Message-ID: <20071127205639.GA3951@galadriel.inutil.org>
Date: Tue, 27 Nov 2007 21:56:39 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 1416-1] New tk8.3 packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1416-1                  security@...ian.org
http://www.debian.org/security/                       Moritz Muehlenhoff
November 27, 2007                     http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : tk8.3
Vulnerability  : buffer overflow
Problem type   : local(remote)
Debian-specific: no
CVE Id(s)      : CVE-2007-5378

It was discovered that Tk, a cross-platform graphical toolkit for Tcl
performs insufficient input validation in the code used to load GIF
images, which may lead to the execution of arbitrary code.

For the stable distribution (etch), this problem has been fixed in
version 8.3.5-6etch1.

Due to the technical limitation in the Debian archive scripts the update
for the old stable distribution (sarge) cannot be released in sync with
the update for the stable distribution. It will be provided in the next
days.

We recommend that you upgrade your tk8.3 packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1.dsc
    Size/MD5 checksum:      672 de719ed8329448b60a2aa5222d94b4c5
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1.diff.gz
    Size/MD5 checksum:    28583 de9d57ab9820f98f01a71cab78b9a51c
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5.orig.tar.gz
    Size/MD5 checksum:  2598030 363a55d31d94e05159e9212074c68004

Architecture independent packages:

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-doc_8.3.5-6etch1_all.deb
    Size/MD5 checksum:   656798 11b87b5e83e8adfa2e19dc93567c422f

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_alpha.deb
    Size/MD5 checksum:   808264 05534d541c67856fd7df57bee0b7448f
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_alpha.deb
    Size/MD5 checksum:   870224 c8f3c39de9dbdbe34afc0558653e97f2

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_amd64.deb
    Size/MD5 checksum:   691340 3aa055a50b0c1864712cad543240cab6
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_amd64.deb
    Size/MD5 checksum:   830790 50c07325658b74d25d06e239012da590

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_arm.deb
    Size/MD5 checksum:   649782 33621a77aaf49894dc7962d7579ae2c3
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_arm.deb
    Size/MD5 checksum:   802848 7619e44e0c07804307f3b3d59d97589a

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_hppa.deb
    Size/MD5 checksum:   888990 d9eaf0227c0594236389bf877747744e
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_hppa.deb
    Size/MD5 checksum:   773376 c06fc4983e04a409811c6b070a7d0b4a

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_i386.deb
    Size/MD5 checksum:   670426 3bf93bae2527f043b01edb3018de4d90
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_i386.deb
    Size/MD5 checksum:   803736 99d6c8562e60a2648817db63555fcbc1

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_ia64.deb
    Size/MD5 checksum:  1057842 45e3159db424788b401d4a98c1dfb511
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_ia64.deb
    Size/MD5 checksum:   959436 9cce282e61e257655301ad47ddc03ac1

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_mips.deb
    Size/MD5 checksum:   824708 437a50b7cfd05d863b9a4a97b596969e
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_mips.deb
    Size/MD5 checksum:   725262 8a50f4b098e50fec648ce187139f8af8

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_mipsel.deb
    Size/MD5 checksum:   822976 3451e740c116b8fbf77c07e744624637
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_mipsel.deb
    Size/MD5 checksum:   725896 6c09774f07d8463251684f26c1bcda1f

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_powerpc.deb
    Size/MD5 checksum:   824230 2251a2ee8548aeeb72dd4a1f425fc2b0
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_powerpc.deb
    Size/MD5 checksum:   659860 d0332098901ff52792d9ab560b242b61

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_s390.deb
    Size/MD5 checksum:   693954 324775b60e7224a3aab44b895a3eb7b9
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_s390.deb
    Size/MD5 checksum:   838370 1a04c4abe7846022366f401a7049e83e

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_sparc.deb
    Size/MD5 checksum:   805234 9bc0cd3ac6d1a375ffe56d889d4967a7
  http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_sparc.deb
    Size/MD5 checksum:   680440 328ed71bd6147eb48d1843ad04d7406c


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHTIQpXm3vHE4uyloRAu3YAJ9RDQkX0xRClWaEiZVkEU1A7/IHAgCdECYE
O227xjm2evaV0ZuE5krU8lU=
=ywra
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists