bugtraq - [SECURITY] [DSA 3194-1] libxfont security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20150317153858.GA13833@pisco.westfalen.local>
Date: Tue, 17 Mar 2015 16:38:58 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3194-1] libxfont security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3194-1                   security@...ian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
March 17, 2015                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libxfont
CVE ID         : CVE-2015-1802 CVE-2015-1803 CVE-2015-1804

Ilja van Sprundel, Alan Coopersmith and William Robinet discovered
multiple issues in libxfont's code to process BDF fonts, which might
result in privilege escalation.

For the stable distribution (wheezy), these problems have been fixed in
version 1.4.5-5.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your libxfont packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVCEpuAAoJEBDCk7bDfE42//QP/2+34kCrp918uZojJihldHHC
i4BFFeqvO+uwU7LnrnXD/q0FXbVCcOI7Q341ASBh8fKYn0k7qrWIdU6oEPNgAhr1
9uTc3jh+n7GscZ3EPbtY+kpZDf6bl13Tc+3/GkIB4WytKHnEQEMsHT3aKSW2ElZZ
W2xDGRqJ4pnOHejoHxL28IiRIaleBR1A+RwbkRxwmee0Q+u7uQdGc8ROz9JesWCJ
pQeLckT4s+WHUH/piDfmiF2fM0iErh8j6i0RTNZA0YwXF1jG3xVwYoWgbXDJwhf+
XsWZ0QYca5KDFaDxXTEecoC1xO4UDr2SS9kcXRtXZ4DmRCeJDe8JpCuRxJRsjxM0
SMT/lRK6kIxwBvH5gapjHKnPuEMtXFgp5okEQrY9Q7i8TZci9qfjgCus6WJLkGq9
xa97xlnqwpBjeeE6sS/GrfVObOPhlBYzInW6eM4y4eQvqr9rxFLnD6NQ01tj5Bms
h404FEqk93JwwJ1gZzzn/oy4bTFFgFTEoGa2I1nhWUk6xwLC83C3LkBK59Io6vD9
VqRPhOn0LIsVXaQWezGaE4req8nbdBvocqcpLWiw6sWXEBQvHwc2I9dx+MoNsxta
FgFH5bFrXXwmXPEcyhGK2rOsuWJl+y3GUSRqtSL13tAgsevfEPVl11raztgi4jtN
aU/BHl1JOQw6IVxZYeBM
=/fNW
-----END PGP SIGNATURE-----