[SECURITY] [DSA 1634-1] New wordnet packages fix arbitrary code execution
Date: Mon, 1 Sep 2008 21:17:47 +0200 (CEST)
From: [email protected] (Thijs Kinkhorst)
Subject: [SECURITY] [DSA 1634-1] New wordnet packages fix arbitrary code execution
Priority: urgent
Resent-Message-ID: <unztPUM0AdF.A.lqC.i_DvIB@liszt.>
Reply-To: [email protected]
Mail-Followup-To: [email protected]
To: [email protected]
Resent-Date: Mon, 1 Sep 2008 19:17:54 +0000 (UTC)
Resent-From: [email protected] (Mailing List Manager)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1634-1 [email protected]
http://www.debian.org/security/ Thijs Kinkhorst
September 01, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : wordnet
Vulnerability : stack and heap overflows
Problem type : local (remote)
Debian-specific: no
CVE id(s) : CVE-2008-2149
Debian Bug : 481186
Rob Holland discovered several programming errors in WordNet, an
electronic lexical database of the English language. These flaws could
allow arbitrary code execution when used with untrusted input, for
example when WordNet is in use as a back end for a web application.
For the stable distribution (etch), these problems have been fixed in
version 1:2.1-4+etch1.
For the testing distribution (lenny), these problems have been fixed in
version 1:3.0-11+lenny1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your wordnet package.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Source archives:
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1.dsc
Size/MD5 checksum: 772 24980d288101a1c11e60e38fe5ea945a
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1.diff.gz
Size/MD5 checksum: 22912 bb970bd2ccd457c6310ba0c75e5ed2be
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1.orig.tar.gz
Size/MD5 checksum: 6379385 95a6e8144254a92a5ea0e97771ef9d07
Architecture independent packages:
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-sense-index_2.1-4+etch1_all.deb
Size/MD5 checksum: 2242538 dc75e162b0013a5d7d0c0679115b134c
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-base_2.1-4+etch1_all.deb
Size/MD5 checksum: 8701430 a680094a45ddf87dd0bcbb5fd63ceae2
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_alpha.deb
Size/MD5 checksum: 80734 3186aeb6b9365a333fdd608d5fa62ffe
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_alpha.deb
Size/MD5 checksum: 109466 cc441b73b2ded97fff9fc5c668f2fbb0
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_amd64.deb
Size/MD5 checksum: 104990 b7b3225b10df973e2d8a652f770a6e1b
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_amd64.deb
Size/MD5 checksum: 65118 bc75f17d4f5b1375fc3862ba80335d2f
arm architecture (ARM)
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_arm.deb
Size/MD5 checksum: 61020 57e49d1f532015f07cbf3f71bba24237
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_arm.deb
Size/MD5 checksum: 100056 43a1c7d6c272412f4f1eff5ff284fd54
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_hppa.deb
Size/MD5 checksum: 108312 f6ed8345d69a1e13e9cd87f7974566fd
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_hppa.deb
Size/MD5 checksum: 69896 a1649115a5bba73602f4c6dba8a57964
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_i386.deb
Size/MD5 checksum: 63096 ff93d37e8edeb63fd9268b19b052f3e2
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_i386.deb
Size/MD5 checksum: 101738 65a6a41a5bf4de85c6ce474de7155c73
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_ia64.deb
Size/MD5 checksum: 83014 98d7592aac60e394cca7262dbae45dc5
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_ia64.deb
Size/MD5 checksum: 119716 a4a53c0fe7acf1828386d2e08e443b7a
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_mips.deb
Size/MD5 checksum: 105498 f76685b8631f82c01b0fc604d22cb7b3
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_mips.deb
Size/MD5 checksum: 73082 73a315a1e3706cc313559c7f8532232f
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_mipsel.deb
Size/MD5 checksum: 104700 22d5b12949930d49d4d49ac63f106747
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_mipsel.deb
Size/MD5 checksum: 71604 78f164f9758891934cb3854c8a10c6e7
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_powerpc.deb
Size/MD5 checksum: 108852 0b0448af12ac1052b11833252a269765
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_powerpc.deb
Size/MD5 checksum: 69846 44d14734b11f31fb1f3522d68fae68ad
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_s390.deb
Size/MD5 checksum: 107032 a83524f4bc09a6f78a53216356043175
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_s390.deb
Size/MD5 checksum: 65640 241a7fa7673077cfc762492a44c7764d
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_sparc.deb
Size/MD5 checksum: 102918 1f7f85106a3f41cfc2162db49ce0ac1f
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_sparc.deb
Size/MD5 checksum: 64812 89d27a34508044af76f2eeac4e1c696a
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<;pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBSLw/n2z0hbPcukPfAQJtQwgAsW+ORtd4lhMAsOaZ6mFQrHj3EJ7AnXRH
0hMoBxUM/ViyWJ/iKFgGKzbmAndl/ylRH3dWKkd4j/E08yQocvM5Ym3kSlV9ni1X
sF6zNdD8eY9FLT6Ja7yT5RrKn7rriNhAr9MaktMq276eCaCpSoB85KfhJ+UGapPJ
cMXLPW59z5BqgFi708stButXe0PHUmMcp/Zd+pvSTvsH+fLaxKK3DBRp2pH4DNLM
Dceugrdzt10uZfeZGRClcDAX4u9HUPwHs7gW7EuaQH5Ni7Y+aZhsigJOGTOl4DOF
4nEgh5eth1WJ0iK1I01KOunfhXVxXWAxh6b27sZbHhpAvYoYl3aKNg==
=EsVl
-----END PGP SIGNATURE-----
