full-disclosure - [USN-390-1] evince vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20061130214742.GD7122@outflux.net>
Date: Thu, 30 Nov 2006 13:47:42 -0800
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-390-1] evince vulnerability

=========================================================== 
Ubuntu Security Notice USN-390-1          November 30, 2006
evince vulnerability
CVE-2006-5864
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.10:
  evince                                   0.4.0-0ubuntu4.2

Ubuntu 6.06 LTS:
  evince                                   0.5.2-0ubuntu3.1

Ubuntu 6.10:
  evince                                   0.6.1-0ubuntu1.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

A buffer overflow was discovered in the PostScript processor included in 
evince.  By tricking a user into opening a specially crafted PS file, an 
attacker could crash evince or execute arbitrary code with the user's 
privileges.


Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.2.diff.gz
      Size/MD5:    11664 d17128192e807a0cfdaeb23fa3dd9946
    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.2.dsc
      Size/MD5:     1873 53d40d023740b9f9cc991d63ae5d8481
    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0.orig.tar.gz
      Size/MD5:  1172276 9c1009e3dae55bcda1bc5204f021ad1b

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.2_amd64.deb
      Size/MD5:   652460 28031556b7536ff3ffaf319e622bc999

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.2_i386.deb
      Size/MD5:   602850 63e55c43013743abe8f5c38a9534ecec

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.2_powerpc.deb
      Size/MD5:   637284 db38bf03b1ecbc4ae880e6585fdf40e2

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.2_sparc.deb
      Size/MD5:   616858 5ba7ba196a16f81bee54e89f90ede0fd

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.1.diff.gz
      Size/MD5:    11759 35cfd8a410ff4b3c007a801d3cc8301b
    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.1.dsc
      Size/MD5:     1977 a7a2cca76d367a7b0b35814dd7c0cdcf
    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2.orig.tar.gz
      Size/MD5:  1362513 5020afb1768d89c251ad8c2a233d9fcf

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.1_amd64.deb
      Size/MD5:   747764 5057f66869023293d377de9003b73e56

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.1_i386.deb
      Size/MD5:   692842 3099a22c4805e72fb337ba80459ab6cf

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.1_powerpc.deb
      Size/MD5:   729082 b22cba1dabdaf7cf893c24ae67db34b7

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.1_sparc.deb
      Size/MD5:   704802 70d63563e2049dbeb5d4dffe449ac9c9

Updated packages for Ubuntu 6.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.1.diff.gz
      Size/MD5:     7695 fd708fce54e71ab4527677314735ae07
    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.1.dsc
      Size/MD5:     1679 3433864ecb96560fa08bd45b0cf7fd7a
    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1.orig.tar.gz
      Size/MD5:  1687870 665387e278d4da97f7540aeddeaae57d

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.1_amd64.deb
      Size/MD5:   944176 3e208ca20e0c86c14e80eb0ceb5188ff

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.1_i386.deb
      Size/MD5:   901790 a8b3eb5076b1517d1f26a4673ae4ba7c

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.1_powerpc.deb
      Size/MD5:   926206 c5cda586a630eddf194acd40a86ffb08

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.1_sparc.deb
      Size/MD5:   895884 6b331297cff754b3011c3fde319f1d20


Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/