ID: 00502
Ref: 485/2006
Date: 25 July 2006:14:47:35
Version: 1
Title: Three Debian Security Advisories: 1. DSA 1122-1 - New Net::Server packages fix denial of service 2. DSA 1123-1 - New libdumb packages fix arbitrary code execution 3. DSA 1124-1 - New fbi packages fix potential deletion of user data
Abstract:
Vendors affected: Debian
Operating systems affected: Debian
Applications affected: Debian
Title
=====
Three Debian Security Advisories:
1. DSA 1122-1 - New Net::Server packages fix denial of service
2. DSA 1123-1 - New libdumb packages fix arbitrary code execution
3. DSA 1124-1 - New fbi packages fix potential deletion of user data
Detail
======
1. Peter Bieringer discovered that the "log" function in the Net::Server
Perl module, an extensible, general perl server engine, is not safe
against format string exploits.
2. Luigi Auriemma discovered that DUMB, a tracker music library, performs
insufficient sanitising of values parsed from IT music files, which might
lead to a buffer overflow and execution of arbitrary code if manipulated
files are read.
3. Toth Andras discovered that the fbgs framebuffer postscript/PDF viewer
contains a typo, which prevents the intended filter against malicious
postscript commands from working correctly. This might lead to the
deletion of user data when displaying a postscript file.
1.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 1122-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
July 24th, 2005 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : libnet-server-perl
Vulnerability : format string
Problem type : remote
Debian-specific: no
CVE ID : CVE-2005-1127
Debian Bug : 378640
Peter Bieringer discovered that the "log" function in the Net::Server
Perl module, an extensible, general perl server engine, is not safe
against format string exploits.
The old stable distribution (woody) does not contain this package.
For the stable distribution (sarge) this problem has been fixed in
version 0.87-3sarge1.
For the unstable distribution (sid) this problem has been fixed in
version 0.89-1.
We recommend that you upgrade your libnet-server-perl package.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/libn/libnet-server-perl/libnet-server-perl_0.87-3sarge1.dsc
Size/MD5 checksum: 692 9790e3935bc81150adb54a5d5a3fa692
http://security.debian.org/pool/updates/main/libn/libnet-server-perl/libnet-server-perl_0.87-3sarge1.diff.gz
Size/MD5 checksum: 8220 59438319c03603473e174c61009b0d7c
http://security.debian.org/pool/updates/main/libn/libnet-server-perl/libnet-server-perl_0.87.orig.tar.gz
Size/MD5 checksum: 69235 0b8553db414dac4c43b9f9282f8e149c
Architecture independent components:
http://security.debian.org/pool/updates/main/libn/libnet-server-perl/libnet-server-perl_0.87-3sarge1_all.deb
Size/MD5 checksum: 126808 5f8a62959bae9000ec8e64a23263d072
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show
' and http://packages.debian.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
iD8DBQFExOJbW5ql+IAeqTIRAiy2AJ9Xbi7cRq7+VtTl1sZYnzKR5yMdlQCgrwGe
RRVbqy68ksVHqr9tF6vf1ig=
=9BkT
-----END PGP SIGNATURE-----
2.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 1123-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
July 24th, 2006 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : libdumb
Vulnerability : buffer overflow
Problem-Type : local(remote)
Debian-specific: no
CVE ID : CVE-2006-3668
Debian Bug : 379064
Luigi Auriemma discovered that DUMB, a tracker music library, performs
insufficient sanitising of values parsed from IT music files, which might
lead to a buffer overflow and execution of arbitrary code if manipulated
files are read.
For the stable distribution (sarge) this problem has been fixed in
version 0.9.2-6.
For the unstable distribution (sid) this problem has been fixed in
version 0.9.3-5.
We recommend that you upgrade your libdumb packages.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb_0.9.2-6.dsc
Size/MD5 checksum: 634 32242f365a1433e66ca9e46a004523df
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb_0.9.2-6.diff.gz
Size/MD5 checksum: 3914 65aa4b7596e81c622e830bbe1d32ff22
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb_0.9.2.orig.tar.gz
Size/MD5 checksum: 145722 0ce45f64934e6d5d7b82a55108596680
Alpha architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_alpha.deb
Size/MD5 checksum: 75276 b7f57922166c536f19b965d3ab0d88fe
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_alpha.deb
Size/MD5 checksum: 6090 06c293edff58a482fcf6084c4b5d934a
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_alpha.deb
Size/MD5 checksum: 121546 715574ff400819fd703793d4ecf75fad
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_alpha.deb
Size/MD5 checksum: 72390 31d5b7901bc0812b9348eb876cc15b8d
AMD64 architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_amd64.deb
Size/MD5 checksum: 74780 04d899dbf1e150f1f9568457d34b6fdd
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_amd64.deb
Size/MD5 checksum: 5244 d0bdb1d783d860280176b190677a4052
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_amd64.deb
Size/MD5 checksum: 109360 712603865afd1d04e536c453bf1ae373
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_amd64.deb
Size/MD5 checksum: 52534 87514a167dc9e6a00ee98c496721b2ae
ARM architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_arm.deb
Size/MD5 checksum: 73954 edb9623bfb0753b9ac8adf7fba5acfd1
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_arm.deb
Size/MD5 checksum: 4738 f5afa9198afce1f16e625e7e41618f71
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_arm.deb
Size/MD5 checksum: 110002 542706c4b04ca773be469d066cce125b
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_arm.deb
Size/MD5 checksum: 54256 6f59fabcf506f6508e86b42ae6ae78ad
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_i386.deb
Size/MD5 checksum: 74484 1c721ae454752d3a252f1cfc9a773d41
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_i386.deb
Size/MD5 checksum: 4738 e4b77e2545480a205f675e39017efc58
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_i386.deb
Size/MD5 checksum: 108496 ead6a0b39172a059491c864b9985101f
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_i386.deb
Size/MD5 checksum: 47478 a0d02ff38ef6791845756ca2394a4bc5
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_ia64.deb
Size/MD5 checksum: 76358 88a9e82bf0c85d8f0b6db2a718c40a9a
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_ia64.deb
Size/MD5 checksum: 6312 953f7b5387e0d99715cf0c7b047bef9a
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_ia64.deb
Size/MD5 checksum: 134560 53dae1f7002cd4c795c8d42990470973
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_ia64.deb
Size/MD5 checksum: 78760 0b70e7b9b4e67399e0e7cdfb94c2122d
HP Precision architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_hppa.deb
Size/MD5 checksum: 75286 7817acef6001881bcea7611ffd538b7d
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_hppa.deb
Size/MD5 checksum: 5414 b399bd5949caccf4cb02ada6a4b7d4f3
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_hppa.deb
Size/MD5 checksum: 116320 a69a36e0c23670499781c2a77611bfae
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_hppa.deb
Size/MD5 checksum: 57774 032d891a6aeda5932fcc8ad6fa64d372
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_m68k.deb
Size/MD5 checksum: 74204 43c5cd2ae45c7871e27bcb0fc948b17e
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_m68k.deb
Size/MD5 checksum: 4596 560f752f7433cf6a743a18d4b7636e1d
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_m68k.deb
Size/MD5 checksum: 105372 785d07eaebf837f71a5ad3b017100f88
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_m68k.deb
Size/MD5 checksum: 44940 606b5f441e61305b304f58a3bdd1ab5b
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_mips.deb
Size/MD5 checksum: 74418 d88ed88421fd473176eda13e168b2ae5
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_mips.deb
Size/MD5 checksum: 5484 fcdfa364a97466a423aa8bf9646fe904
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_mips.deb
Size/MD5 checksum: 111414 01edc258404ab63fe164fea1930476f2
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_mips.deb
Size/MD5 checksum: 56954 99e88c70e885558040177fb634c0a027
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_mipsel.deb
Size/MD5 checksum: 74416 0eda36c34e3962aa3dd84c1a0092372a
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_mipsel.deb
Size/MD5 checksum: 5468 13f0d69dda9223f444a94ea0ca1d6843
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_mipsel.deb
Size/MD5 checksum: 111572 f82a7f553c8e1fe5b40bb6d676e7af77
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_mipsel.deb
Size/MD5 checksum: 57134 c41f1608565019146d563859d8df849f
PowerPC architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_powerpc.deb
Size/MD5 checksum: 75934 15e1e9c231b1fa79002285249aa1868f
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_powerpc.deb
Size/MD5 checksum: 4932 bda0bd686f1711f9ba4d9fefb6cd1df4
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_powerpc.deb
Size/MD5 checksum: 112666 450a7cc5c2c6134dda51bbe17bedade0
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_powerpc.deb
Size/MD5 checksum: 53122 8c7ef44c26a5eb803456b1484e86780b
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_s390.deb
Size/MD5 checksum: 75080 69120a96775c9ce4da1005e88285bfc7
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_s390.deb
Size/MD5 checksum: 5118 c80b9f07677b5cd0efef90d75e4f2226
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_s390.deb
Size/MD5 checksum: 114394 171899c4214e870b72c0be62113d866b
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_s390.deb
Size/MD5 checksum: 53434 b0d7b9822aae29da009fbe70602992c6
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_sparc.deb
Size/MD5 checksum: 74112 dfeda909f974a6ca36404bbe87887d5a
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_sparc.deb
Size/MD5 checksum: 4782 9dcd795ae35d0136d30e36634278a44f
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_sparc.deb
Size/MD5 checksum: 111376 9e364aa1a08ef44ee0b1704158f9649a
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_sparc.deb
Size/MD5 checksum: 51554 c2d5966066dd655303b3f431bd09de4d
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
iD8DBQFExQW4Xm3vHE4uyloRAouZAJ96R9dDMVIHXcgUAWF7p8aBIY/hrQCgiPe6
FpXhO7XJb0I3qa6ppARmmNc=
=Ms9D
-----END PGP SIGNATURE-----
3.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 1124-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
July 24th, 2006 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : fbi
Vulnerability : typo
Problem-Type : local
Debian-specific: no
CVE ID : CVE-2006-3119
Toth Andras discovered that the fbgs framebuffer postscript/PDF viewer
contains a typo, which prevents the intended filter against malicious
postscript commands from working correctly. This might lead to the
deletion of user data when displaying a postscript file.
For the stable distribution (sarge) this problem has been fixed in
version 2.01-1.2sarge2.
For the unstable distribution (sid) this problem will be fixed soon.
We recommend that you upgrade your fbi package.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2.dsc
Size/MD5 checksum: 735 36d0568b3c180e41cb1f6df809ff5e5b
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2.diff.gz
Size/MD5 checksum: 5088 3b4e9623e4aa9d333c3aee47c42f3422
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01.orig.tar.gz
Size/MD5 checksum: 205822 7bf21eae612fd457155533a83ab075c2
Alpha architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_alpha.deb
Size/MD5 checksum: 29542 b0a4b4a73a93bda7243fea211f5ead9f
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_alpha.deb
Size/MD5 checksum: 67686 303fed22421dda6d18e541425c6a945f
AMD64 architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_amd64.deb
Size/MD5 checksum: 24528 359cf3eadf6294c39b4fe2b185aa1167
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_amd64.deb
Size/MD5 checksum: 57384 cb5af6bbe2bd5ea99966eab903f220bf
ARM architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_arm.deb
Size/MD5 checksum: 22494 4a750437cdd4fcb2049e8c33b5231b64
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_arm.deb
Size/MD5 checksum: 51232 240a6f9509c00477bcbefe80a0fb7e70
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_i386.deb
Size/MD5 checksum: 22712 809f7d0fcfce407e5679305b07b69967
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_i386.deb
Size/MD5 checksum: 52200 e2b4fdc29c3787d0a843415c5e62bcc1
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_ia64.deb
Size/MD5 checksum: 33896 a60373a4938640174dc80b34c65dadc4
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_ia64.deb
Size/MD5 checksum: 79814 6b6bfc5816ca014e4d290b05834eceac
HP Precision architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_hppa.deb
Size/MD5 checksum: 26914 164ccc167aa0fda01d9535c65db000cc
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_hppa.deb
Size/MD5 checksum: 60222 c215390ee5bef416b5a9eb9ad0b16a2e
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_m68k.deb
Size/MD5 checksum: 20754 006ed3c7e982e08d14860282ac312fad
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_m68k.deb
Size/MD5 checksum: 47324 63732b97562e3b2e8f801128faf8b8b4
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_mips.deb
Size/MD5 checksum: 26048 211c8a4c5398e403b7d7f4a1a4bb3c4f
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_mips.deb
Size/MD5 checksum: 59498 6e68121650840d81e04b1bec82156f5c
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_mipsel.deb
Size/MD5 checksum: 26122 74ffc8475a2acf27af99b83b7cd0cbc6
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_mipsel.deb
Size/MD5 checksum: 59234 6b976898ad8c23b7da53449d6af2c3e0
PowerPC architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_powerpc.deb
Size/MD5 checksum: 25978 ec0d5e88f5e7c908ce7c053485ca415a
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_powerpc.deb
Size/MD5 checksum: 57298 996b2e6523767b439583dad7c511df83
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_s390.deb
Size/MD5 checksum: 24472 8c030047c8d631a6a1c01079e7d352e7
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_s390.deb
Size/MD5 checksum: 58050 e5bebfa9b1c7ab4a0cfac3bc8f5f4541
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/f/fbi/exiftran_2.01-1.2sarge2_sparc.deb
Size/MD5 checksum: 23074 5c0854fb34e3c6da7c12991dedae0910
http://security.debian.org/pool/updates/main/f/fbi/fbi_2.01-1.2sarge2_sparc.deb
Size/MD5 checksum: 52484 72496fbe05968cfb7bd185414629033f
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
iD8DBQFExQaRXm3vHE4uyloRAiQgAJ4qPeQ93sCM0w86nEIW1z7QsRx4ywCgu+ez
4jdvLmA2K7QbRl205/2QqdI=
=79Oc
-----END PGP SIGNATURE-----