Message-ID: <20090916191017.GA18081@galadriel.inutil.org>
Date: Wed, 16 Sep 2009 21:10:17 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 1889-1] New icu packages correct multibyte sequence parsing

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1889-1                  security@...ian.org
http://www.debian.org/security/                       Moritz Muehlenhoff
September 16, 2009                    http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : icu
Vulnerability  : programming error
Problem type   : local(remote)
Debian-specific: no
CVE Id(s)      : CVE-2009-0153

It was discovered that the ICU unicode library performed incorrect 
processing of invalid multibyte sequences, resulting in potential
bypass of security mechanisms.

For the old stable distribution (etch), this problem has been fixed in
version 3.6-2etch3.

For the stable distribution (lenny), this problem has been fixed in
version 3.8.1-3+lenny2.

For the unstable distribution (sid), this problem has been fixed in
version 4.0.1-1.

We recommend that you upgrade your icu packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/i/icu/icu_3.6-2etch3.dsc
    Size/MD5 checksum:      592 8b600075600533ce08c9801ffa571a19
  http://security.debian.org/pool/updates/main/i/icu/icu_3.6-2etch3.diff.gz
    Size/MD5 checksum:    45190 601af38fe10a27e08e40985c409bc6c4
  http://security.debian.org/pool/updates/main/i/icu/icu_3.6.orig.tar.gz
    Size/MD5 checksum:  9778863 0f1bda1992b4adca62da68a7ad79d830

Architecture independent packages:

  http://security.debian.org/pool/updates/main/i/icu/icu-doc_3.6-2etch3_all.deb
    Size/MD5 checksum:  3239572 8bf16fb7db375fb14de7082bcb814733

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_alpha.deb
    Size/MD5 checksum:  5586140 1244a1b89188c020a97468dc25d22af7
  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_alpha.deb
    Size/MD5 checksum:  7012868 8680617bb8c38f6abef169b572a76baa

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_amd64.deb
    Size/MD5 checksum:  5444866 f9271ec21977880f74955cfe06b7580d
  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_amd64.deb
    Size/MD5 checksum:  6573726 25374ce8e6ae12b655a9744db65b9455

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_hppa.deb
    Size/MD5 checksum:  5913798 20c8976b23d28d9bc91ea053748d79e0
  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_hppa.deb
    Size/MD5 checksum:  7110674 bee82145df32672bf5d61e29dd3d6bc3

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_i386.deb
    Size/MD5 checksum:  6466444 d8e1c31e6f1d238353340a9b82da1ed8
  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_i386.deb
    Size/MD5 checksum:  5470148 f5d9e50ecb224df9ae4f0c7057097f54

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_ia64.deb
    Size/MD5 checksum:  5869036 c305e7cff86ad5584c4842fec7619fd8
  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_ia64.deb
    Size/MD5 checksum:  7243932 effc8dc2ed962de903e848ff402c167a

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_mips.deb
    Size/MD5 checksum:  5747354 39624db186bbf7ce259c47681d0a1cfc
  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_mips.deb
    Size/MD5 checksum:  7052540 c159699731d592ec60fcfd4bbe010a51

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_mipsel.deb
    Size/MD5 checksum:  6769230 32e24d0b40b3f2e62e0c2c4c4be96dce
  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_mipsel.deb
    Size/MD5 checksum:  5464426 5f544b29dd41d8326ddfd70b31e4045a

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_powerpc.deb
    Size/MD5 checksum:  6891510 af8e8b416b43a9d6c5f5893dd63261d6
  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_powerpc.deb
    Size/MD5 checksum:  5750422 ec7b53398b703da8f7e166a33768e260

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_s390.deb
    Size/MD5 checksum:  6896648 d6e3cde239924756df46b084e80388d4
  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_s390.deb
    Size/MD5 checksum:  5781028 e5c3b53fdcda2562a206d92b15a5f520

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/i/icu/libicu36-dev_3.6-2etch3_sparc.deb
    Size/MD5 checksum:  6774462 94ce55cf609a906af5336f32b6c2ee22
  http://security.debian.org/pool/updates/main/i/icu/libicu36_3.6-2etch3_sparc.deb
    Size/MD5 checksum:  5673738 d63d35c169da448d83074fa45e25ed64

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/i/icu/icu_3.8.1-3+lenny2.diff.gz
    Size/MD5 checksum:    41943 57d76fe9884c543a634bfd44425a42c6
  http://security.debian.org/pool/updates/main/i/icu/icu_3.8.1.orig.tar.gz
    Size/MD5 checksum: 10591204 ca52a1eb5050478f5f7d24e16ce01f57
  http://security.debian.org/pool/updates/main/i/icu/icu_3.8.1-3+lenny2.dsc
    Size/MD5 checksum:     1298 e0528ce00964025af9b2f940f588664a

Architecture independent packages:

  http://security.debian.org/pool/updates/main/i/icu/icu-doc_3.8.1-3+lenny2_all.deb
    Size/MD5 checksum:  3659700 69882d02e07863b195b7e9b798bdeff2

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_alpha.deb
    Size/MD5 checksum:  6068242 7e4d26e612e178ebac27cbd2a7db72a9
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_alpha.deb
    Size/MD5 checksum:  7568600 18c17c486d3ee39d0c0b1574d219c228
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_alpha.deb
    Size/MD5 checksum:  2366836 bb1325175eb3086459d6a1daba52d010

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_amd64.deb
    Size/MD5 checksum:  5932454 22e0013e161bf6ec46fdb7e330fa9c2e
  http://security.debian.org/pool/updates/main/i/icu/lib32icu38_3.8.1-3+lenny2_amd64.deb
    Size/MD5 checksum:  5919044 c785a70caa0bf88a644f0b65011915ee
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_amd64.deb
    Size/MD5 checksum:  2404096 2ce67914c39c474ff42f57ffc24bb263
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_amd64.deb
    Size/MD5 checksum:  7123322 5357c9591d7cea42b4cd9bd00b6c9114
  http://security.debian.org/pool/updates/main/i/icu/lib32icu-dev_3.8.1-3+lenny2_amd64.deb
    Size/MD5 checksum:  6063026 bde21ee163171d88d1d3b96cfa795d9b

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_arm.deb
    Size/MD5 checksum:  5910002 195d7e79719dc7b6275776eb29b28b3a
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_arm.deb
    Size/MD5 checksum:  7183106 d5939d433c5e647e1c75af8fb27351d7
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_arm.deb
    Size/MD5 checksum:  2287448 c3e04dae0ad884951cc1ba6663026fed

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_armel.deb
    Size/MD5 checksum:  5848632 1adf442fa32cd182384d2d2608000ef8
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_armel.deb
    Size/MD5 checksum:  7420504 f593ee94d7bdb4bb8c0796aebfaccd61
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_armel.deb
    Size/MD5 checksum:  1758708 cffc60f24a4293d362d82fb6483d38fd

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_hppa.deb
    Size/MD5 checksum:  6379014 1cdb8e9a77f953d7846eb12976efb04f
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_hppa.deb
    Size/MD5 checksum:  7667266 2b4fa947ccb1c56e0a1ab997081349ad
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_hppa.deb
    Size/MD5 checksum:  2360524 012847a53a622bb3dff6a522c0521801

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_i386.deb
    Size/MD5 checksum:  2278340 b95d691813f7d32d7bc1a8aa96ddcd94
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_i386.deb
    Size/MD5 checksum:  6975168 e5c844c5ce908655075dd49c57182b3f
  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_i386.deb
    Size/MD5 checksum:  5918780 a471bd785fecadc4a7acd91be38a1bca

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_ia64.deb
    Size/MD5 checksum:  6398722 9a8fb2a23112dfa081285f2b34bc2c48
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_ia64.deb
    Size/MD5 checksum:  7828890 a56ec00c1e33f8abaaa73e211e3f26c1
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_ia64.deb
    Size/MD5 checksum:  2210326 674686adc1b87ef59144e90fdddb6e8a

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_mips.deb
    Size/MD5 checksum:  6209236 3f2f1f954799ec7c20226b66578496fb
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_mips.deb
    Size/MD5 checksum:  7601662 e5873a370ba2f10e07ba438221ec9326
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_mips.deb
    Size/MD5 checksum:  2475268 9ccfeff2fbd457798ad595513c3fceb8

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_mipsel.deb
    Size/MD5 checksum:  7294770 e7a2b87be42cf6c2eb5defc1f16fcd1b
  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_mipsel.deb
    Size/MD5 checksum:  5900392 1fd37ee3d1d15c3ad251a5b4e2707275
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_mipsel.deb
    Size/MD5 checksum:  2408066 8c5b8b9e7eb46d8404d6fbdf319ba647

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_powerpc.deb
    Size/MD5 checksum:  2378760 842531d765b7bcd25f27535f7e2195fa
  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_powerpc.deb
    Size/MD5 checksum:  7462340 0ce58e5b42bf6cea3488fc55af9b0721
  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_powerpc.deb
    Size/MD5 checksum:  6292462 d8ca2eb3b172e43405339d1ddb233b66

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_s390.deb
    Size/MD5 checksum:  7436198 33277bb42e73a64ae8421c5ce4cc390a
  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_s390.deb
    Size/MD5 checksum:  6270994 b23dd748a28ccde33d87d7df945693a2
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_s390.deb
    Size/MD5 checksum:  2471744 926e06bca83a31ce3aca813409cc95a8

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/i/icu/libicu-dev_3.8.1-3+lenny2_sparc.deb
    Size/MD5 checksum:  7304054 9f98cb39fce383087d192faa2fc47386
  http://security.debian.org/pool/updates/main/i/icu/libicu38-dbg_3.8.1-3+lenny2_sparc.deb
    Size/MD5 checksum:  2135440 3db054d567561c48e935814465e4a525
  http://security.debian.org/pool/updates/main/i/icu/libicu38_3.8.1-3+lenny2_sparc.deb
    Size/MD5 checksum:  6146402 1bfc509accd39f0ca52b871b4af534a2


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkqxN9cACgkQXm3vHE4uylp6WACcDP/faUO12bVfOeG8qVHMiiRv
oKUAn0ZXj9WAkxDxgUbpM2SEG6TuoUgo
=FNYT
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists