[SECURITY] [DSA 936-1] New libextractor packages fix arbitrary code execution
Date: Wed, 11 Jan 2006 10:04:51 +0100 (CET)
From: [email protected] (Martin Schulze)
Subject: [SECURITY] [DSA 936-1] New libextractor packages fix arbitrary code execution
Priority: urgent
Resent-Message-ID: <erwnWD.A.w6G.-qMxDB@murphy.>
Reply-To: [email protected]
Mail-Followup-To: [email protected]
To: [email protected]
Resent-Date: Wed, 11 Jan 2006 03:07:10 -0600 (CST)
Resent-From: [email protected] (Mailing List Manager)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 936-1 [email protected]
http://www.debian.org/security/ Martin Schulze
January 11th, 2006 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : libextractor
Vulnerability : buffer overflows
Problem type : remote
Debian-specific: no
CVE IDs : CVE-2005-3191 CVE-2005-3192 CVE-2005-3193 CVE-2005-2097
CVE-2005-3624 CVE-2005-3625 CVE-2005-3626 CVE-2005-3627
CVE-2005-3628
"infamous41md" and Chris Evans discovered several heap based buffer
overflows in xpdf, the Portable Document Format (PDF) suite, which is
also present in libextractor, a library to extract arbitrary meta-data
from files, and which can lead to a denial of service by crashing the
application or possibly to the execution of arbitrary code.
The old stable distribution (woody) does not contain libextractor
packages.
For the stable distribution (sarge) these problems have been fixed in
version 0.4.2-2sarge2.
For the unstable distribution (sid) these problems have been fixed in
version 0.5.8-1.
We recommend that you upgrade your libextractor packages.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor_0.4.2-2sarge2.dsc
Size/MD5 checksum: 778 6906857074772199e2a8a892feb3aae2
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor_0.4.2-2sarge2.diff.gz
Size/MD5 checksum: 6345 c214699bde0bfad501cede35488b4f09
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor_0.4.2.orig.tar.gz
Size/MD5 checksum: 5887095 d99e1b13a017d39700e376a0edbf7ba2
Alpha architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_alpha.deb
Size/MD5 checksum: 19424 59bb8cddd5c80fb1cba57796b9445dab
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_alpha.deb
Size/MD5 checksum: 5804676 9942575a95cb97dfcae26b156dca7a58
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_alpha.deb
Size/MD5 checksum: 19204 fed48ebb930e6a7d3484bd75c8263a81
AMD64 architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_amd64.deb
Size/MD5 checksum: 18098 7d4a40679062c4d2d70f9c08dc785559
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_amd64.deb
Size/MD5 checksum: 5641300 ff1bac0e15d1a6ff630a6ced168e284f
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_amd64.deb
Size/MD5 checksum: 17364 54dd55236286550d6cadc8dbb3df9ccd
ARM architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_arm.deb
Size/MD5 checksum: 17480 aa541fc867f51588b676aa23d34e25a8
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_arm.deb
Size/MD5 checksum: 5710616 ed153d5e88e899f4e27ae5a67c5e45d0
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_arm.deb
Size/MD5 checksum: 16784 7a7f73139e8c0c62187179e993734932
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_i386.deb
Size/MD5 checksum: 17624 5419b495e3df96a658e1323c83f7faf9
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_i386.deb
Size/MD5 checksum: 5713300 1bc2a3ab8b321b543a1ae92590e76f8b
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_i386.deb
Size/MD5 checksum: 16546 71e4044ff8d923cd56d4bb046be1b37f
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_ia64.deb
Size/MD5 checksum: 20404 cdea8cf2f6cd2b8a761ccca2a2d85421
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_ia64.deb
Size/MD5 checksum: 5905266 98f5de1716817b660791a92d5ee7c6a6
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_ia64.deb
Size/MD5 checksum: 19140 d780e22f3cd6c6204de3db711f068dcd
HP Precision architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_hppa.deb
Size/MD5 checksum: 18560 70ae8b43a0cd581a36a8097fc94c2172
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_hppa.deb
Size/MD5 checksum: 5687318 a241f7e800ac5cbd7f45fdafeae267ac
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_hppa.deb
Size/MD5 checksum: 17710 c1848801758081872515d88f86938537
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_m68k.deb
Size/MD5 checksum: 17184 d64fcc89500919e03805e47dbb9eca52
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_m68k.deb
Size/MD5 checksum: 5708190 0d20df48cd437a99544bf748a1c89ea9
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_m68k.deb
Size/MD5 checksum: 16404 0e47447d4b7007d4016c32a81f2b66f4
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_mips.deb
Size/MD5 checksum: 18416 38f460cbf16a6c2a3c735c5a6545013a
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_mips.deb
Size/MD5 checksum: 5729074 76787645b83e4438fc79325410114c99
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_mips.deb
Size/MD5 checksum: 17700 8cbf4e1556b59d982589d27e5af1211e
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_mipsel.deb
Size/MD5 checksum: 18460 dfaad60fd479b74c72c46680d92c5920
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_mipsel.deb
Size/MD5 checksum: 5726846 0d9ad0d53eddd3503cdc2fce6b118595
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_mipsel.deb
Size/MD5 checksum: 17734 a74a4df56930cd6e1ec289a714fe2225
PowerPC architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_powerpc.deb
Size/MD5 checksum: 19600 0fbb4093db271d5924d8e1fb81d0c5c3
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_powerpc.deb
Size/MD5 checksum: 5677812 543192c6a5b6b89fdc0cc0c5b3f2befe
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_powerpc.deb
Size/MD5 checksum: 17556 bd868a198744609509201e7af0e33ab9
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_s390.deb
Size/MD5 checksum: 17974 f16109dd971b139abc8a2194731e33c8
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_s390.deb
Size/MD5 checksum: 5768028 dfda84e8d1a0e53794418a77a09d801f
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_s390.deb
Size/MD5 checksum: 17918 da3bb3df7f86443b1f36ed4b5bcc0113
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_sparc.deb
Size/MD5 checksum: 17480 1ef23c92384723ab64b315b7d8d51089
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_sparc.deb
Size/MD5 checksum: 5752164 91a3ad11d2f029e99955b2c54088e034
http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_sparc.deb
Size/MD5 checksum: 16696 87e4150b6738d9921728a1e594bc4904
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<;pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDxMoyW5ql+IAeqTIRAoa3AJ4wdQARyff9H2Mjm+0DBiZr4i2HXACfT3tc
/HQ6b6/FOirsuLBIBvIWdew=
=McFo
-----END PGP SIGNATURE-----
