| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20061206032327.GJ6550@outflux.net>
Date: Tue, 5 Dec 2006 19:23:27 -0800
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-390-2] evince vulnerability
===========================================================
Ubuntu Security Notice USN-390-2 December 06, 2006
evince vulnerability
CVE-2006-5864
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 5.10:
evince 0.4.0-0ubuntu4.3
Ubuntu 6.06 LTS:
evince 0.5.2-0ubuntu3.2
Ubuntu 6.10:
evince 0.6.1-0ubuntu1.2
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
USN-390-1 fixed a vulnerability in evince. The original fix did not
fully solve the problem, allowing for a denial of service in certain
situations.
Original advisory details:
A buffer overflow was discovered in the PostScript processor included
in evince. By tricking a user into opening a specially crafted PS
file, an attacker could crash evince or execute arbitrary code with
the user's privileges.
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.3.diff.gz
Size/MD5: 11703 57da8bfc0ad787ae9c8ecd69c517249c
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.3.dsc
Size/MD5: 1873 72d17a9bdb8a65e1a240834099cfdbe6
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0.orig.tar.gz
Size/MD5: 1172276 9c1009e3dae55bcda1bc5204f021ad1b
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.3_amd64.deb
Size/MD5: 652508 2815d3389a1260c6388485b71c3bb5b1
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.3_i386.deb
Size/MD5: 602688 3f7768319e1d5f8f3a3131cf23856c86
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.3_powerpc.deb
Size/MD5: 637256 0c2653001eb6c40e0a3228f8dd49598f
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.4.0-0ubuntu4.3_sparc.deb
Size/MD5: 616900 ade92071c11fd148af61ec3f57900ea3
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.2.diff.gz
Size/MD5: 11818 e485f45171c5558cb7d7fec930f050ba
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.2.dsc
Size/MD5: 1977 15a5db1f73061fbf0d468e9c4a8fe0c7
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2.orig.tar.gz
Size/MD5: 1362513 5020afb1768d89c251ad8c2a233d9fcf
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.2_amd64.deb
Size/MD5: 747902 8f75cb0125481699918dfd23c3d81718
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.2_i386.deb
Size/MD5: 692882 392d072d36c0c200f14ff44c5dd40858
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.2_powerpc.deb
Size/MD5: 729070 d5053fd093002988670243a050f8be1f
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.5.2-0ubuntu3.2_sparc.deb
Size/MD5: 704756 19aa53d800f922641d8660417a982fc4
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.2.diff.gz
Size/MD5: 7742 31f26b98ab68c5c9f7bb9a133ddec8f3
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.2.dsc
Size/MD5: 1679 6e3252457e5c8703932a04804c2af514
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1.orig.tar.gz
Size/MD5: 1687870 665387e278d4da97f7540aeddeaae57d
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.2_amd64.deb
Size/MD5: 944244 bbcc0ea3a31c4f71c528dbf4d144f0e3
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.2_i386.deb
Size/MD5: 901854 ab0b5badc19b9c7665dee69ab937dd02
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.2_powerpc.deb
Size/MD5: 926276 fda07c35d1f38589f515720772888785
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/e/evince/evince_0.6.1-0ubuntu1.2_sparc.deb
Size/MD5: 895824 f94e53b05c5985f9b4fa0889ac2b55c8
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists