[SECURITY] [DSA 1579-1] New netpbm-free packages fix arbitrary code execution
From: Devin Carraway <devin@debian.org.>
Date: Sun, 18 May 2008 11:29:26 +0200 (CEST)
Subject: [SECURITY] [DSA 1579-1] New netpbm-free packages fix arbitrary code execution
Priority: urgent
Resent-Message-ID: <zDc37oilLKJ.A.XCC.6b_LIB@liszt.>
Reply-To: [email protected]
Mail-Followup-To: [email protected]
To: [email protected]
Resent-Date: Sun, 18 May 2008 09:29:30 +0000 (UTC)
Resent-From: [email protected] (Mailing List Manager)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1579-1 [email protected]
http://www.debian.org/security/ Devin Carraway
May 18, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : netpbm-free
Vulnerability : insufficient input sanitizing
Problem type : local (remote)
Debian-specific: no
CVE Id(s) : CVE-2008-0554
A vulnerability was discovered in the GIF reader implementation in
netpbm-free, a suite of image manipulation utilities. Insufficient
input data validation could allow a maliciously-crafted GIF file
to overrun a stack buffer, potentially permitting the execution of
arbitrary code.
For the stable distribution (etch), these problems have been fixed in
version 2:10.0-11.1+etch1.
For the unstable distribution (sid), these problems were fixed in
version 2:10.0-11.1.
We recommend that you upgrade your netpbm packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Source archives:
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm-free_10.0-11.1+etch1.diff.gz
Size/MD5 checksum: 49833 5e340881bb56e88ca2525c5baf3a12cf
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm-free_10.0.orig.tar.gz
Size/MD5 checksum: 1926538 985e9f6d531ac0b2004f5cbebdeea87d
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm-free_10.0-11.1+etch1.dsc
Size/MD5 checksum: 755 e8b82a4cab1e4352faf53d6093ff02d1
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_alpha.deb
Size/MD5 checksum: 84206 b33236e6b1bfd895231905579583ec1c
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_alpha.deb
Size/MD5 checksum: 139256 4dde0418859c0a44e8abbd5a8888bc97
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_alpha.deb
Size/MD5 checksum: 75730 5ba8dac319fcb09e6057edcf339031da
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_alpha.deb
Size/MD5 checksum: 1423650 928d158de222f0aad537d2e9d5a55d1c
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_alpha.deb
Size/MD5 checksum: 138864 d72de0e9205fafc74ed5a61574f90a89
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_amd64.deb
Size/MD5 checksum: 75412 c87cf158e0234259584f584a9f1832b5
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_amd64.deb
Size/MD5 checksum: 1241558 470cca7fe0cafa9a3ef519e45911989f
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_amd64.deb
Size/MD5 checksum: 116838 1444d40f6022a1650c8ebcf5041ba6ef
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_amd64.deb
Size/MD5 checksum: 67404 c11ac33a59b828227df65f030d4b0ecd
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_amd64.deb
Size/MD5 checksum: 117288 aa57bddc977bfcaae40c4d2e0dfab247
arm architecture (ARM)
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_arm.deb
Size/MD5 checksum: 62288 4f73d9da53ef5fca46b720787b69a937
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_arm.deb
Size/MD5 checksum: 1260142 3aad360491069ca71cb1fd79a54047b3
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_arm.deb
Size/MD5 checksum: 109834 a9b24a209be2c2a05183d5a501981669
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_arm.deb
Size/MD5 checksum: 68692 02d48f5f058f67b7d2007332c214211d
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_arm.deb
Size/MD5 checksum: 110104 7e35448f17f029ad74902589aae0c0c5
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_hppa.deb
Size/MD5 checksum: 1333920 a56ad3bc6edba6f0c8aeeb90a05b24ae
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_hppa.deb
Size/MD5 checksum: 82594 68fa87cdf4869bc89047fe0ad48cb1cf
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_hppa.deb
Size/MD5 checksum: 125684 7df0ea27cbd816e3c4846bd4714907c4
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_hppa.deb
Size/MD5 checksum: 125788 49bdc7c577ccfee26adfd44187e7098d
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_hppa.deb
Size/MD5 checksum: 73896 5cd54f6760f1d0a74899aa5b1eeeefee
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_i386.deb
Size/MD5 checksum: 63758 f905f22588b614831324060426e5751d
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_i386.deb
Size/MD5 checksum: 1181300 365c86b4233a807c3c6c10f800da4afa
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_i386.deb
Size/MD5 checksum: 70202 591a522cb5cc225858e8ef59c0b0229e
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_i386.deb
Size/MD5 checksum: 109860 c1011f89b554328ff82cd01451e667c1
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_i386.deb
Size/MD5 checksum: 109718 c1130da9304e855827b99d4c2202a5b2
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_ia64.deb
Size/MD5 checksum: 101310 e695256a27385dee8fb2f8ddf1ccb151
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_ia64.deb
Size/MD5 checksum: 92042 a2df3ed51d279ad0191401d7db0a29de
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_ia64.deb
Size/MD5 checksum: 1759566 1f58b0302e2394d09bf3fcc423ee77ec
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_ia64.deb
Size/MD5 checksum: 149610 8458ab3ca7477d7011b815e31651a74a
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_ia64.deb
Size/MD5 checksum: 149986 dc3f0e6f5e4511c5970a0bcd726d8f3b
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_mips.deb
Size/MD5 checksum: 124128 fad3edf3cf23f0bf7d13660bbb02795e
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_mips.deb
Size/MD5 checksum: 123212 5331c9d21f4e49029a2d6afc8e88fbcd
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_mips.deb
Size/MD5 checksum: 73522 ff8075e6113bf9f387798a142c8d07a8
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_mips.deb
Size/MD5 checksum: 1318050 688e833af5f7ed3dcaf6c8b803acab6b
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_mips.deb
Size/MD5 checksum: 65826 f6f9b8c34d1fc3ecb332baf87144cc67
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_mipsel.deb
Size/MD5 checksum: 123410 7e7c4c3649a11e6c5d2bac60511a2608
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_mipsel.deb
Size/MD5 checksum: 65710 dff78e7f50f68e0e942323af94c69af5
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_mipsel.deb
Size/MD5 checksum: 1297700 ed5a3f2a53460072beae27697d68bb31
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_mipsel.deb
Size/MD5 checksum: 72604 b5a39f3389ede6a53b330e761db9d0e8
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_mipsel.deb
Size/MD5 checksum: 123830 2593cde97437a5d9c33ac978a948bbeb
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_powerpc.deb
Size/MD5 checksum: 119758 e917d3ac53867792653b8a7d2d090824
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_powerpc.deb
Size/MD5 checksum: 79014 ee2fd0a785658b116b877f951b8e1531
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_powerpc.deb
Size/MD5 checksum: 1448810 c24163baecf73aa5452954e1f4c04b05
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_powerpc.deb
Size/MD5 checksum: 119366 26fc1ef0d6d24cc8c0ea956b9cc12f9c
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_powerpc.deb
Size/MD5 checksum: 68122 8ef7a20dc73a9e293cf5b15bf33ead0d
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_s390.deb
Size/MD5 checksum: 1245934 825184a22f4476b277cade23ec93cbf5
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_s390.deb
Size/MD5 checksum: 76472 005fc9caafb6eb047701e3f5272d0bbe
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_s390.deb
Size/MD5 checksum: 114788 ba4a56d368c612f161f3e0c983e98bd6
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_s390.deb
Size/MD5 checksum: 115006 4c1b4a388455a0725771dfb5c73f8ddc
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_s390.deb
Size/MD5 checksum: 69900 bf8bf3369a29c340eb035413034cccae
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9-dev_10.0-11.1+etch1_sparc.deb
Size/MD5 checksum: 111782 e2553ed79f836d8fa1dc25422ba8aa95
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm9_10.0-11.1+etch1_sparc.deb
Size/MD5 checksum: 68808 4ee6c9653cd560ec0074275b457202b7
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10-dev_10.0-11.1+etch1_sparc.deb
Size/MD5 checksum: 111562 e126024c8567d3140c240e60ecc390dc
http://security.debian.org/pool/updates/main/n/netpbm-free/netpbm_10.0-11.1+etch1_sparc.deb
Size/MD5 checksum: 1204234 85d633a743c51efea0122caa7e12c6ea
http://security.debian.org/pool/updates/main/n/netpbm-free/libnetpbm10_10.0-11.1+etch1_sparc.deb
Size/MD5 checksum: 62992 efe34ea795e4c875ab65c28f413a590f
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<;pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQEUAwUBSC/2iWz0hbPcukPfAQLyPgf2MvGbXy5foPi9uyzUu1beoK4VwMVBv2Fp
McQJv2NyEeJ2zhI6Axnk0EFKLNyATvPVoHkSF4IGBhqW9inR40AMVwRgLDsDvWsw
S3R/xfd+0JnIhyc+i+lOxNbT9fUlZTfTVnot4IKKf9WMg7vAdBcj3VEAopr+4dTh
cHQ0GJeIYb5EUriwxv3dR7gRgKE8UI1EFVdDMj8y49hAgtGIZ4kbGplVxabLp0Pw
sOPZir7jPrJ3OTSVuT3IUGtu52o232BJpSmFSJ1fkQFXhqjSgrlqG+WdlqHnzXxV
lRVsk1APdvD5OFJ7MBKrKNe3sQmiVb2WUbWN8yB9mYOn1TmTXgCz
=XTgI
-----END PGP SIGNATURE-----
