lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list] 
Message-ID: <20091030010420.GA4523@ngolde.de>
Date: Fri, 30 Oct 2009 02:04:20 +0100
From: Nico Golde <nion@...ian.org>
To: debian-security-announce@...ts.debian.org
Subject: [SECURITY] [DSA 1923-1] New libhtml-parser-perl
	packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA-1923-1                    security@...ian.org
http://www.debian.org/security/                                 Nico Golde
October 27th, 2009                      http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : libhtml-parser-perl
Vulnerability  : denial of service
Problem type   : remote
Debian-specific: no
Debian bug     : #552531
CVE ID         : CVE-2009-3627

A denial of service vulnerability has been found in libhtml-parser-perl,
a collection of modules to parse HTML in text documents which is used by
several other projects like e.g. SpamAssassin.

Mark Martinec discovered that the decode_entities() function will get stuck
in an infinite loop when parsing certain HTML entities with invalid UTF-8
characters.  An attacker can use this to perform denial of service attacks
by submitting crafted HTML to an application using this functionality.


For the oldstable distribution (etch), this problem has been fixed in
version 3.55-1+etch1.

For the stable distribution (lenny), this problem has been fixed in
version 3.56-1+lenny1.

For the testing (squeeze) and unstable (sid) distribution, this problem
will be fixed soon.


We recommend that you upgrade your libhtml-parser-perl packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55.orig.tar.gz
    Size/MD5 checksum:    84746 75eb683f1fb7aa7c0ffa46ded4564b54
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.diff.gz
    Size/MD5 checksum:     6136 8c713a84e3df953ae77d83d9f2cff5bc
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.dsc
    Size/MD5 checksum:      882 0f38d699bda26190ea4764aa74eac2c8

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_alpha.deb
    Size/MD5 checksum:   108540 a6d69a440e25b3d3b4e9c5057f6b6908

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_amd64.deb
    Size/MD5 checksum:   108168 ddafcee82387004c4d55a39a8ca54eb6

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_arm.deb
    Size/MD5 checksum:   106962 9842d5bc00c6b308d01fae6d20676e9e

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_hppa.deb
    Size/MD5 checksum:   109602 2d4a2d3ff134cfdd70135e71caf9043a

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_i386.deb
    Size/MD5 checksum:   108032 b542502d5b1d4fff66c2d730e8c02790

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_ia64.deb
    Size/MD5 checksum:   117524 ce065d8d05996cdc4c436104b578ed0a

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mips.deb
    Size/MD5 checksum:   106518 25feabc68e1aa4aff02b6aff00a2a9df

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mipsel.deb
    Size/MD5 checksum:   105742 17a4f0fafa183a3794fad636e4e26ce4

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_powerpc.deb
    Size/MD5 checksum:   106504 beb784e9d723ba717d207c6e9c58414b

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_s390.deb
    Size/MD5 checksum:   106630 1de105f77b55dd920dbfccb7712e3dc1

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_sparc.deb
    Size/MD5 checksum:   106222 bd1cd736644c4f2dceb76cc5192f18d0


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.diff.gz
    Size/MD5 checksum:     6147 18b2407d8b26d6225b82a880b16a0e05
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.dsc
    Size/MD5 checksum:     1316 5a923d6089e2ffddf050ea5b017a7956
  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56.orig.tar.gz
    Size/MD5 checksum:    86040 bddc432e5ed9df4d4153a62234f04fc2

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_alpha.deb
    Size/MD5 checksum:   111160 928145a65d633d76bf3db6a42bcf9173

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_amd64.deb
    Size/MD5 checksum:   111614 9152d47982c212aa1ee9ec8d6293c97e

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_arm.deb
    Size/MD5 checksum:   109442 e559abada6a045e2a8d51b1c54a89655

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_armel.deb
    Size/MD5 checksum:   109388 47e0480a189e752018d27ffb4b19d9e1

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_hppa.deb
    Size/MD5 checksum:   112026 52d258a94e332f7f1c527ae0c47d77d6

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_i386.deb
    Size/MD5 checksum:   109680 da9426f29d77127b954a77263a5b7665

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_ia64.deb
    Size/MD5 checksum:   121744 90933c7e204254b4c308424af76917b2

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_mips.deb
    Size/MD5 checksum:   109378 f46f9971f7d22fe40a1d15cc224cdc70

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_mipsel.deb
    Size/MD5 checksum:   109870 af19cea178841be6c1fc658cac4c468d

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_powerpc.deb
    Size/MD5 checksum:   112450 1a2d490c6120185ec0cbddc2bb73e792

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_s390.deb
    Size/MD5 checksum:   110958 2f21853d729b141554b39132ecf21f5c

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_sparc.deb
    Size/MD5 checksum:   108682 a1831a4919f5c7b30eab0def292928b5


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkrqO5QACgkQHYflSXNkfP8jYACgkATgE0BJ4ndT4SUaOhI8Qg0w
gpkAnAzu0Jnb9nHUe/46Ggi7CdwAoApn
=q4EB
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ