Horde, a web application framework providing\nclasses for dealing with preferences, compression, browser detection,\nconnection tracking, MIME, and more, is insufficiently validating and\nescaping user provided input. The Horde_Form_Type_image form element\nallows to reuse a temporary filename on reuploads which are stored in a\nhidden HTML field and then trusted without prior validation. An attacker\ncan use this to overwrite arbitrary files on the system or to upload PHP\ncode and thus execute arbitrary code with the rights of the webserver.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 3.1.3-4etch6.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.2.2+debian0-2+lenny1.
\nFor the testing distribution (squeeze), this problem has been fixed in\nversion 3.3.5+debian0-1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.3.5+debian0-1.
\nWe recommend that you upgrade your horde3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that the pluto daemon in openswan, an\nimplementation of IPSEC and IKE, could crash when processing a crafted\nX.509 certificate.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 2.4.6+dfsg.2-1.1+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.4.12+dfsg-1.3+lenny2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.6.22+dfsg-1.
\nWe recommend that you upgrade your openswan package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in strongswan, an\nimplementation of the IPSEC and IKE protocols. The Common\nVulnerabilities and Exposures project identifies the following\nproblems:
\nThe charon daemon can crash when processing certain crafted IKEv2\npackets. (The old stable distribution (etch) was not affected by\nthese two problems because it lacks IKEv2 support.)
The pluto daemon could crash when processing a crafted X.509\ncertificate.
For the old stable distribution (etch), these problems have been fixed\nin version 2.8.0+dfsg-1+etch2.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4.2.4-5+lenny3.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.3.2-1.1.
\nWe recommend that you upgrade your strongswan packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in PostgreSQL, an SQL\ndatabase system. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nAuthenticated users can shut down the backend server by re-LOAD-ing\nlibraries in $libdir/plugins, if any libraries are present there.\n(The old stable distribution (etch) is not affected by this issue.)
Authenticated non-superusers can gain database superuser privileges if\nthey can create functions and tables due to incorrect execution of\nfunctions in functional indexes.
If PostgreSQL is configured with LDAP authentication, and the LDAP\nconfiguration allows anonymous binds, it is possible for a user to\nauthenticate themselves with an empty password. (The old stable\ndistribution (etch) is not affected by this issue.)
In addition, this update contains reliability improvements which do\nnot target security issues.
\nFor the old stable distribution (etch), these problems have been fixed\nin version 7.4.26-0etch1 of the postgresql-7.4 source package, and\nversion 8.1.18-0etch1 of the postgresql-8.1 source package.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 8.3.8-0lenny1 of the postgresql-8.3 source package.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 8.3.8-1 of the postgresql-8.3 source package, and version\n8.4.1-1 of the postgresql-8.4 source package.
\nWe recommend that you upgrade your PostgreSQL packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in mediawiki1.7, a website engine\nfor collaborative work. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nDavid Remahl discovered that mediawiki1.7 is prone to a cross-site scripting attack.
David Remahl discovered that mediawiki1.7, when Internet Explorer is used and\nuploads are enabled, or an SVG scripting browser is used and SVG uploads are\nenabled, allows remote authenticated users to inject arbitrary web script or\nHTML by editing a wiki page.
David Remahl discovered that mediawiki1.7 is prone to a cross-site request\nforgery vulnerability in the Special:Import feature.
It was discovered that mediawiki1.7 is prone to a cross-site scripting attack in\nthe web-based installer.
For the oldstable distribution (etch), these problems have been fixed in version\n1.7.1-9etch1 for mediawiki1.7, and mediawiki is not affected (it is a\nmetapackage for mediawiki1.7).
\nThe stable (lenny) distribution does not include mediawiki1.7, and these\nproblems have been fixed in version 1:1.12.0-2lenny3 for mediawiki which was\nalready included in the lenny release.
\nThe unstable (sid) and testing (squeeze) distributions do not\ninclude mediawiki1.7, and these problems have been fixed in version 1:1.14.0-1\nfor mediawiki.
\nWe recommend that you upgrade your mediawiki1.7 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJakub Wilk discovered an off-by-one buffer overflow in the charset\nhandling of elinks, a feature-rich text-mode WWW browser, which might\nlead to the execution of arbitrary code if the user is tricked into\nopening a malformed HTML page.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 0.11.1-1.2etch2.
\nThe stable distribution (lenny) and the unstable distribution (sid)\nalready contain a patch for this problem.
\nWe recommend that you upgrade your elinks package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in graphicsmagick, a\ncollection of image processing tool, which can lead to the execution\nof arbitrary code, exposure of sensitive information or cause DoS.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nMultiple integer overflows in XInitImage function in xwd.c for\n GraphicsMagick, allow user-assisted remote attackers to cause a\n denial of service (crash) or obtain sensitive information via\n crafted images with large or negative values that trigger a\n buffer overflow. It only affects the oldstable distribution (etch).
Multiple integer overflows allow remote attackers to execute arbitrary\n code via a crafted DCM image, or the colors or comments field in a\n crafted XWD image. It only affects the oldstable distribution (etch).
A crafted image file can trigger an infinite loop in the ReadDCMImage\n function or in the ReadXCFImage function. It only affects the oldstable\n distribution (etch).
Multiple integer overflows allow context-dependent attackers to execute\n arbitrary code via a crafted .dcm, .dib, .xbm, .xcf, or .xwd image file,\n which triggers a heap-based buffer overflow. It only affects the\n oldstable distribution (etch).
A sign extension error allows context-dependent attackers to execute\n arbitrary code via a crafted width value in an image file, which\n triggers an integer overflow and a heap-based buffer overflow. It\n affects only the oldstable distribution (etch).
The load_tile function in the XCF coder allows user-assisted remote\n attackers to cause a denial of service or possibly execute arbitrary\n code via a crafted .xcf file that triggers an out-of-bounds heap write.\n It affects only oldstable (etch).
Multiple vulnerabilities in GraphicsMagick before 1.2.4 allow remote\n attackers to cause a denial of service (crash, infinite loop, or\n memory consumption) via vectors in the AVI, AVS, DCM, EPT, FITS,\n MTV, PALM, RLA, and TGA decoder readers; and the\n GetImageCharacteristics function in magick/image.c, as reachable\n from a crafted PNG, JPEG, BMP, or TIFF file.
Multiple heap-based buffer underflows in the ReadPALMImage function in\n coders/palm.c in GraphicsMagick before 1.2.3 allow remote attackers\n to cause a denial of service (crash) or possibly execute arbitrary\n code via a crafted PALM image.
Heap-based buffer overflow in the DecodeImage function in\n coders/pict.c in GraphicsMagick before 1.1.14, and 1.2.x before\n 1.2.3, allows remote attackers to cause a denial of service (crash)\n or possibly execute arbitrary code via a crafted PICT image.
Multiple vulnerabilities in GraphicsMagick allow remote attackers to\n cause a denial of service (crash) via vectors in XCF and CINEON images.
Vulnerability in GraphicsMagick allows remote attackers to cause a denial\n of service (crash) via vectors in DPX images.
Integer overflow allows remote attackers to cause a denial of service\n (crash) and possibly execute arbitrary code via a crafted TIFF file,\n which triggers a buffer overflow.
For the oldstable distribution (etch), these problems have been fixed in\nversion 1.1.7-13+etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.1.11-3.2+lenny1.
\nFor the upcoming stable distribution (squeeze) and the unstable\ndistribution (sid), these problems have been fixed in version\n1.3.5-5.1.
\nWe recommend that you upgrade your graphicsmagick packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDaniel Stenberg discovered that wget, a network utility to retrieve files from\nthe Web using HTTP(S) and FTP, is vulnerable to the \"Null Prefix Attacks Against\nSSL/TLS Certificates\" published at the Blackhat conference some time ago. This\nallows an attacker to perform undetected man-in-the-middle attacks via a crafted\nITU-T X.509 certificate with an injected null byte in the Common Name field.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.10.2-2+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.11.4-2+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.12-1.
\nWe recommend that you upgrade your wget packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nThe forms library of python-django, a high-level Python web development\nframework, is using a badly chosen regular expression when validating\nemail addresses and URLs. An attacker can use this to perform denial\nof service attacks (100% CPU consumption) due to bad backtracking\nvia a specially crafted email address or URL which is validated by the\ndjango forms library.
\npython-django in the oldstable distribution (etch), is not affected by\nthis problem.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.2-1+lenny2.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.1-1.
\nWe recommend that you upgrade your python-django packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSecurity support for clamav, an anti-virus utility for Unix, has been\ndiscontinued for the stable distribution (lenny) and the oldstable\ndistribution (etch). Clamav Upstream has stopped supporting the\nreleases in etch and lenny. Also, it is not easily possible to receive\nsignature updates for the virus scanner with our released versions\nanymore.
\nWe recommend that all clamav users consider switching to the\nversion in debian-volatile, which receives regular updates and security\nsupport on a best effort basis.
\nFor more information on debian-volatile, please visit\nhttps://www.debian.org/volatile/.
\nMD5 checksums of the listed files are available in the original advisory.
\nSeveral vulnerabilities have been discovered in kvm, a full virtualization system.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nChris Webb discovered an off-by-one bug limiting KVM's VNC passwords to 7\ncharacters. This flaw might make it easier for remote attackers to guess the VNC\npassword, which is limited to seven characters where eight was intended.
It was discovered that the kvm_emulate_hypercall function in KVM does not\nprevent access to MMU hypercalls from ring 0, which allows local guest OS users\nto cause a denial of service (guest kernel crash) and read or write guest kernel\nmemory.
The oldstable distribution (etch) does not contain kvm.
\nFor the stable distribution (lenny), these problems have been fixed in version\n72+dfsg-5~lenny3.
\nFor the testing distribution (squeeze) these problems will be fixed soon.
\nFor the unstable distribution (sid) these problems have been fixed in version\n85+dfsg-4.1
\nWe recommend that you upgrade your kvm packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in samba, an implementation of\nthe SMB/CIFS protocol for Unix systems, providing support for cross-platform\nfile and printer sharing with other operating systems and more. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nThe mount.cifs utility is missing proper checks for file permissions when\nused in verbose mode. This allows local users to partly disclose the\ncontent of arbitrary files by specifying the file as credentials file and\nattempting to mount a samba share.
A reply to an oplock break notification which samba doesn't expect could\nlead to the service getting stuck in an infinite loop. An attacker\ncan use this to perform denial of service attacks via a specially crafted\nSMB request.
A lack of error handling in case no home directory was configured/specified\nfor the user could lead to file disclosure. In case the automated [homes]\nshare is enabled or an explicit share is created with that username, samba\nfails to enforce sharing restrictions which results in an attacker being\nable to access the file system from the root directory.
For the oldstable distribution (etch), this problem will be fixed soon.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2:3.2.5-4lenny7.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2:3.4.2-1.
\nWe recommend that you upgrade your samba packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that postgresql-ocaml, OCaml bindings to PostgreSQL's\nlibpq, was missing a function to call PQescapeStringConn(). This is\nneeded, because PQescapeStringConn() honours the charset of the\nconnection and prevents insufficient escaping, when certain multibyte\ncharacter encodings are used. The added function is called\nescape_string_conn() and takes the established database connection as a\nfirst argument. The old escape_string() was kept for backwards\ncompatibility.
\nDevelopers using these bindings are encouraged to adjust their code to\nuse the new function.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.5.4-2+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.7.0-3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.12.1-1.
\nWe recommend that you upgrade your postgresql-ocaml packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that mysql-ocaml, OCaml bindings for MySql, was\nmissing a function to call mysql_real_escape_string(). This is needed,\nbecause mysql_real_escape_string() honours the charset of the connection\nand prevents insufficient escaping, when certain multibyte character\nencodings are used. The added function is called real_escape() and\ntakes the established database connection as a first argument. The old\nescape_string() was kept for backwards compatibility.
\nDevelopers using these bindings are encouraged to adjust their code to\nuse the new function.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.0.4-2+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.4-4+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your mysql-ocaml packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that pygresql, a PostgreSQL module for Python, was\nmissing a function to call PQescapeStringConn(). This is needed, because\nPQescapeStringConn() honours the charset of the connection and prevents\ninsufficient escaping, when certain multibyte character encodings are\nused. The new function is called pg_escape_string(), which takes the\ndatabase connection as a first argument. The old function\nescape_string() has been preserved as well for backwards compatibility.
\nDevelopers using these bindings are encouraged to adjust their code to\nuse the new function.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1:3.8.1-1etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1:3.8.1-3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1:4.0-1.
\nWe recommend that you upgrade your pygresql packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that CamlImages, an open source image processing\nlibrary, suffers from several integer overflows, which may lead to a\npotentially exploitable heap overflow and result in arbitrary code\nexecution. This advisory addresses issues with the reading of TIFF\nfiles. It also expands the patch for CVE-2009-2660 to cover another\npotential overflow in the processing of JPEG images.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.20-8+etch3.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1:2.2.0-4+lenny3.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your camlimages package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Kanat-Alexander, Bradley Baetz, and Fr\u00e9d\u00e9ric Buclin discovered an SQL\ninjection vulnerability in the Bug.create WebService function in Bugzilla, a\nweb-based bug tracking system, which allows remote attackers to execute\narbitrary SQL commands.
\nThe oldstable distribution (etch) isn't affected by this problem.
\nFor the stable distribution (lenny), this problem has been fixed in version\n3.0.4.1-2+lenny2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your bugzilla packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in mapserver, a CGI-based\nweb framework to publish spatial data and interactive mapping applications.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nMissing input validation on a user supplied map queryfile name can be\n used by an attacker to check for the existence of a specific file by\n using the queryfile GET parameter and checking for differences in error\n messages.
A lack of file type verification when parsing a map file can lead to\n partial disclosure of content from arbitrary files through parser error\n messages.
Due to missing input validation when saving map files under certain\n conditions it is possible to perform directory traversal attacks and\n to create arbitrary files.\n NOTE: Unless the attacker is able to create directories in the image\n path or there is already a readable directory this doesn't affect\n installations on Linux as the fopen() syscall will fail in case a sub\n path is not readable.
It was discovered that mapserver is vulnerable to a stack-based buffer\n overflow when processing certain GET parameters. An attacker can use\n this to execute arbitrary code on the server via crafted id parameters.
An integer overflow leading to a heap-based buffer overflow when\n processing the Content-Length header of an HTTP request can be used by an\n attacker to execute arbitrary code via crafted POST requests containing\n negative Content-Length values.
An integer overflow when processing HTTP requests can lead to a\n heap-based buffer overflow. An attacker can use this to execute arbitrary\n code either via crafted Content-Length values or large HTTP request. This\n is partly because of an incomplete fix for\n CVE-2009-0840.
For the oldstable distribution (etch), this problem has been fixed in\nversion 4.10.0-5.1+etch4.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 5.0.3-3+lenny4.
\nFor the testing distribution (squeeze), this problem has been fixed in\nversion 5.4.2-1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 5.4.2-1.
\nWe recommend that you upgrade your mapserver packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNotice: Debian 5.0.4, the next point release of Debian 'lenny',\nwill include a new default value for the mmap_min_addr tunable.\nThis change will add an additional safeguard against a class of security\nvulnerabilities known as \"NULL pointer dereference\" vulnerabilities, but\nit will need to be overridden when using certain applications.\nAdditional information about this change, including instructions for\nmaking this change locally in advance of 5.0.4 (recommended), can be\nfound at: https://wiki.debian.org/mmap_min_addr.
\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service, sensitive memory leak or privilege escalation.\nThe Common Vulnerabilities and Exposures project identifies the following\nproblems:
\nEric Paris provided several fixes to increase the protection\n provided by the mmap_min_addr tunable against NULL pointer\n dereference vulnerabilities.
Mark Smith discovered a memory leak in the appletalk\n implementation. When the appletalk and ipddp modules are loaded,\n but no ipddp\"N\" device is found, remote attackers can cause a\n denial of service by consuming large amounts of system memory.
Loic Minier discovered an issue in the eCryptfs filesystem. A\n local user can cause a denial of service (kernel oops) by causing\n a dentry value to go negative.
Arjan van de Ven discovered an issue in the AX.25 protocol\n implementation. A specially crafted call to setsockopt() can\n result in a denial of service (kernel oops).
Jan Beulich discovered the existence of a sensitive kernel memory\n leak. Systems running the 'amd64' kernel do not properly sanitize\n registers for 32-bit processes.
Jiri Slaby fixed a sensitive memory leak issue in the ANSI/IEEE\n 802.2 LLC implementation. This is not exploitable in the Debian\n lenny kernel as root privileges are required to exploit this\n issue.
Eric Dumazet fixed several sensitive memory leaks in the IrDA,\n X.25 PLP (Rose), NET/ROM, Acorn Econet/AUN, and Controller Area\n Network (CAN) implementations. Local users can exploit these\n issues to gain access to kernel memory.
Eric Paris discovered an issue with the NFSv4 server\n implementation. When an O_EXCL create fails, files may be left\n with corrupted permissions, possibly granting unintentional\n privileges to other local users.
Jan Kiszka noticed that the kvm_emulate_hypercall function in KVM\n does not prevent access to MMU hypercalls from ring 0, which\n allows local guest OS users to cause a denial of service (guest\n kernel crash) and read or write guest kernel memory.
Alistair Strachan reported an issue in the r8169 driver. Remote\n users can cause a denial of service (IOMMU space exhaustion and\n system crash) by transmitting a large amount of jumbo frames.
For the oldstable distribution (etch), these problems, where\napplicable, will be fixed in updates to linux-2.6 and linux-2.6.24.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.6.26-19lenny1.
\nWe recommend that you upgrade your linux-2.6 and user-mode-linux\npackages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nThe following matrix lists additional source packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 5.0 (lenny) |
|---|---|
| user-mode-linux | 2.6.26-1um-2+19lenny1 |
MD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Kaminsky and Moxie Marlinspike discovered that kdelibs, core libraries from\nthe official KDE release, does not properly handle a '\\0' character in a domain\nname in the Subject Alternative Name field of an X.509 certificate, which allows\nman-in-the-middle attackers to spoof arbitrary SSL servers via a crafted\ncertificate issued by a legitimate Certification Authority.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 4:3.5.5a.dfsg.1-8etch3.
\nDue to a bug in the archive system, the fix for the stable distribution\n(lenny), will be released as version 4:3.5.10.dfsg.1-0lenny3 once it is\navailable.
\nFor the testing distribution (squeeze), and the unstable distribution (sid),\nthis problem has been fixed in version 4:3.5.10.dfsg.1-2.1.
\nWe recommend that you upgrade your kdelibs packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in mimetex, a lightweight\nalternative to MathML. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nChris Evans and Damien Miller, discovered multiple stack-based buffer overflow.\nAn attacker could execute arbitrary code via a TeX file with long picture,\ncircle, input tags.
Chris Evans discovered that mimeTeX contained certain directives that may be\nunsuitable for handling untrusted user input. A remote attacker can obtain\nsensitive information.
For the oldstable distribution (etch), these problems have been fixed in\nversion 1.50-1+etch1.
\nDue to a bug in the archive system, the fix for the stable distribution\n(lenny) will be released as version 1.50-1+lenny1 once it is available.
\nFor the testing distribution (squeeze), and the unstable distribution (sid),\nthese problems have been fixed in version 1.50-1.1.
\nWe recommend that you upgrade your mimetex packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in phpMyAdmin, a tool\nto administer MySQL over the web. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nCross-site scripting (XSS) vulnerability allows remote attackers to\n inject arbitrary web script or HTML via a crafted MySQL table name.
SQL injection vulnerability in the PDF schema generator functionality\n allows remote attackers to execute arbitrary SQL commands. This issue\n does not apply to the version in Debian 4.0 Etch.
Additionally, extra fortification has been added for the web based setup.php\nscript. Although the shipped web server configuration should ensure that\nthis script is protected, in practice this turned out not always to be the\ncase. The config.inc.php file is not writable anymore by the webserver user.\nSee README.Debian for details on how to enable the setup.php\nscript if and when you need it.
\nFor the old stable distribution (etch), these problems have been fixed in\nversion 2.9.1.1-13.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.11.8.1-5+lenny3.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.2.2.1-1.
\nWe recommend that you upgrade your phpmyadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Smarty, a PHP\ntemplating engine. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nThe _expand_quoted_text function allows for certain restrictions in\n templates, like function calling and PHP execution, to be bypassed.
The smarty_function_math function allows context-dependent attackers\n to execute arbitrary commands via shell metacharacters in the equation\n attribute of the math function.
For the old stable distribution (etch), these problems have been fixed\nin version 2.6.14-1etch2.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.6.20-1.2.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your smarty package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA denial of service vulnerability has been found in nginx, a small and\nefficient web server.
\nJasson Bell discovered that a remote attacker could cause a denial of service\n(segmentation fault) by sending a crafted request.
\nFor the old stable distribution (etch), this problem has been fixed in version\n0.4.13-2+etch3.
\nFor the stable distribution (lenny), this problem has been fixed in version\n0.6.32-3+lenny3.
\nFor the testing (squeeze) and unstable (sid) distributions, this problem has\nbeen fixed in version 0.7.62-1.
\nWe recommend that you upgrade your nginx package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nPeter Valchev discovered an error in expat, an XML parsing C library,\nwhen parsing certain UTF-8 sequences, which can be exploited to crash an\napplication using the library.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 1.95.8-3.4+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0.1-4+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your expat packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nVladimir Vukicevic, Jesse Ruderman, Martijn Wargers, Daniel\n Banchero, David Keeler and Boris Zbarsky reported crashes in\n layout engine, which might allow the execution of arbitrary code.
Carsten Book reported a crash in the layout engine, which might\n allow the execution of arbitrary code.
Jesse Ruderman and Sid Stamm discovered spoofing vulnerability\n in the file download dialog.
Gregory Fleischer discovered a bypass of the same-origin policy\n using the document.getSelection() function.
\"moz_bug_r_a4\" discovered a privilege escalation to Chrome status\n in the XPCOM utility XPCVariant::VariantDataToJS.
\"regenrecht\" discovered a buffer overflow in the GIF parser, which\n might lead to the execution of arbitrary code.
Marco C. discovered that a programming error in the proxy auto\n configuration code might lead to denial of service or the\n execution of arbitrary code.
Jeremy Brown discovered that the filename of a downloaded file\n which is opened by the user is predictable, which might lead to\n tricking the user into a malicious file if the attacker has local\n access to the system.
Paul Stone discovered that history information from web forms\n could be stolen.
For the stable distribution (lenny), these problems have been fixed\nin version 1.9.0.15-0lenny1.
\nAs indicated in the Etch\nrelease notes, security support for the Mozilla products in the oldstable\ndistribution needed to be stopped before the end of the regular Etch security\nmaintenance life cycle. You are strongly encouraged to upgrade to stable or\nswitch to a still supported browser.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.1.4-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA denial of service vulnerability has been found in libhtml-parser-perl,\na collection of modules to parse HTML in text documents which is used by\nseveral other projects like e.g. SpamAssassin.
\nMark Martinec discovered that the decode_entities() function will get stuck\nin an infinite loop when parsing certain HTML entities with invalid UTF-8\ncharacters. An attacker can use this to perform denial of service attacks\nby submitting crafted HTML to an application using this functionality.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 3.55-1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.56-1+lenny1.
\nFor the testing (squeeze) and unstable (sid) distribution, this problem\nwill be fixed soon.
\nWe recommend that you upgrade your libhtml-parser-perl packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo vulnerabilities have been discovered in mahara, an electronic portfolio,\nweblog, and resume builder. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nRuslan Kabalin discovered a issue with resetting passwords, which could\nlead to a privilege escalation of an institutional administrator\naccount.
Sven Vetsch discovered a cross-site scripting vulnerability via the\nresume fields.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.0.4-4+lenny4.
\nThe oldstable distribution (etch) does not contain mahara.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your mahara packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt has been discovered that proftpd-dfsg, a virtual-hosting FTP daemon,\ndoes not properly handle a '\\0' character in a domain name in the\nSubject Alternative Name field of an X.509 client certificate, when the\ndNSNameRequired TLS option is enabled.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.3.1-17lenny4.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.3.0-19etch3.
\nBinaries for the amd64 architecture will be released once they are\navailable.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.3.2a-2.
\nWe recommend that you upgrade your proftpd-dfsg packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the TYPO3 web\ncontent management framework. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nThe Backend subcomponent allows remote authenticated users to\n determine an encryption key via crafted input to a form field.
Multiple cross-site scripting (XSS) vulnerabilities in the\n Backend subcomponent allow remote authenticated users to inject\n arbitrary web script or HTML.
The Backend subcomponent allows remote authenticated users to\n place arbitrary web sites in TYPO3 backend framesets via\n crafted parameters.
The Backend subcomponent, when the DAM extension or ftp upload\n is enabled, allows remote authenticated users to execute\n arbitrary commands via shell metacharacters in a filename.
SQL injection vulnerability in the traditional frontend editing\n feature in the Frontend Editing subcomponent allows remote\n authenticated users to execute arbitrary SQL commands.
Cross-site scripting (XSS) vulnerability allows remote\n attackers to inject arbitrary web script.
Cross-site scripting (XSS) vulnerability in the Frontend Login Box\n (aka felogin) subcomponent allows remote attackers to inject\n arbitrary web script or HTML.
The Install Tool subcomponent allows remote attackers to gain access\n by using only the password's md5 hash as a credential.
Cross-site scripting (XSS) vulnerability in the Install Tool\n subcomponent allows remote attackers to inject arbitrary web script\n or HTML.
For the old stable distribution (etch), these problems have been fixed\nin version 4.0.2+debian-9.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4.2.5-1+lenny2.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 4.2.10-1.
\nWe recommend that you upgrade your typo3-src package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nNotice: Debian 5.0.4, the next point release of Debian 'lenny', will\ninclude a new default value for the mmap_min_addr tunable. This\nchange will add an additional safeguard against a class of security\nvulnerabilities known as \"NULL pointer dereference\" vulnerabilities,\nbut it will need to be overridden when using certain applications.\nAdditional information about this change, including instructions for\nmaking this change locally in advance of 5.0.4 (recommended), can be\nfound at:\nhttps://wiki.debian.org/mmap_min_addr.
\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service, sensitive memory leak or privilege\nescalation. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nEric Dumazet reported an instance of uninitialized kernel memory\n in the network packet scheduler. Local users may be able to\n exploit this issue to read the contents of sensitive kernel\n memory.
Linus Torvalds provided a change to the get_random_int() function\n to increase its randomness.
Earl Chew discovered a NULL pointer dereference issue in the\n pipe_rdwr_open function which can be used by local users to gain\n elevated privileges.
Jiri Pirko discovered a typo in the initialization of a structure\n in the netlink subsystem that may allow local users to gain access\n to sensitive kernel memory.
Ben Hutchings discovered an issue in the DRM manager for ATI Rage\n 128 graphics adapters. Local users may be able to exploit this\n vulnerability to cause a denial of service (NULL pointer\n dereference).
Tomoki Sekiyama discovered a deadlock condition in the UNIX domain\n socket implementation. Local users can exploit this vulnerability\n to cause a denial of service (system hang).
David Wagner reported an overflow in the KVM subsystem on i386\n systems. This issue is exploitable by local users with access to\n the /dev/kvm device file.
For the stable distribution (lenny), this problem has been fixed in\nversion 2.6.26-19lenny2.
\nFor the oldstable distribution (etch), these problems, where\napplicable, will be fixed in updates to linux-2.6 and linux-2.6.24.
\nWe recommend that you upgrade your linux-2.6 and user-mode-linux\npackages.
\nNote: Debian carefully tracks all known security issues across every\nlinux kernel package in all releases under active security support.\nHowever, given the high frequency at which low-severity security\nissues are discovered in the kernel and the resource requirements of\ndoing an update, updates for lower priority issues will normally not\nbe released for all kernels at the same time. Rather, they will be\nreleased in a staggered or \"leap-frog\" fashion.
\nThe following matrix lists additional source packages that were\nrebuilt for compatibility with or to take advantage of this update:
\n| \u00a0 | Debian 5.0 (lenny) |
|---|---|
| user-mode-linux | 2.6.26-1um-2+19lenny2 |
MD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service, sensitive memory leak or privilege\nescalation. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nMichael Buesch noticed a typing issue in the eisa-eeprom driver\n for the hppa architecture. Local users could exploit this issue to\n gain access to restricted memory.
Ulrich Drepper noticed an issue in the do_sigalstack routine on\n 64-bit systems. This issue allows local users to gain access to\n potentially sensitive memory on the kernel stack.
Eric Dumazet discovered an issue in the execve path, where the\n clear_child_tid variable was not being properly cleared. Local\n users could exploit this issue to cause a denial of service\n (memory corruption).
Neil Brown discovered an issue in the sysfs interface to md\n devices. When md arrays are not active, local users can exploit\n this vulnerability to cause a denial of service (oops).
Mark Smith discovered a memory leak in the appletalk\n implementation. When the appletalk and ipddp modules are loaded,\n but no ipddp\"N\" device is found, remote attackers can cause a\n denial of service by consuming large amounts of system memory.
Loic Minier discovered an issue in the eCryptfs filesystem. A\n local user can cause a denial of service (kernel oops) by causing\n a dentry value to go negative.
Arjan van de Ven discovered an issue in the AX.25 protocol\n implementation. A specially crafted call to setsockopt() can\n result in a denial of service (kernel oops).
Jan Beulich discovered the existence of a sensitive kernel memory\n leak. Systems running the 'amd64' kernel do not properly sanitize\n registers for 32-bit processes.
Jiri Slaby fixed a sensitive memory leak issue in the ANSI/IEEE\n 802.2 LLC implementation. This is not exploitable in the Debian\n lenny kernel as root privileges are required to exploit this\n issue.
Eric Dumazet fixed several sensitive memory leaks in the IrDA,\n X.25 PLP (Rose), NET/ROM, Acorn Econet/AUN, and Controller Area\n Network (CAN) implementations. Local users can exploit these\n issues to gain access to kernel memory.
Eric Dumazet reported an instance of uninitialized kernel memory\n in the network packet scheduler. Local users may be able to\n exploit this issue to read the contents of sensitive kernel\n memory.\n
Linus Torvalds provided a change to the get_random_int() function\n to increase its randomness.
Eric Paris discovered an issue with the NFSv4 server\n implementation. When an O_EXCL create fails, files may be left\n with corrupted permissions, possibly granting unintentional\n privileges to other local users.
Earl Chew discovered a NULL pointer dereference issue in the\n pipe_rdwr_open function which can be used by local users to gain\n elevated privileges.
Jiri Pirko discovered a typo in the initialization of a structure\n in the netlink subsystem that may allow local users to gain access\n to sensitive kernel memory.
Alistair Strachan reported an issue in the r8169 driver. Remote\n users can cause a denial of service (IOMMU space exhaustion and\n system crash) by transmitting a large amount of jumbo frames.
Ben Hutchings discovered an issue in the DRM manager for ATI Rage\n 128 graphics adapters. Local users may be able to exploit this\n vulnerability to cause a denial of service (NULL pointer\n dereference).
Tomoki Sekiyama discovered a deadlock condition in the UNIX domain\n socket implementation. Local users can exploit this vulnerability\n to cause a denial of service (system hang).
For the oldstable distribution (etch), this problem has been fixed in\nversion 2.6.24-6~etchnhalf.9etch1.
\nWe recommend that you upgrade your linux-2.6.24 packages.
\nNote: Debian 'etch' includes linux kernel packages based upon both the\n2.6.18 and 2.6.24 linux releases. All known security issues are\ncarefully tracked against both packages and both packages will receive\nsecurity updates until security support for Debian 'etch'\nconcludes. However, given the high frequency at which low-severity\nsecurity issues are discovered in the kernel and the resource\nrequirements of doing an update, lower severity 2.6.18 and 2.6.24\nupdates will typically release in a staggered or \"leap-frog\" fashion.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the Linux kernel that\nmay lead to a denial of service, sensitive memory leak or privilege\nescalation. The Common Vulnerabilities and Exposures project\nidentifies the following problems:
\nSolar Designer discovered a missing capability check in the\n z90crypt driver or s390 systems. This vulnerability may allow\n a local user to gain elevated privileges.
Arjan van de Ven discovered an issue in the AX.25 protocol\n implementation. A specially crafted call to setsockopt() can\n result in a denial of service (kernel oops).
Jiri Slaby fixed a sensitive memory leak issue in the ANSI/IEEE\n 802.2 LLC implementation. This is not exploitable in the Debian\n lenny kernel as root privileges are required to exploit this\n issue.
Eric Dumazet fixed several sensitive memory leaks in the IrDA,\n X.25 PLP (Rose), NET/ROM, Acorn Econet/AUN, and Controller Area\n Network (CAN) implementations. Local users can exploit these\n issues to gain access to kernel memory.
Eric Dumazet reported an instance of uninitialized kernel memory\n in the network packet scheduler. Local users may be able to\n exploit this issue to read the contents of sensitive kernel\n memory.
Linus Torvalds provided a change to the get_random_int() function\n to increase its randomness.
Eric Paris discovered an issue with the NFSv4 server\n implementation. When an O_EXCL create fails, files may be left\n with corrupted permissions, possibly granting unintentional\n privileges to other local users.
Earl Chew discovered a NULL pointer dereference issue in the\n pipe_rdwr_open function which can be used by local users to gain\n elevated privileges.
Jiri Pirko discovered a typo in the initialization of a structure\n in the netlink subsystem that may allow local users to gain access\n to sensitive kernel memory.
Tomoki Sekiyama discovered a deadlock condition in the UNIX domain\n socket implementation. Local users can exploit this vulnerability\n to cause a denial of service (system hang).
For the oldstable distribution (etch), this problem has been fixed in\nversion 2.6.18.dfsg.1-26etch1.
\nWe recommend that you upgrade your linux-2.6, fai-kernels, and\nuser-mode-linux packages.
\nNote: Debian 'etch' includes linux kernel packages based upon both the\n2.6.18 and 2.6.24 linux releases. All known security issues are\ncarefully tracked against both packages and both packages will receive\nsecurity updates until security support for Debian 'etch'\nconcludes. However, given the high frequency at which low-severity\nsecurity issues are discovered in the kernel and the resource\nrequirements of doing an update, lower severity 2.6.18 and 2.6.24\nupdates will typically release in a staggered or \"leap-frog\" fashion.
\nThe following matrix lists additional source packages that were rebuilt for\ncompatibility with or to take advantage of this update:
\n| \u00a0 | Debian 4.0 (etch) |
|---|---|
| fai-kernels | 1.17+etch.26etch1 |
| user-mode-linux | 2.6.18-1um-2etch.26etch1 |
MD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in drupal6, a fully-featured\ncontent management framework. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nGerhard Killesreiter discovered a flaw in the way user signatures are\nhandled. It is possible for a user to inject arbitrary code via a\ncrafted user signature. (SA-CORE-2009-007)
Mark Piper, Sven Herrmann and Brandon Knight discovered a cross-site\nscripting issue in the forum module, which could be exploited via the\ntid parameter. (SA-CORE-2009-007)
Sumit Datta discovered that certain drupal6 pages leak sensitive\ninformation such as user credentials. (SA-CORE-2009-007)
Several design flaws in the OpenID module have been fixed, which could\nlead to cross-site request forgeries or privilege escalations. Also, the\nfile upload function does not process all extensions properly leading\nto the possible execution of arbitrary code.\n(SA-CORE-2009-008)
\nThe oldstable distribution (etch) does not contain drupal6.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 6.6-3lenny3.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 6.14-1.
\nWe recommend that you upgrade your drupal6 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the NetScape Portable\nRuntime Library, which may lead to the execution of arbitrary code. The\nCommon Vulnerabilities and Exposures project identifies the following\nproblems:
\nA programming error in the string handling code may lead to the\n execution of arbitrary code.
An integer overflow in the Base64 decoding functions may lead to\n the execution of arbitrary code.
The old stable distribution (etch) doesn't contain nspr.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4.7.1-5.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 4.8.2-1.
\nWe recommend that you upgrade your NSPR packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that incorrect pointer handling in the purple library,\nan internal component of the multi-protocol instant messaging client\nPidgin, could lead to denial of service or the execution of arbitrary\ncode through malformed contact requests.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.4.3-4lenny5.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.6.3-1.
\nWe recommend that you upgrade your pidgin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nAaron Siegel discovered that the web interface of cups, the Common UNIX\nPrinting System, is prone to cross-site scripting attacks.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.2.7-4+etch9.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.3.8-1+lenny7.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your cups packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nA design flaw has been found in the TLS and SSL protocol that allows\nan attacker to inject arbitrary content at the beginning of a TLS/SSL\nconnection. The attack is related to the way how TLS and SSL handle\nsession renegotiations. CVE-2009-3555 has been assigned to this\nvulnerability.
\nAs a partial mitigation against this attack, this apache2 update\ndisables client-initiated renegotiations. This should fix the\nvulnerability for the majority of Apache configurations in use.
\nNOTE: This is not a complete fix for the problem. The attack is\nstill possible in configurations where the server initiates the\nrenegotiation. This is the case for the following configurations\n(the information in the changelog of the updated packages is\nslightly inaccurate):
\nAs a workaround, you may rearrange your configuration in a way that\nSSLVerifyClient and SSLCipherSuite are only used on the server or\nvirtual host level.
\nA complete fix for the problem will require a protocol change. Further\ninformation will be included in a separate announcement about this\nissue.
\nIn addition, this update fixes the following issues in Apache's\nmod_proxy_ftp:
\nInsufficient input validation in the mod_proxy_ftp module allowed remote FTP\nservers to cause a denial of service (NULL pointer dereference and child\nprocess crash) via a malformed reply to an EPSV command.
Insufficient input validation in the mod_proxy_ftp module allowed remote\nauthenticated attackers to bypass intended access restrictions and send\narbitrary FTP commands to an FTP server.
The oldstable distribution (etch), these problems have been fixed in\nversion 2.2.3-4+etch11.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.2.9-10+lenny6. This version also includes some non-security\nbug fixes that were scheduled for inclusion in the next stable point\nrelease (Debian 5.0.4).
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed in version 2.2.14-2.
\nThis advisory also provides updated apache2-mpm-itk packages which\nhave been recompiled against the new apache2 packages.
\nUpdated apache2-mpm-itk packages for the armel architecture are not\nincluded yet. They will be released as soon as they become available.
\nWe recommend that you upgrade your apache2 and apache2-mpm-itk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Kaminsky and Moxie Marlinspike discovered that gnutls, an implementation of\nthe TLS/SSL protocol, does not properly handle a '\\0' character in a domain name\nin the subject's Common Name or Subject Alternative Name (SAN) field of an X.509\ncertificate, which allows man-in-the-middle attackers to spoof arbitrary SSL\nservers via a crafted certificate issued by a legitimate Certification\nAuthority. (CVE-2009-2730)
\nIn addition, with this update, certificates with MD2 hash signatures are no\nlonger accepted since they're no longer considered cryptograhically secure. It\nonly affects the oldstable distribution (etch).(CVE-2009-2409)
\nFor the oldstable distribution (etch), these problems have been fixed in version\n1.4.4-3+etch5 for gnutls13.
\nFor the stable distribution (lenny), these problems have been fixed in version\n2.4.2-6+lenny2 for gnutls26.
\nFor the testing distribution (squeeze), and the unstable distribution (sid),\nthese problems have been fixed in version 2.8.3-1 for gnutls26.
\nWe recommend that you upgrade your gnutls13/gnutls26 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in libgd2, a library for\nprogrammatic graphics creation and manipulation. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nKees Cook discovered a buffer overflow in libgd2's font renderer. An\n attacker could cause denial of service (application crash) and\n possibly execute arbitrary code via a crafted string with a JIS\n encoded font. This issue only affects the oldstable distribution\n (etch).
Tomas Hoger discovered a boundary error in the \"_gdGetColors()\"\n function. An attacker could conduct a buffer overflow or buffer\n over-read attacks via a crafted GD file.
For the oldstable distribution (etch), these problems have been fixed in\nversion 2.0.33-5.2etch2.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.0.36~rc1~dfsg-3+lenny1.
\nFor the upcoming stable distribution (squeeze) and the unstable\ndistribution (sid), these problems have been fixed in version\n2.0.36~rc1~dfsg-3.1.
\nWe recommend that you upgrade your libgd2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that gforge, collaborative development tool, is prone\nto a cross-site scripting attack via the helpname parameter. Beside\nfixing this issue, the update also introduces some additional input\nsanitising. However, there are no known attack vectors.
\nThe oldstable distribution (etch), these problems have been fixed in\nversion 4.5.14-22etch12.
\nFor the stable distribution (lenny), these problem have been fixed in\nversion 4.7~rc2-7lenny2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 4.8.1-3.
\nWe recommend that you upgrade your gforge packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that php-mail, a PHP PEAR module for sending email,\nhas insufficient input sanitising, which might be used to obtain\nsensitive data from the system that uses php-mail.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.1.6-2+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.1.14-1+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.1.14-2.
\nWe recommend that you upgrade your php-mail packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLucas Adamski, Matthew Gregan, David Keeler, and Dan Kaminsky discovered\nthat libvorbis, a library for the Vorbis general-purpose compressed\naudio codec, did not correctly handle certain malformed ogg files. An\nattacher could cause a denial of service (memory corruption and\napplication crash) or possibly execute arbitrary code via a crafted .ogg\nfile.
\nFor the oldstable distribution (etch), these problems have been fixed in\nversion 1.1.2.dfsg-1.4+etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.2.0.dfsg-3.1+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 1.2.3-1
\nWe recommend that you upgrade your libvorbis packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the PHP 5\nhypertext preprocessor. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nThe following issues have been fixed in both the stable (lenny)\nand the oldstable (etch) distributions:\n
The exif module did not properly handle malformed jpeg files,\n allowing an attacker to cause a segfault, resulting in a denial\n of service.\n
The php_openssl_apply_verification_policy() function did not\n properly perform certificate validation.
Bogdan Calin discovered that a remote attacker could cause a denial\n of service by uploading a large number of files in using multipart/\n form-data requests, causing the creation of a large number of\n temporary files.
\nTo address this issue, the max_file_uploads option introduced in PHP\n 5.3.1 has been backported. This option limits the maximum number of\n files uploaded per request. The default value for this new option is\n 50. See NEWS.Debian for more information.
The following issue has been fixed in the stable (lenny) distribution:
\nA flaw in the ini_restore() function could lead to a memory\n disclosure, possibly leading to the disclosure of sensitive data.
In the oldstable (etch) distribution, this update also fixes a regression\nintroduced by the fix for\nCVE-2008-5658\nin DSA-1789-1 (bug #527560).
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 5.2.6.dfsg.1-1+lenny4.
\nThe oldstable distribution (etch), these problems have been fixed in\nversion 5.2.0+dfsg-8+etch16.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed in version 5.2.11.dfsg.1-2.
\nWe recommend that you upgrade your php5 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral integer overflows, buffer overflows and memory allocation\nerrors were discovered in the Poppler PDF rendering library, which may\nlead to denial of service or the execution of arbitrary code if a user\nis tricked into opening a malformed PDF document.
\nAn update for the old stable distribution (etch) will be issued soon as\nversion 0.4.5-5.1etch4.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.8.7-3.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your poppler packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Wireshark\nnetwork traffic analyzer, which may lead to the execution of arbitrary\ncode or denial of service. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nA NULL pointer dereference was found in the RADIUS dissector.
A NULL pointer dereference was found in the DCERP/NT dissector.
An integer overflow was discovered in the ERF parser.
This update also includes fixes for three minor issues\n(CVE-2008-1829,\nCVE-2009-2562,\nCVE-2009-3241),\nwhich were scheduled for the next stable point update. Also\nCVE-2009-1268\nwas fixed for Etch. Since this security update was issued prior to the release\nof the point update, the fixes were included.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 0.99.4-5.etch.4.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.2-3+lenny7.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.2.3-1.
\nWe recommend that you upgrade your Wireshark packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that OpenLDAP, a free implementation of the Lightweight\nDirectory Access Protocol, when OpenSSL is used, does not properly handle a '\\0'\ncharacter in a domain name in the subject's Common Name (CN) field of an X.509\ncertificate, which allows man-in-the-middle attackers to spoof arbitrary SSL\nservers via a crafted certificate issued by a legitimate Certification Authority.
\nFor the oldstable distribution (etch), this problem has been fixed in version\n2.3.30-5+etch3 for openldap2.3.
\nFor the stable distribution (lenny), this problem has been fixed in version\n2.4.11-1+lenny1 for openldap.
\nFor the testing distribution (squeeze), and the unstable distribution (sid),\nthis problem has been fixed in version 2.4.17-2.1 for openldap.
\nWe recommend that you upgrade your openldap2.3/openldap packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMikal Gule discovered that request-tracker, an extensible trouble-ticket\ntracking system, is prone to an attack, where an attacker with access\nto the same domain can hijack a user's RT session.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 3.6.1-4+etch1 of request-tracker3.6 and version 3.4.5-2+etch1\nof request-tracker3.4.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 3.6.7-5+lenny3.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.6.9-2.
\nWe recommend that you upgrade your request-tracker packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSylvain Beucler discovered that gforge, a collaborative development\ntool, is prone to a symlink attack, which allows local users to perform\na denial of service attack by overwriting arbitrary files.
\nThe oldstable distribution (etch), this problem has been fixed in\nversion 4.5.14-22etch13.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 4.7~rc2-7lenny3.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 4.8.2-1.
\nWe recommend that you upgrade your gforge packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that belpic, the belgian eID PKCS11 library, does not\nproperly check the result of an OpenSSL function for verifying\ncryptographic signatures, which could be used to bypass the certificate\nvalidation.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.5.9-7.etch.1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.6.0-6, which was already included in the lenny release.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 2.6.0-6.
\nWe recommend that you upgrade your belpic packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMatt Elder discovered that Shibboleth, a federated web single sign-on\nsystem is vulnerable to script injection through redirection URLs. More\ndetails can be found in the Shibboleth advisory at\nhttp://shibboleth.internet2.edu/secadv/secadv_20091104.txt.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 1.3f.dfsg1-2+etch2 of shibboleth-sp.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.3.1.dfsg1-3+lenny2 of shibboleth-sp, version 2.0.dfsg1-4+lenny2\nof shibboleth-sp2 and version 2.0-2+lenny2 of opensaml2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.3+dfsg-1 of shibboleth-sp2, version 2.3-1 of opensaml2 and\nversion 1.3.1-1 of xmltooling.
\nWe recommend that you upgrade your Shibboleth packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nRobin Park and Dmitri Vinokurov discovered that the daemon component of\nthe ntp package, a reference implementation of the NTP protocol, is\nnot properly reacting to certain incoming packets.
\nAn unexpected NTP mode 7 packet (MODE_PRIVATE) with spoofed IP data can lead\nntpd to reply with a mode 7 response to the spoofed address. This may result\nin the service playing packet ping-pong with other ntp servers or even itself\nwhich causes CPU usage and excessive disk use due to logging. An attacker\ncan use this to conduct denial of service attacks.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1:4.2.2.p4+dfsg-2etch4.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1:4.2.4p4+dfsg-8lenny3.
\nFor the testing (squeeze) and unstable (sid) distribution, this problem\nwill be fixed soon.
\nWe recommend that you upgrade your ntp packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that php-net-ping, a PHP PEAR module to execute ping\nindependently of the Operating System, performs insufficient input\nsanitising, which might be used to inject arguments (no CVE yet) or\nexecute arbitrary commands (CVE-2009-4024) on a system that uses\nphp-net-ping.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.4.2-1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.4.2-1+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed\nsoon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.4.2-1.1.
\nWe recommend that you upgrade your php-net-ping packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in WebKit, a Web content engine\nlibrary for Gtk+. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nArray index error in the insertItemBefore method in WebKit, allows remote\nattackers to execute arbitrary code via a document with a SVGPathList data\nstructure containing a negative index in the SVGTransformList, SVGStringList,\nSVGNumberList, SVGPathSegList, SVGPointList, or SVGLengthList SVGList object,\nwhich triggers memory corruption.
The JavaScript garbage collector in WebKit does not properly handle allocation\nfailures, which allows remote attackers to execute arbitrary code or cause a\ndenial of service (memory corruption and application crash) via a crafted HTML\ndocument that triggers write access to an \"offset of a NULL pointer.\"
Use-after-free vulnerability in WebKit, allows remote attackers to execute\narbitrary code or cause a denial of service (memory corruption and application\ncrash) by setting an unspecified property of an HTML tag that causes child\nelements to be freed and later accessed when an HTML error occurs, related to\n\"recursion in certain DOM event handlers.\"
WebKit does not initialize a pointer during handling of a Cascading Style Sheets\n(CSS) attr function call with a large numerical argument, which allows remote\nattackers to execute arbitrary code or cause a denial of service (memory\ncorruption and application crash) via a crafted HTML document.
WebKit does not properly initialize memory for Attr DOM objects, which allows\nremote attackers to execute arbitrary code or cause a denial of service\n(application crash) via a crafted HTML document.
WebKit does not prevent remote loading of local Java applets, which allows\nremote attackers to execute arbitrary code, gain privileges, or obtain sensitive\ninformation via an APPLET or OBJECT element.
WebKit do not properly handle numeric character references, which allows remote\nattackers to execute arbitrary code or cause a denial of service (memory\ncorruption and application crash) via a crafted HTML document.
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit allows\nuser-assisted remote attackers to inject arbitrary web script or HTML, and read\nlocal files, via vectors related to the improper escaping of HTML attributes.
WebKit allows remote attackers to spoof the browser's display of the host name,\nsecurity indicators, and unspecified other UI elements via a custom cursor in\nconjunction with a modified CSS3 hotspot property.
CRLF injection vulnerability in WebKit allows remote attackers to inject HTTP\nheaders and bypass the Same Origin Policy via a crafted HTML document, related\nto cross-site scripting (XSS) attacks that depend on communication with\narbitrary web sites on the same server through use of XMLHttpRequest without a\nHost header.
Cross-site scripting (XSS) vulnerability in WebKit allows remote attackers to\ninject arbitrary web script or HTML via vectors involving access to frame\ncontents after completion of a page transition.
WebKit allows remote attackers to read images from arbitrary web sites via a\nCANVAS element with an SVG image, related to a \"cross-site image capture issue.\"
WebKit does not properly handle redirects, which allows remote attackers to read\nimages from arbitrary web sites via vectors involving a CANVAS element and\nredirection, related to a \"cross-site image capture issue.\"
WebKit does not prevent web sites from loading third-party content into a\nsubframe, which allows remote attackers to bypass the Same Origin Policy and\nconduct \"clickjacking\" attacks via a crafted HTML document.
Cross-site scripting (XSS) vulnerability in WebKit allows remote attackers to\ninject arbitrary web script or HTML via an event handler that triggers script\nexecution in the context of the next loaded document.
WebKit allows remote attackers to cause a denial of service (memory consumption\nor device reset) via a web page containing an HTMLSelectElement object with a\nlarge length attribute, related to the length property of a Select object.
For the stable distribution (lenny), these problems has been fixed in\nversion 1.0.1-4+lenny2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 1.1.16-1.
\nWe recommend that you upgrade your webkit package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that firefox-sage, a lightweight RSS and Atom feed\nreader for Firefox, does not sanitise the RSS feed information\ncorrectly, which makes it prone to a cross-site scripting and a\ncross-domain scripting attack.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.3.6-4etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.4.2-0.1+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.4.3-3.
\nWe recommend that you upgrade your firefox-sage packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in asterisk, an Open Source\nPBX and telephony toolkit. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nIt is possible to determine valid login names via probing, due to the\nIAX2 response from asterisk (AST-2009-001).
It is possible to determine a valid SIP username, when Digest\nauthentication and authalwaysreject are enabled (AST-2009-003).
It is possible to determine a valid SIP username via multiple crafted\nREGISTER messages (AST-2009-008).
It was discovered that asterisk contains an obsolete copy of the\nPrototype JavaScript framework, which is vulnerable to several security\nissues. This copy is unused and now removed from asterisk\n(AST-2009-009).
It was discovered that it is possible to perform a denial of service\nattack via RTP comfort noise payload with a long data length\n(AST-2009-010).
The current version in oldstable is not supported by upstream anymore\nand is affected by several security issues. Backporting fixes for these\nand any future issues has become unfeasible and therefore we need to\ndrop our security support for the version in oldstable. We recommend\nthat all asterisk users upgrade to the stable distribution (lenny).
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1:1.4.21.2~dfsg-3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 1:1.6.2.0~rc7-1.
\nWe recommend that you upgrade your asterisk packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJan Lieskovsky discovered an error in expat, an XML parsing C library,\nwhen parsing certain UTF-8 sequences, which can be exploited to crash an\napplication using the library.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.95.8-3.4+etch2.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0.1-4+lenny2.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be in version 2.0.1-6.
\nThe builds for the mipsel architecture for the oldstable distribution\nare not included yet. They will be released when they become available.
\nWe recommend that you upgrade your expat packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in cacti, a frontend to rrdtool\nfor monitoring systems and services. The Common Vulnerabilities and\nExposures project identifies the following problems:
\nIt was discovered that cacti is prone to a denial of service via the\ngraph_height, graph_width, graph_start and graph_end parameters.\nThis issue only affects the oldstable (etch) version of cacti.
It was discovered that cacti is prone to several cross-site scripting\nattacks via different vectors.
It has been discovered that cacti allows authenticated administrator\nusers to gain access to the host system by executing arbitrary commands\nvia the \"Data Input Method\" for the \"Linux - Get Memory Usage\" setting.
\nThere is no fix for this issue at this stage. Upstream will implement a\nwhitelist policy to only allow certain \"safe\" commands. For the moment,\nwe recommend that such access is only given to trusted users and that\nthe options \"Data Input\" and \"User Administration\" are otherwise\ndeactivated.
For the oldstable distribution (etch), these problems have been fixed in\nversion 0.8.6i-3.6.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.8.7e-1.1.
\nWe recommend that you upgrade your cacti packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that network-manager-applet, a network management\nframework, lacks some dbus restriction rules, which allows local users\nto obtain sensitive information.
\nIf you have locally modified the /etc/dbus-1/system.d/nm-applet.conf\nfile, then please make sure that you merge the changes from this fix\nwhen asked during upgrade.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.6.4-6+etch1 of network-manager.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.6.6-4+lenny1 of network-manager-applet.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 0.7.0.99-1 of\nnetwork-manager-applet.
\nWe recommend that you upgrade your network-manager and\nnetwork-manager-applet packages accordingly.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in Xulrunner, a\nruntime environment for XUL applications, such as the Iceweasel web\nbrowser. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nDavid James discovered that the window.opener property allows Chrome\n privilege escalation.
Jordi Chanel discovered a spoofing vulnerability of the URL location bar\n using the document.location property.
Jonathan Morgan discovered that the icon indicating a secure connection\n could be spoofed through the document.location property.
Takehiro Takahashi discovered that the NTLM implementation is vulnerable\n to reflection attacks.
Jesse Ruderman discovered a crash in the layout engine, which might allow\n the execution of arbitrary code.
Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel and Olli Pettay\n discovered crashes in the layout engine, which might allow the execution\n of arbitrary code.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.9.0.16-1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.9.1.6-1.
\nWe recommend that you upgrade your xulrunner packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that aria2, a high speed download utility, is prone\nto a buffer overflow in the DHT routing code, which might lead to the\nexecution of arbitrary code.
\nThe oldstable distribution (etch) is not affected by this problem.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.14.0-1+lenny1. Binaries for powerpc, arm, ia64 and hppa will\nbe provided once they are available.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 1.2.0-1.
\nWe recommend that you upgrade your aria2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that ltdl, a system-independent dlopen wrapper for\nGNU libtool, can be tricked to load and run modules from an arbitrary\ndirectory, which might be used to execute arbitrary code with the\nprivileges of the user running an application that uses libltdl.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.5.22-4+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.5.26-4+lenny1.
\nFor the testing distribution (squeeze) and unstable distribution (sid),\nthis problem has been fixed in 2.2.6b-1.
\nWe recommend that you upgrade your libtool packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that ganeti, a virtual server cluster manager, does\nnot validate the path of scripts passed as arguments to certain\ncommands, which allows local or remote users (via the web interface in\nversions 2.x) to execute arbitrary commands on a host acting as a\ncluster master.
\nThe oldstable distribution (etch) does not include ganeti.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.2.6-3+lenny2.
\nFor the testing distribution (squeeze), this problem will be fixed\nin version 2.0.5-1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.0.5-1.
\nWe recommend that you upgrade your ganeti packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that acpid, the Advanced Configuration and Power\nInterface event daemon, on the oldstable distribution (etch) creates\nits log file with weak permissions, which might expose sensitive\ninformation or might be abused by a local user to consume all free disk\nspace on the same partition of the file.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.0.4-5etch2.
\nThe stable distribution (lenny) in version 1.0.8-1lenny2 and the\nunstable distribution (sid) in version 1.0.10-5, have been updated to\nfix the weak file permissions of the log file created by older\nversions.
\nWe recommend that you upgrade your acpid packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMichael Sinatra discovered that the DNS resolver component in BIND\ndoes not properly check DNS records contained in additional sections\nof DNS responses, leading to a cache poisoning vulnerability. This\nvulnerability is only present in resolvers which have been configured\nwith DNSSEC trust anchors, which is still rare.
\nNote that this update contains an internal ABI change, which means\nthat all BIND-related packages (bind9, dnsutils and the library\npackages) must be updated at the same time (preferably using \"apt-get\nupdate\" and \"apt-get upgrade\"). In the unlikely event that you have\ncompiled your own software against libdns, you must recompile this\nprograms, too.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 9.3.4-2etch6.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 9.5.1.dfsg.P3-1+lenny1.
\nFor the unstable distribution (sid) and the testing distribution\n(squeeze), this problem has been fixed in version 9.6.1.dfsg.P2-1.
\nWe recommend that you upgrade your bind9 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in kvm, a full virtualization system.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered an Integer overflow in the kvm_dev_ioctl_get_supported_cpuid\nfunction. This allows local users to have an unspecified impact via a\nKVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.
It was discovered that the handle_dr function in the KVM subsystem does not\nproperly verify the Current Privilege Level (CPL) before accessing a debug\nregister, which allows guest OS users to cause a denial of service (trap) on the\nhost OS via a crafted application.
It was discovered that the do_insn_fetch function in the x86 emulator in the KVM\nsubsystem tries to interpret instructions that contain too many bytes to be\nvalid, which allows guest OS users to cause a denial of service (increased\nscheduling latency) on the host OS via unspecified manipulations related to SMP\nsupport.
For the stable distribution (lenny), these problems have been fixed in version\n72+dfsg-5~lenny4.
\nFor the testing distribution (squeeze), and the unstable distribution (sid),\nthese problems will be fixed soon.
\nWe recommend that you upgrade your kvm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Unbound, a DNS resolver, does not properly\ncheck cryptographic signatures on NSEC3 records. As a result, zones\nsigned with the NSEC3 variant of DNSSEC lose their cryptographic\nprotection. (An attacker would still have to carry out an ordinary\ncache poisoning attack to add bad data to the cache.)
\nThe old stable distribution (etch) does not contain an unbound\npackage.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.0.2-1+lenny1.
\nFor the unstable distribution (sid) and the testing distribution\n(squeeze), this problem has been fixed in version 1.3.4-1.
\nWe recommend that you upgrade your unbound package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in PostgreSQL, a database\nserver. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nIt was discovered that PostgreSQL did not properly verify the Common\nName attribute in X.509 certificates, enabling attackers to bypass the\n(optional) TLS protection on client-server connections, by relying on\na certificate from a trusted CA which contains an embedded NUL byte in\nthe Common Name (CVE-2009-4034).
\nAuthenticated database users could elevate their privileges by\ncreating specially-crafted index functions (CVE-2009-4136).
\nThe following matrix shows fixed source package versions for the\nrespective distributions.
\n| \u00a0 | oldstable/etch | stable/lenny | testing/unstable |
|---|---|---|---|
| postgresql-7.4 | 7.4.27-0etch1 | \u00a0 | \u00a0 |
| postgresql-8.1 | 8.1.19-0etch1 | \u00a0 | \u00a0 |
| postgresql-8.3 | \u00a0 | 8.3.9-0lenny1 | 8.3.9-1 |
| postgresql-8.4 | \u00a0 | \u00a0 | 8.4.2-1 |
In addition to these security fixes, the updates contain reliability\nimprovements and fix other defects.
\nWe recommend that you upgrade your PostgreSQL packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that phpLDAPadmin, a web based interface for administering\nLDAP servers, doesn't sanitize an internal variable, which allows remote\nattackers to include and execute arbitrary local files.
\nThe oldstable distribution (etch) is not affected by this problem.
\nFor the stable distribution (lenny), this problem has been fixed in version\n1.1.0.5-6+lenny1.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in version\n1.1.0.7-1.1
\nWe recommend that you upgrade your phpldapadmin package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in horde3, the horde web application\nframework. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nIt has been discovered that horde3 is prone to cross-site scripting\nattacks via crafted number preferences or inline MIME text parts when\nusing text/plain as MIME type.\nFor lenny this issue was already fixed, but as an additional security\nprecaution, the display of inline text was disabled in the configuration\nfile.
It has been discovered that the horde3 administration interface is prone\nto cross-site scripting attacks due to the use of the PHP_SELF variable.\nThis issue can only be exploited by authenticated administrators.
It has been discovered that horde3 is prone to several cross-site\nscripting attacks via crafted data:text/html values in HTML messages.
For the stable distribution (lenny), these problems have been fixed in\nversion 3.2.2+debian0-2+lenny2.
\nFor the oldstable distribution (etch), these problems have been fixed in\nversion 3.1.3-4etch7.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 3.3.6+debian0-1.
\nWe recommend that you upgrade your horde3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Rosenberg discovered that Transmission, a lightwight client for\nthe Bittorrent filesharing protocol, performs insufficient sanitising\nof file names specified in .torrent files. This could lead to the\noverwrite of local files with the privileges of the user running\nTransmission if the user is tricked into opening a malicious torrent\nfile.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.22-1+lenny2.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.77-1.
\nWe recommend that you upgrade your transmission packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that pdns-recursor, the PowerDNS recursive name\nserver, contains several vulnerabilities:
\nA buffer overflow can be exploited to crash the daemon, or potentially\nexecute arbitrary code.
A cache poisoning vulnerability may allow attackers to trick the\nserver into serving incorrect DNS data.
For the oldstable distribution (etch), fixed packages will be\nprovided soon.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 3.1.7-1+lenny1.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 3.1.7.2-1.
\nWe recommend that you upgrade your pdns-recursor package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that krb5, a system for authenticating users and services on a\nnetwork, is prone to integer underflow in the AES and RC4 decryption operations of\nthe crypto library. A remote attacker can cause crashes, heap corruption, or,\nunder extraordinarily unlikely conditions, arbitrary code execution.
\nFor the old stable distribution (etch), this problem has been fixed in\nversion 1.4.4-7etch8.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.6.dfsg.4~beta1-5lenny2.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.8+dfsg~alpha1-1.
\nWe recommend that you upgrade your krb5 package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that a significant memory leak could occur in OpenSSL,\nrelated to the reinitialization of zlib. This could result in a remotely\nexploitable denial of service vulnerability when using the Apache httpd\nserver in a configuration where mod_ssl, mod_php5, and the php5-curl\nextension are loaded.
\nThe old stable distribution (etch) is not affected by this issue.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.9.8g-15+lenny6.
\nThe packages for the arm architecture are not included in this advisory.\nThey will be released as soon as they become available.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon. The issue does not seem to be\nexploitable with the apache2 package contained in squeeze/sid.
\nWe recommend that you upgrade your openssl packages. You also need to\nrestart your Apache httpd server to make sure it uses the updated\nlibraries.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTim Starling discovered that libthai, a set of Thai language support routines,\nis vulnerable of integer/heap overflow.\nThis vulnerability could allow an attacker to run arbitrary code by sending a very\nlong string.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 0.1.6-1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.1.9-4+lenny1.
\nFor the testing distribution (squeeze), and the unstable distribution (sid),\nthis problem will be fixed soon.
\nWe recommend that you upgrade your libthai package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMax Kellermann discovered a heap-based buffer overflow in the handling\nof ADPCM WAV files in libaudiofile. This flaw could result in a denial\nof service (application crash) or possibly execution of arbitrary code\nvia a crafted WAV file.
\nThe old stable distribution (etch), this problem will be fixed in\nversion 0.2.6-6+etch1.
\nThe packages for the oldstable distribution are not included in this\nadvisory. An update will be released soon.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.2.6-7+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem has been fixed in version 0.2.6-7.1.
\nWe recommend that you upgrade your audiofile packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChristoph Pleger has discovered that the GNU C Library (aka glibc) and\nits derivatives add information from the passwd.adjunct.byname map to\nentries in the passwd map, which allows local users to obtain the\nencrypted passwords of NIS accounts by calling the getpwnam function.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.3.6.ds1-13etch10 of the glibc package.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.7-18lenny2 of the glibc package.
\nFor the unstable distribution (sid) this problem has been fixed in\nversion 2.10.2-4 of the eglibc package.
\nWe recommend that you upgrade your glibc or eglibc package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been found in gzip, the GNU compression\nutilities. The Common Vulnerabilities and Exposures project identifies\nthe following problems:
\nThiemo Nagel discovered a missing input sanitation flaw in the way gzip\nused to decompress data blocks for dynamic Huffman codes, which could\nlead to the execution of arbitrary code when trying to decompress a\ncrafted archive. This issue is a reappearance of CVE-2006-4334 and only\naffects the lenny version.
Aki Helin discovered an integer underflow when decompressing files that\nare compressed using the LZW algorithm. This could lead to the execution\nof arbitrary code when trying to decompress a crafted LZW compressed\ngzip archive.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.3.12-6+lenny1.
\nFor the oldstable distribution (etch), these problems have been fixed in\nversion 1.3.5-15+etch1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed soon.
\nWe recommend that you upgrade your gzip packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in dokuwiki, a standards compliant\nsimple to use wiki.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered that an internal variable is not properly sanitized before\nbeing used to list directories. This can be exploited to list contents of\narbitrary directories.
It was discovered that the ACL Manager plugin doesn't properly check the\nadministrator permissions. This allow an attacker to introduce arbitrary ACL\nrules and thus gaining access to a closed Wiki.
It was discovered that the ACL Manager plugin doesn't have protections against\ncross-site request forgeries (CSRF). This can be exploited to change the\naccess control rules by tricking a logged in administrator into visiting\na malicious web site.
The oldstable distribution (etch) is not affected by these problems.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 0.0.20080505-4+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 0.0.20090214b-3.1.
\nWe recommend that you upgrade your dokuwiki package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that the embedded Expat copy\nin the interpreter for the Python language, does not properly process malformed or\ncrafted XML files. (CVE-2009-3560 CVE-2009-3720)\nThis vulnerability could allow an attacker to cause a denial of service while parsing\na malformed XML file.
\nIn addition, this update fixes an integer overflow in the hashlib module in python2.5.\nThis vulnerability could allow an attacker to defeat cryptographic digests. (CVE-2008-2316)\nIt only affects the oldstable distribution (etch).
\nFor the oldstable distribution (etch), these problems have been fixed in\nversion 2.4.4-3+etch3 for python2.4 and version 2.5-5+etch2 for python2.5.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 2.4.6-1+lenny1 for python2.4 and version 2.5.2-15+lenny1 for python2.5.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.5.4-3.1 for python2.5, and will migrate to the testing distribution (squeeze)\nshortly.\npython2.4 has been removed from the testing distribution (squeeze), and it will\nbe removed from the unstable distribution soon.
\nWe recommend that you upgrade your python packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in phpgroupware, a\nWeb based groupware system written in PHP. The Common Vulnerabilities\nand Exposures project identifies the following problems:
\nAn SQL injection vulnerability was found in the authentication\n module.
Multiple directory traversal vulnerabilities were found in the\n addressbook module.
The authentication module is affected by cross-site scripting.
For the stable distribution (lenny) these problems have been fixed in\nversion 0.9.16.012+dfsg-8+lenny1.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 0.9.16.012+dfsg-9.
\nWe recommend that you upgrade your phpgroupware packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nMultiple vulnerabilities have been discovered in lintian,\na Debian package checker. The following Common Vulnerabilities and\nExposures project ids have been assigned to identify them:
\nControl field names and values were not sanitised before using them\n in certain operations that could lead to directory traversals.
\nPatch systems' control files were not sanitised before using them\n in certain operations that could lead to directory traversals.
\nAn attacker could exploit these vulnerabilities to overwrite\n arbitrary files or disclose system information.
Multiple check scripts and the Lintian::Schedule module were using\n user-provided input as part of the sprintf/printf format string.
File names were not properly escaped when passing them as arguments\n to certain commands, allowing the execution of other commands as\n pipes or as a set of shell commands.
For the oldstable distribution (etch), these problems have been fixed in\nversion 1.23.28+etch1.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.24.2.1+lenny1.
\nFor the testing distribution (squeeze), these problems will be fixed\nsoon.
\nFor the unstable distribution (sid), these problems have been fixed in\nversion 2.3.2
\nWe recommend that you upgrade your lintian packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDavid Leadbeater discovered an integer underflow that could be triggered\nvia the LINKS command and can lead to a denial of service or the\nexecution of arbitrary code (CVE-2009-4016). This issue affects both,\nircd-hybrid and ircd-ratbox.
\nIt was discovered that the ratbox IRC server is prone to a denial of\nservice attack via the HELP command. The ircd-hybrid package is not\nvulnerable to this issue (CVE-2010-0300).
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1:7.2.2.dfsg.2-4+lenny1 of the ircd-hybrid package and in\nversion 2.2.8.dfsg-2+lenny1 of ircd-ratbox.
\nDue to a bug in the archive software it was not possible to release the\nfix for the oldstable distribution (etch) simultaneously. The packages\nwill be released as version 7.2.2.dfsg.2-3+etch1 once they become\navailable.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your ircd-hybrid/ircd-ratbox packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nChristoph Anton Mitterer discovered that maildrop, a mail delivery agent\nwith filtering abilities, is prone to a privilege escalation issue that\ngrants a user root group privileges.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.0.2-11+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.0.4-3+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), this problem will be fixed soon.
\nWe recommend that you upgrade your maildrop packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nJulien Cristau discovered that hybserv, a daemon running IRC services\nfor IRCD-Hybrid, is prone to a denial of service attack via the commands\noption.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.9.2-4+lenny2.
\nDue to a bug in the archive system, it is not possible to release the\nfix for the oldstable distribution (etch) simultaneously. Therefore,\netch will be fixed in version 1.9.2-4+etch1 as soon as it becomes\navailable.
\nFor the testing distribution (squeeze), this problem will be fixed soon.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.9.2-4.1.
\nWe recommend that you upgrade your hybserv packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral remote vulnerabilities have been discovered in the Wireshark\nnetwork traffic analyzer, which may lead to the execution of arbitrary\ncode or denial of service. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nA NULL pointer dereference was found in the SMB/SMB2 dissectors.
Several buffer overflows were found in the LWRES dissector.
For the stable distribution (lenny), these problems have been fixed in\nversion 1.0.2-3+lenny8.
\nFor the unstable distribution (sid) these problems have been fixed in\nversion 1.2.6-1.
\nWe recommend that you upgrade your Wireshark packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that libxerces2-java, a validating XML parser for Java,\ndoes not properly process malformed XML files.\nThis vulnerability could allow an attacker to cause a denial of service while parsing\na malformed XML file.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.8.1-1+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.9.1-2+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.9.1-4.1, and will migrate to the testing distribution (squeeze)\nshortly.
\nWe recommend that you upgrade your libxerces2-java package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that sendmail, a Mail Transport Agent, does not properly handle\na '\\0' character in a Common Name (CN) field of an X.509 certificate.
\nThis allows an attacker to spoof arbitrary SSL-based SMTP servers via a crafted server\ncertificate issued by a legitimate Certification Authority, and to bypass intended\naccess restrictions via a crafted client certificate issued by a legitimate\nCertification Authority.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 8.13.8-3+etch1
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 8.14.3-5+lenny1
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 8.14.3-9.1, and will migrate to the testing distribution (squeeze)\nshortly.
\nWe recommend that you upgrade your sendmail package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in Moodle, an online\ncourse management system. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nMultiple cross-site request forgery (CSRF) vulnerabilities have been\ndiscovered.
It has been discovered that the LAMS module is prone to the disclosure\nof user account information.
The Glossary module has an insufficient access control mechanism.
Moodle does not properly check permissions when the MNET service is\nenabled, which allows remote authenticated servers to execute arbitrary\nMNET functions.
The login/index_form.html page links to an HTTP page instead of using an\nSSL secured connection.
Moodle stores sensitive data in backup files, which might make it\npossible for attackers to obtain them.
It has been discovered that the SCORM module is prone to an SQL\ninjection.
Additionally, an SQL injection in the update_record function, a problem\nwith symbolic links and a verification problem with Glossary, database\nand forum ratings have been fixed.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1.8.2.dfsg-3+lenny3.
\nFor the oldstable distribution (etch), there are no fixed packages\navailable and it is too hard to backport many of the fixes. Therefore,\nwe recommend to upgrade to the lenny version.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 1.8.2.dfsg-6.
\nWe recommend that you upgrade your moodle packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nLi Ming discovered that lighttpd, a small and fast webserver with minimal\nmemory footprint, is vulnerable to a denial of service attack due to bad\nmemory handling. Slowly sending very small chunks of request data causes\nlighttpd to allocate new buffers for each read instead of appending to\nold ones. An attacker can abuse this behaviour to cause denial of service\nconditions due to memory exhaustion.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 1.4.13-4etch12.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.4.19-5+lenny1.
\nFor the testing (squeeze) and unstable (sid) distribution, this problem\nwill be fixed soon.
\nWe recommend that you upgrade your lighttpd packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in qt4-x11, a cross-platform\nC++ application framework.\nThe Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nArray index error in the insertItemBefore method in WebKit, as used in qt4-x11,\nallows remote attackers to execute arbitrary code.
The JavaScript garbage collector in WebKit, as used in qt4-x11 does not\nproperly handle allocation failures, which allows remote attackers to\nexecute arbitrary code or cause a denial of service (memory corruption\nand application crash) via a crafted HTML document that triggers write\naccess to an \"offset of a NULL pointer.
Use-after-free vulnerability in WebKit, as used in qt4-x11, allows remote\nattackers to execute arbitrary code or cause a denial of service (memory\ncorruption and application crash) by setting an unspecified property of\nan HTML tag that causes child elements to be freed and later accessed\nwhen an HTML error occurs.
WebKit in qt4-x11 does not initialize a pointer during handling of a\nCascading Style Sheets (CSS) attr function call with a large numerical\nargument, which allows remote attackers to execute arbitrary code or\ncause a denial of service (memory corruption and application crash) via\na crafted HTML document.
The XSL stylesheet implementation in WebKit, as used in qt4-x11 does\nnot properly handle XML external entities, which allows remote attackers to read\narbitrary files via a crafted DTD.
WebKit in qt4-x11 does not properly initialize memory for Attr DOM objects,\nwhich allows remote attackers to execute arbitrary code or cause a denial\nof service (application crash) via a crafted HTML document.
WebKit in qt4-x11 does not prevent remote loading of local Java applets,\nwhich allows remote attackers to execute arbitrary code, gain privileges, or\nobtain sensitive information via an APPLET or OBJECT element.
The XSLT functionality in WebKit, as used in qt4-x11 does not properly\nimplement the document function, which allows remote attackers to read\narbitrary local files and files from different security zones.
WebKit in qt4-x11 does not properly handle numeric character references,\nwhich allows remote attackers to execute arbitrary code or cause a\ndenial of service (memory corruption and application crash) via a\ncrafted HTML document.
qt4-x11 does not properly handle a '\\0' character in a domain name in the\nSubject Alternative Name field of an X.509 certificate, which allows\nman-in-the-middle attackers to spoof arbitrary SSL servers via a crafted\ncertificate issued by a legitimate Certification Authority.
The oldstable distribution (etch) is not affected by these problems.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 4.4.3-1+lenny1.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems have been fixed in version 4.5.3-1.
\nWe recommend that you upgrade your qt4-x11 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nDan Rosenberg discovered a race condition in FUSE, a Filesystem in USErspace.\nA local attacker, with access to use FUSE, could unmount arbitrary\nlocations, leading to a denial of service.
\nFor the oldstable distribution (etch), this problem has been fixed in\nversion 2.5.3-4.4+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 2.7.4-1.1+lenny1.
\nFor the unstable distribution (sid), this problem has been fixed in\nversion 2.8.1-1.2, and will migrate to the testing distribution (squeeze)\nshortly.
\nWe recommend that you upgrade your fuse packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nStefan Goebel discovered that the Debian version of trac-git, the Git\nadd-on for the Trac issue tracking system, contains a flaw which\nenables attackers to execute code on the web server running trac-git\nby sending crafted HTTP queries.
\nThe old stable distribution (etch) does not contain a trac-git package.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.0.20080710-3+lenny1.
\nFor the unstable distribution (sid) and the testing distribution\n(squeeze), this problem has been fixed in version 0.0.20090320-1.
\nWe recommend that you upgrade your trac-git package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nTwo denial of service vulnerabilities have been discovered in\nsquid and squid3, a web proxy. The Common Vulnerabilities and Exposures\nproject identifies the following problems:
\nBastian Blank discovered that it is possible to cause a denial of\nservice via a crafted auth header with certain comma delimiters.
Tomas Hoger discovered that it is possible to cause a denial of service\nvia invalid DNS header-only packets.
For the stable distribution (lenny), these problems have been fixed in\nversion 2.7.STABLE3-4.1lenny1 of the squid package and version\n3.0.STABLE8-3+lenny3 of the squid3 package.
\nFor the oldstable distribution (etch), these problems have been fixed in\nversion 2.6.5-6etch5 of the squid package and version 3.0.PRE5-5+etch2\nof the squid3 package.
\nFor the testing distribution (squeeze) and the unstable distribution\n(sid), these problems will be fixed soon.
\nWe recommend that you upgrade your squid/squid3 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in chrony, a pair of programs\nwhich are used to maintain the accuracy of the system clock on a computer.\nThis issues are similar to the NTP security flaw CVE-2009-3563. The Common\nVulnerabilities and Exposures project identifies the following problems:
\nchronyd replies to all cmdmon packets with NOHOSTACCESS messages even for\n unauthorized hosts. An attacker can abuse this behaviour to force two\n chronyd instances to play packet ping-pong by sending such a packet with\n spoofed source address and port. This results in high CPU and network\n usage and thus denial of service conditions.
The client logging facility of chronyd doesn't limit memory that is used\n to store client information. An attacker can cause chronyd to allocate\n large amounts of memory by sending NTP or cmdmon packets with spoofed\n source addresses resulting in memory exhaustion.
chronyd lacks of a rate limit control to the syslog facility when logging\n received packets from unauthorized hosts. This allows an attacker to\n cause denial of service conditions via filling up the logs and thus disk\n space by repeatedly sending invalid cmdmon packets.
For the oldstable distribution (etch), this problem has been fixed in\nversion 1.21z-5+etch1.
\nFor the stable distribution (lenny), this problem has been fixed in\nversion 1.23-6+lenny1.
\nFor the testing (squeeze) and unstable (sid) distribution, this problem\nwill be fixed soon.
\nWe recommend that you upgrade your chrony packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that otrs2, the Open Ticket Request System, does not\nproperly sanitise input data that is used on SQL queries, which might be\nused to inject arbitrary SQL to, for example, escalate privileges on a\nsystem that uses otrs2.
\nThe oldstable distribution (etch) is not affected.
\nFor the stable distribution (lenny), the problem has been fixed in\nversion 2.2.7-2lenny3.
\nFor the testing distribution (squeeze), the problem will be fixed soon.
\nFor the unstable distribution (sid), the problem has been fixed in\nversion 2.4.7-1.
\nWe recommend that you upgrade your otrs2 packages.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nIt was discovered that Ajaxterm, a web-based terminal, generates weak\nand predictable session IDs, which might be used to hijack a session or\ncause a denial of service attack on a system that uses Ajaxterm.
\nFor the oldstable distribution (etch), the problem has been fixed in\nversion 0.9-2+etch1.
\nFor the stable distribution (lenny), the problem has been fixed in\nversion 0.10-2+lenny1.
\nFor the unstable distribution (sid), the problem has been fixed in\nversion 0.10-5.
\nWe recommend that you upgrade your ajaxterm package.
\nMD5 checksums of the listed files are available in the original advisory.
\n\n\n\nSeveral vulnerabilities have been discovered in the OpenOffice.org office\nsuite. The Common Vulnerabilities and Exposures project identifies the\nfollowing problems:
\nIt was discovered that macro security settings were insufficiently\n enforced for VBA macros.
It was discovered that the W3C XML Signature recommendation\n contains a protocol-level vulnerability related to HMAC output\n truncation. This also affects the integrated libxmlsec library.
Sebastian Apelt discovered that an integer overflow in the XPM\n import code may lead to the execution of arbitrary code.
Sebastian Apelt and Frank Reissner discovered that a buffer\n overflow in the GIF import code may lead to the execution of\n arbitrary code.
Nicolas Joly discovered multiple vulnerabilities in the parser for\n Word document files, which may lead to the execution of arbitrary\n code.
For the old stable distribution (etch), these problems have been fixed in\nversion 2.0.4.dfsg.2-7etch9.
\nFor the stable distribution (lenny), these problems have been fixed in\nversion 1:2.4.1+dfsg-1+lenny6.
\nFor the unstable distribution (sid), these problems will be fixed soon.
\nWe recommend that you upgrade your openoffice.org packages.
\n