| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20071127205117.GA3918@galadriel.inutil.org>
Date: Tue, 27 Nov 2007 21:51:17 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: debian-security-announce@...ts.debian.org
Subject: [SECURITY] [DSA 1415-1] New tk8.4 packages fix
arbitrary code execution
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1415-1 security@...ian.org
http://www.debian.org/security/ Moritz Muehlenhoff
November 27, 2007 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : tk8.4
Vulnerability : buffer overflow
Problem type : local(remote)
Debian-specific: no
CVE Id(s) : CVE-2007-5378
It was discovered that Tk, a cross-platform graphical toolkit for Tcl
performs insufficient input validation in the code used to load GIF
images, which may lead to the execution of arbitrary code.
For the stable distribution (etch), this problem has been fixed in
version 8.4.12-1etch1.
For the old stable distribution (sarge), this problem has been fixed
in version 8.4.9-1sarge1.
We recommend that you upgrade your tk8.4 packages. Updated packages for
sparc will be provided later.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian 3.1 (oldstable)
- ----------------------
Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1.diff.gz
Size/MD5 checksum: 19132 8ded0a058cbe9140f905cbd769622d45
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9.orig.tar.gz
Size/MD5 checksum: 3266500 1b64258abaf258e9a86f331d8de17a71
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1.dsc
Size/MD5 checksum: 672 3a7de8981a9239e231c55486ee308de3
Architecture independent packages:
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-doc_8.4.9-1sarge1_all.deb
Size/MD5 checksum: 775182 df1628c1fadebdf2ce7d4ab138a0dcca
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_alpha.deb
Size/MD5 checksum: 940380 984e7d1787ea4bf5df7d05be8feaee31
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_alpha.deb
Size/MD5 checksum: 1031394 a68b8bd438ce30ad2899e893abbdf042
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_amd64.deb
Size/MD5 checksum: 976380 299c8fca87bdbe6a162edea32d44c38d
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_amd64.deb
Size/MD5 checksum: 810012 3b83261ac52a6a630958969f8b68f044
arm architecture (ARM)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_arm.deb
Size/MD5 checksum: 945218 6f016ddd99884ffb1a7fa636d5c157fd
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_arm.deb
Size/MD5 checksum: 823888 2c55586df75b8ce85b71f396aa511ce9
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_hppa.deb
Size/MD5 checksum: 912732 100772a425baf8736ac2e59e11a111e4
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_hppa.deb
Size/MD5 checksum: 1046506 ac02d6ea5b9249cfc8d8bd3f7905dd03
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_i386.deb
Size/MD5 checksum: 956128 8508b0b84a8a8887903ee61096c85c39
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_i386.deb
Size/MD5 checksum: 793304 9bc383580f29575f49035ec640595df4
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_ia64.deb
Size/MD5 checksum: 1053280 c1684368d5bbdc14919cb11ad26bc726
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_ia64.deb
Size/MD5 checksum: 1182358 2a0c99c93455876bf42867bc83620b00
m68k architecture (Motorola Mc680x0)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_m68k.deb
Size/MD5 checksum: 909088 ccece33fe08dc605e03044dad3a43661
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_m68k.deb
Size/MD5 checksum: 696326 0ab235f58988c18975e43089c3e10af0
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_mips.deb
Size/MD5 checksum: 836414 48299e087ae5dc67625b27d7f0854e32
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_mips.deb
Size/MD5 checksum: 974766 f39594e6990da6263c3bdba7ee4aea86
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_mipsel.deb
Size/MD5 checksum: 971980 1c4ef565e11e47071ea107f141170512
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_mipsel.deb
Size/MD5 checksum: 834546 4597a7304dd446b7925e2c063545624c
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_powerpc.deb
Size/MD5 checksum: 809966 12bcccfa9063c8a62f0dd7057dfe8504
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_powerpc.deb
Size/MD5 checksum: 972248 f0bd560ab2cee8d267e9dbb9094058a3
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.9-1sarge1_s390.deb
Size/MD5 checksum: 807346 ecd93447c67c3699fd208103d816978c
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.9-1sarge1_s390.deb
Size/MD5 checksum: 979828 d1bac5275945a17ed5367dda901430f8
Debian (stable)
- ---------------
Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1.diff.gz
Size/MD5 checksum: 21554 9ebdf19de1ed8568cd28c25eb972e2d3
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1.dsc
Size/MD5 checksum: 673 61cb74d2fb34540869e30d14ea1e40d9
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12.orig.tar.gz
Size/MD5 checksum: 3245547 316491cb82d898b434842353aed1f0d6
Architecture independent packages:
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-doc_8.4.12-1etch1_all.deb
Size/MD5 checksum: 788108 6f9d55cb28c45666ae3b32df3c1ca795
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_alpha.deb
Size/MD5 checksum: 967902 85a3c359c59496341cec367587b900a0
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_alpha.deb
Size/MD5 checksum: 1050782 2fc3f31072e99d2353bbb8dccf96855e
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_amd64.deb
Size/MD5 checksum: 839242 de732d67838526d3226e8fde45371f03
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_amd64.deb
Size/MD5 checksum: 1008782 a7835d6d302380cce9d052ce84aa7bd5
arm architecture (ARM)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_arm.deb
Size/MD5 checksum: 971456 2a559e222eeaa8a98adbda09313d834d
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_arm.deb
Size/MD5 checksum: 793800 030853f33c20183d311aa847c36b1701
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_hppa.deb
Size/MD5 checksum: 931586 ce5bdcac2f3accf51c0f5c06ef3482fe
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_hppa.deb
Size/MD5 checksum: 1073338 f4e3cd09a5b8a06703831fe5854484bb
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_i386.deb
Size/MD5 checksum: 818374 4a7b6492c3442378f328f3eb0fe1601f
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_i386.deb
Size/MD5 checksum: 977082 87f0b6134d507238444463e55e38fec7
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_ia64.deb
Size/MD5 checksum: 1259516 20ddea5e9bcd3bb35763572e38c4361d
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_ia64.deb
Size/MD5 checksum: 1136186 9fc4e609f181584adf0236898ddf8f4c
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_mips.deb
Size/MD5 checksum: 1000718 3622d0943aae361891aedebf76d76ad8
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_mips.deb
Size/MD5 checksum: 876670 3d2c3888b2d52647f81c85a4deb756c0
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_mipsel.deb
Size/MD5 checksum: 999140 5012f47d29bd963cc8b3bb25015deba3
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_mipsel.deb
Size/MD5 checksum: 875762 541b3137f5bca84dcb5cb2e7cac949bf
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_powerpc.deb
Size/MD5 checksum: 807006 cd8b98b18b585b658812050315a0cb73
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_powerpc.deb
Size/MD5 checksum: 998832 f69d8b6c7ed360dcba77fada3d39ad3a
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_s390.deb
Size/MD5 checksum: 847076 c9fb6468ecd528584dadc67888f897ed
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_s390.deb
Size/MD5 checksum: 1016808 5eefee6032b8d4109796e68b78f16bd6
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4-dev_8.4.12-1etch1_sparc.deb
Size/MD5 checksum: 826552 ba502e25a2a6c811ee609216d3483bf8
http://security.debian.org/pool/updates/main/t/tk8.4/tk8.4_8.4.12-1etch1_sparc.deb
Size/MD5 checksum: 978866 aadde6fd7e0713a4c6d52f95c352382c
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFHTIMRXm3vHE4uyloRAv2HAKCExv3bKZmNEajHyjLHKX2eAk9AygCgklvL
+IE9W+yttsJz4MiKD3hasaI=
=ZPdF
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists