[SECURITY] [DSA 239-1] New kdesdk packages fix several vulnerabilities
Date: Thu, 23 Jan 2003 16:56:44 +0100 (CET)
From: (Martin Schulze) <[email protected]>
To: [email protected]
Subject: [SECURITY] [DSA 239-1] New kdesdk packages fix several vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 239-1 [email protected]
http://www.debian.org/security/ Martin Schulze
January 23rd, 2003 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : kdesdk
Vulnerability : several
Problem-type : local, remote
Debian-specific: no
CVE Id : CAN-2002-1393
The KDE team discovered several vulnerabilities in the K Desktop
Environment. In some instances KDE fails to properly quote parameters
of instructions passed to a command shell for execution. These
parameters may incorporate data such as URLs, filenames and e-mail
addresses, and this data may be provided remotely to a victim in an
e-mail, a webpage or files on a network filesystem or other untrusted
source.
By carefully crafting such data an attacker might be able to execute
arbitary commands on a vulnerable sytem using the victim's account and
privileges. The KDE Project is not aware of any existing exploits of
these vulnerabilities. The patches also provide better safe guards
and check data from untrusted sources more strictly in multiple
places.
For the current stable distribution (woody), these problems have been fixed
in version 2.2.2-3.2.
The old stable distribution (potato) does not contain KDE packages.
For the unstable distribution (sid), these problems will most probably
not be fixed but new packages for KDE 3.1 for sid are expected for
this year.
We recommend that you upgrade your KDE packages.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2.dsc
Size/MD5 checksum: 809 1e72a255b00079ba8e293a4ceb1c8eb3
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2.diff.gz
Size/MD5 checksum: 2645 1f41391569ee52599dc843687a03181e
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2.orig.tar.gz
Size/MD5 checksum: 1360120 27bc6f7baf89e63fc6913772769920df
Architecture independent components:
http://security.debian.org/pool/updates/main/k/kdesdk/kapptemplate_2.2.2-3.2_all.deb
Size/MD5 checksum: 250626 a8e193b6c246f9038bd0b1634e8628c0
http://security.debian.org/pool/updates/main/k/kdesdk/kdepalettes_2.2.2-3.2_all.deb
Size/MD5 checksum: 5836 d426f27006ee16b366e7aea58535ab3f
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk-doc_2.2.2-3.2_all.deb
Size/MD5 checksum: 126968 30f7976922e912f7ced3b4c5252241df
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk-scripts_2.2.2-3.2_all.deb
Size/MD5 checksum: 66716 1c1b8276651620280b31cf892a10a6e7
Alpha architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_alpha.deb
Size/MD5 checksum: 859876 2d1f134832246f016708c9b5869b2e6b
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_alpha.deb
Size/MD5 checksum: 21394 4bccd516498a581fae81f4f0a86a91c9
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_alpha.deb
Size/MD5 checksum: 4812 8003ab13861e310bcc912fccc8fcd2ca
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_alpha.deb
Size/MD5 checksum: 27588 891cb9ed18b7fcbf0dbcd6d81777d04a
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_alpha.deb
Size/MD5 checksum: 63782 972cec3713037b485e993dddf0b4d38a
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_alpha.deb
Size/MD5 checksum: 31528 de61d755227fbc982af96b3d1823f238
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_alpha.deb
Size/MD5 checksum: 14632 528754318b469f61e61bd239576c629c
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_alpha.deb
Size/MD5 checksum: 646068 8215138bec95fce13579ddeb57835363
ARM architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_arm.deb
Size/MD5 checksum: 774294 7be484e4e531bada235675670656f7ad
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_arm.deb
Size/MD5 checksum: 21392 a106a49607929471e8d0fbfda42b7302
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_arm.deb
Size/MD5 checksum: 4814 c659f7dba60b8d00ff8f6e9c0d7f1d87
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_arm.deb
Size/MD5 checksum: 25996 2fc418708a8c880c5aecc45cbde1c2ec
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_arm.deb
Size/MD5 checksum: 58904 34211e1af64b8a80aa39149480f07c74
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_arm.deb
Size/MD5 checksum: 28198 c4f819f1d31987346a979fab5fc8ec2e
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_arm.deb
Size/MD5 checksum: 13276 e1a80773b018de47fa2a4247743cb5e5
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_arm.deb
Size/MD5 checksum: 823442 679a0cc8b4716ea12a3431af11c16697
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_i386.deb
Size/MD5 checksum: 771636 398d372af4149eba47689f9b36db7780
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_i386.deb
Size/MD5 checksum: 21390 4af236cb7cbfb97be9650a5bb0912247
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_i386.deb
Size/MD5 checksum: 4812 c3b559f9f7429653181503c179f1f0e4
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_i386.deb
Size/MD5 checksum: 27030 ea6665b84e3e12bf1ea11ce30e086d8a
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_i386.deb
Size/MD5 checksum: 52800 068d88ee6551f11a48f51d3973787a39
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_i386.deb
Size/MD5 checksum: 26852 dca10d6aa7f98c468e983e60b1f4b452
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_i386.deb
Size/MD5 checksum: 13280 8611af32043773a83bb1cf59bf45c859
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_i386.deb
Size/MD5 checksum: 646918 8cab3553cb420581e5d5d61dc6bb6c32
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_ia64.deb
Size/MD5 checksum: 1081164 adc303bb20b873e1d1111e4bff4b0035
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_ia64.deb
Size/MD5 checksum: 21398 6adf6c79dcbf70931c1865b649a7cdcb
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_ia64.deb
Size/MD5 checksum: 4812 3cc47238e4fc2a13f2f54e617e646d00
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_ia64.deb
Size/MD5 checksum: 29356 b121017c5ed894da3aa55ba8e39c2ba3
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_ia64.deb
Size/MD5 checksum: 82626 123f528b9eed10394461baa30243ee51
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_ia64.deb
Size/MD5 checksum: 33162 26c22978b33eeda9cae0d15641302a1e
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_ia64.deb
Size/MD5 checksum: 15300 d6b7c27627086e1b5cef53959af9731c
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_ia64.deb
Size/MD5 checksum: 925860 d4ce81bf2af95fe33100df103c21dc7e
HP Precision architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_hppa.deb
Size/MD5 checksum: 889318 bcff53bd4619d49193abe277c09d1506
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_hppa.deb
Size/MD5 checksum: 21398 5ce6c4922f8c176b969a9c1a96bee298
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_hppa.deb
Size/MD5 checksum: 4810 5ab1aa6a25c4939e9c9c8abe65a17d7c
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_hppa.deb
Size/MD5 checksum: 28136 159b6cc8977f5b45cad85e97e9ce117c
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_hppa.deb
Size/MD5 checksum: 66134 ac364b2798f4b2307a51529d1bb600db
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_hppa.deb
Size/MD5 checksum: 32966 22ee0f939f8922c25517823214b193bf
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_hppa.deb
Size/MD5 checksum: 14020 c16c6dde35ed450d4142cd06527481cd
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_hppa.deb
Size/MD5 checksum: 606434 f71003608b1e050c050069f4d17c226a
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_m68k.deb
Size/MD5 checksum: 755554 8a29c63753913e33ebde86dcf2d6d392
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_m68k.deb
Size/MD5 checksum: 21412 da1079065eebd18a353a66a61cd4dee1
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_m68k.deb
Size/MD5 checksum: 4824 8f8a296e9cb9809992ee775afbf3fd18
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_m68k.deb
Size/MD5 checksum: 27516 5d50b2f558e0c762ee5c2dfc99fa7f6e
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_m68k.deb
Size/MD5 checksum: 49072 fbe18a9d85c5f8412b73d6b525fc9739
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_m68k.deb
Size/MD5 checksum: 30292 4bf09fa1bd8cc6de9c16159ecd3ae589
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_m68k.deb
Size/MD5 checksum: 13366 438135879b2780246d418743f9a9fd3d
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_m68k.deb
Size/MD5 checksum: 572830 43978d2e9e5361e5961e8ff54063faa6
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_mips.deb
Size/MD5 checksum: 732348 3a20102bd3df1b16a1c383925ff280ea
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_mips.deb
Size/MD5 checksum: 21404 c57eb0e4b427557ea08331a1fad33779
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_mips.deb
Size/MD5 checksum: 4816 7df152e52a3794b317ecdb434bfd8295
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_mips.deb
Size/MD5 checksum: 25996 4b6716a1024718ab305040fe445794c6
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_mips.deb
Size/MD5 checksum: 56908 21b6f8a8f328b37485b4403d0c1b63d3
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_mips.deb
Size/MD5 checksum: 26984 7fb1700bf00e7c136bc541670a6e21a8
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_mips.deb
Size/MD5 checksum: 13490 d0ff206692c05683bfc25b8628359430
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_mips.deb
Size/MD5 checksum: 501868 c1b11ebc04ab12231740ba85ff34fab0
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_mipsel.deb
Size/MD5 checksum: 725606 67c6d21460d34f18dabe4b4541da49f0
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_mipsel.deb
Size/MD5 checksum: 21398 373e5e32b5afc536b654006206925d59
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_mipsel.deb
Size/MD5 checksum: 4814 537b6a8c5f982f61a299c429a8e66487
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_mipsel.deb
Size/MD5 checksum: 25926 5c5e4027ef6ca161d15c0088f8ae73e0
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_mipsel.deb
Size/MD5 checksum: 56948 2077d42240aa305ceadd620744e4a3af
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_mipsel.deb
Size/MD5 checksum: 26842 3008905abfba7904d5df4fd55a416bdc
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_mipsel.deb
Size/MD5 checksum: 13456 1daf24ffefc3abe4bc68fc0b86a8056f
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_mipsel.deb
Size/MD5 checksum: 485800 1e801b8a53fcba4d804a1991ef33f598
PowerPC architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_powerpc.deb
Size/MD5 checksum: 776788 c45a2dca8dcb7cbd34f4d9a19dc4891f
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_powerpc.deb
Size/MD5 checksum: 21396 0c42f08dd63079eb61dae050629678df
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_powerpc.deb
Size/MD5 checksum: 4814 9311209a5ea526e9f24f5c9311865f7b
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_powerpc.deb
Size/MD5 checksum: 25568 eb202cb0741f3d6dac8c56a5364513b3
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_powerpc.deb
Size/MD5 checksum: 55920 deccf7c64b24a5d4cd133a03fd0965d1
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_powerpc.deb
Size/MD5 checksum: 27254 0768e4faa8088feb0b0ae96d077f9a73
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_powerpc.deb
Size/MD5 checksum: 13480 19e5c0ef57434c581e6609feac1d402e
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_powerpc.deb
Size/MD5 checksum: 597628 ef1f2ff7a37f6a260325aa14156a6293
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_s390.deb
Size/MD5 checksum: 786632 823b69607fc4b1a29544308a46b14da5
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_s390.deb
Size/MD5 checksum: 21396 71a5686e9469e65219adfb5e71b25430
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_s390.deb
Size/MD5 checksum: 4812 7bbff9c4a6052f2233add2f024a32357
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_s390.deb
Size/MD5 checksum: 28408 81d705f49ed63cd6c0e06e2d54aba3ab
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_s390.deb
Size/MD5 checksum: 56080 e173c5fa1a60090fc88fbd55810f6713
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_s390.deb
Size/MD5 checksum: 28160 e02c2b090c006177af9f79554496d96a
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_s390.deb
Size/MD5 checksum: 13626 6cb99ec8320414ff2aae1a021be21038
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_s390.deb
Size/MD5 checksum: 498292 90c93d77364f16bf6bbc6df35bd3f7af
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel_2.2.2-3.2_sparc.deb
Size/MD5 checksum: 782502 4f23c31dd8961b0c14098cb35a14a14c
http://security.debian.org/pool/updates/main/k/kdesdk/kbabel-dev_2.2.2-3.2_sparc.deb
Size/MD5 checksum: 21394 e59e9cf5957993d613e0bfc168e2895b
http://security.debian.org/pool/updates/main/k/kdesdk/kdesdk_2.2.2-3.2_sparc.deb
Size/MD5 checksum: 4810 96cc1ed9708a39cd1ee98093c4af5aab
http://security.debian.org/pool/updates/main/k/kdesdk/kexample_2.2.2-3.2_sparc.deb
Size/MD5 checksum: 26404 d6ddf3c6847c1968f763a5803cad36de
http://security.debian.org/pool/updates/main/k/kdesdk/kmtrace_2.2.2-3.2_sparc.deb
Size/MD5 checksum: 55730 697a73daa3bf53170c03b0c2b56ddce4
http://security.debian.org/pool/updates/main/k/kdesdk/kspy_2.2.2-3.2_sparc.deb
Size/MD5 checksum: 29364 7a6926422194514084fd3637686313a1
http://security.debian.org/pool/updates/main/k/kdesdk/kstartperf_2.2.2-3.2_sparc.deb
Size/MD5 checksum: 13378 69e08fa7cabf50fa2e97f16a8af16192
http://security.debian.org/pool/updates/main/k/kdesdk/poxml_2.2.2-3.2_sparc.deb
Size/MD5 checksum: 584010 04dd30e9894dff1b2bbaf709ae6e13e2
These files will probably be moved into the stable distribution on
its next revision.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<;pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+MBC8W5ql+IAeqTIRApYDAKC5tA4+xAog6VT2h4oo3haYcc/3JwCaAhax
YdYE+ygjcd5zdYM+ykq6cmM=
=kNcy
-----END PGP SIGNATURE-----
