Re: [SECURITY] [DSA 1123-1] New libdumb packages fix arbitrary code execution
s
----- Original Message -----
From: "Moritz Muehlenhoff" <jmm@debian.org>
To: <debian-security-announce@lists.debian.org>
Sent: Monday, July 24, 2006 7:40 PM
Subject: [SECURITY] [DSA 1123-1] New libdumb packages fix arbitrary code execution
| -----BEGIN PGP SIGNED MESSAGE-----
| Hash: SHA1
|
| - --------------------------------------------------------------------------
| Debian Security Advisory DSA 1123-1 security@debian.org
| http://www.debian.org/security/ Moritz Muehlenhoff
| July 24th, 2006 http://www.debian.org/security/faq
| - --------------------------------------------------------------------------
|
| Package : libdumb
| Vulnerability : buffer overflow
| Problem-Type : local(remote)
| Debian-specific: no
| CVE ID : CVE-2006-3668
| Debian Bug : 379064
|
| Luigi Auriemma discovered that DUMB, a tracker music library, performs
| insufficient sanitising of values parsed from IT music files, which might
| lead to a buffer overflow and execution of arbitrary code if manipulated
| files are read.
|
| For the stable distribution (sarge) this problem has been fixed in
| version 0.9.2-6.
|
| For the unstable distribution (sid) this problem has been fixed in
| version 0.9.3-5.
|
| We recommend that you upgrade your libdumb packages.
|
|
| Upgrade Instructions
| - --------------------
|
| wget url
| will fetch the file for you
| dpkg -i file.deb
| will install the referenced file.
|
| If you are using the apt-get package manager, use the line for
| sources.list as given below:
|
| apt-get update
| will update the internal database
| apt-get upgrade
| will install corrected packages
|
| You may use an automated update by adding the resources from the
| footer to the proper configuration.
|
|
| Debian GNU/Linux 3.1 alias sarge
| - --------------------------------
|
| Source archives:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb_0.9.2-6.dsc
| Size/MD5 checksum: 634 32242f365a1433e66ca9e46a004523df
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb_0.9.2-6.diff.gz
| Size/MD5 checksum: 3914 65aa4b7596e81c622e830bbe1d32ff22
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb_0.9.2.orig.tar.gz
| Size/MD5 checksum: 145722 0ce45f64934e6d5d7b82a55108596680
|
| Alpha architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_alpha.deb
| Size/MD5 checksum: 75276 b7f57922166c536f19b965d3ab0d88fe
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_alpha.deb
| Size/MD5 checksum: 6090 06c293edff58a482fcf6084c4b5d934a
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_alpha.deb
| Size/MD5 checksum: 121546 715574ff400819fd703793d4ecf75fad
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_alpha.deb
| Size/MD5 checksum: 72390 31d5b7901bc0812b9348eb876cc15b8d
|
| AMD64 architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_amd64.deb
| Size/MD5 checksum: 74780 04d899dbf1e150f1f9568457d34b6fdd
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_amd64.deb
| Size/MD5 checksum: 5244 d0bdb1d783d860280176b190677a4052
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_amd64.deb
| Size/MD5 checksum: 109360 712603865afd1d04e536c453bf1ae373
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_amd64.deb
| Size/MD5 checksum: 52534 87514a167dc9e6a00ee98c496721b2ae
|
| ARM architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_arm.deb
| Size/MD5 checksum: 73954 edb9623bfb0753b9ac8adf7fba5acfd1
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_arm.deb
| Size/MD5 checksum: 4738 f5afa9198afce1f16e625e7e41618f71
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_arm.deb
| Size/MD5 checksum: 110002 542706c4b04ca773be469d066cce125b
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_arm.deb
| Size/MD5 checksum: 54256 6f59fabcf506f6508e86b42ae6ae78ad
|
| Intel IA-32 architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_i386.deb
| Size/MD5 checksum: 74484 1c721ae454752d3a252f1cfc9a773d41
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_i386.deb
| Size/MD5 checksum: 4738 e4b77e2545480a205f675e39017efc58
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_i386.deb
| Size/MD5 checksum: 108496 ead6a0b39172a059491c864b9985101f
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_i386.deb
| Size/MD5 checksum: 47478 a0d02ff38ef6791845756ca2394a4bc5
|
| Intel IA-64 architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_ia64.deb
| Size/MD5 checksum: 76358 88a9e82bf0c85d8f0b6db2a718c40a9a
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_ia64.deb
| Size/MD5 checksum: 6312 953f7b5387e0d99715cf0c7b047bef9a
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_ia64.deb
| Size/MD5 checksum: 134560 53dae1f7002cd4c795c8d42990470973
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_ia64.deb
| Size/MD5 checksum: 78760 0b70e7b9b4e67399e0e7cdfb94c2122d
|
| HP Precision architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_hppa.deb
| Size/MD5 checksum: 75286 7817acef6001881bcea7611ffd538b7d
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_hppa.deb
| Size/MD5 checksum: 5414 b399bd5949caccf4cb02ada6a4b7d4f3
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_hppa.deb
| Size/MD5 checksum: 116320 a69a36e0c23670499781c2a77611bfae
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_hppa.deb
| Size/MD5 checksum: 57774 032d891a6aeda5932fcc8ad6fa64d372
|
| Motorola 680x0 architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_m68k.deb
| Size/MD5 checksum: 74204 43c5cd2ae45c7871e27bcb0fc948b17e
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_m68k.deb
| Size/MD5 checksum: 4596 560f752f7433cf6a743a18d4b7636e1d
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_m68k.deb
| Size/MD5 checksum: 105372 785d07eaebf837f71a5ad3b017100f88
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_m68k.deb
| Size/MD5 checksum: 44940 606b5f441e61305b304f58a3bdd1ab5b
|
| Big endian MIPS architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_mips.deb
| Size/MD5 checksum: 74418 d88ed88421fd473176eda13e168b2ae5
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_mips.deb
| Size/MD5 checksum: 5484 fcdfa364a97466a423aa8bf9646fe904
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_mips.deb
| Size/MD5 checksum: 111414 01edc258404ab63fe164fea1930476f2
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_mips.deb
| Size/MD5 checksum: 56954 99e88c70e885558040177fb634c0a027
|
| Little endian MIPS architecture:
|
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_mipsel.deb
| Size/MD5 checksum: 74416 0eda36c34e3962aa3dd84c1a0092372a
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_mipsel.deb
| Size/MD5 checksum: 5468 13f0d69dda9223f444a94ea0ca1d6843
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_mipsel.deb
| Size/MD5 checksum: 111572 f82a7f553c8e1fe5b40bb6d676e7af77
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_mipsel.deb
| Size/MD5 checksum: 57134 c41f1608565019146d563859d8df849f
|
| PowerPC architecture:
|
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_powerpc.deb
| Size/MD5 checksum: 75934 15e1e9c231b1fa79002285249aa1868f
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_powerpc.deb
| Size/MD5 checksum: 4932 bda0bd686f1711f9ba4d9fefb6cd1df4
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_powerpc.deb
| Size/MD5 checksum: 112666 450a7cc5c2c6134dda51bbe17bedade0
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_powerpc.deb
| Size/MD5 checksum: 53122 8c7ef44c26a5eb803456b1484e86780b
|
| IBM S/390 architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_s390.deb
| Size/MD5 checksum: 75080 69120a96775c9ce4da1005e88285bfc7
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_s390.deb
| Size/MD5 checksum: 5118 c80b9f07677b5cd0efef90d75e4f2226
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_s390.deb
| Size/MD5 checksum: 114394 171899c4214e870b72c0be62113d866b
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_s390.deb
| Size/MD5 checksum: 53434 b0d7b9822aae29da009fbe70602992c6
|
| Sun Sparc architecture:
|
| http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0_0.9.2-6_sparc.deb
| Size/MD5 checksum: 74112 dfeda909f974a6ca36404bbe87887d5a
|
http://security.debian.org/pool/updates/main/libd/libdumb/libaldmb0-dev_0.9.2-6_sparc.deb
| Size/MD5 checksum: 4782 9dcd795ae35d0136d30e36634278a44f
| http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0_0.9.2-6_sparc.deb
| Size/MD5 checksum: 111376 9e364aa1a08ef44ee0b1704158f9649a
|
http://security.debian.org/pool/updates/main/libd/libdumb/libdumb0-dev_0.9.2-6_sparc.deb
| Size/MD5 checksum: 51554 c2d5966066dd655303b3f431bd09de4d
|
|
| These files will probably be moved into the stable distribution on
| its next update.
|
| - ---------------------------------------------------------------------------------
| For apt-get: deb http://security.debian.org/ stable/updates main
| For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
| Mailing list: debian-security-announce@lists.debian.org
| Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
| -----BEGIN PGP SIGNATURE-----
| Version: GnuPG v1.4.3 (GNU/Linux)
|
| iD8DBQFExQW4Xm3vHE4uyloRAouZAJ96R9dDMVIHXcgUAWF7p8aBIY/hrQCgiPe6
| FpXhO7XJb0I3qa6ppARmmNc=
| =Ms9D
| -----END PGP SIGNATURE-----
|
|
|
|
|
| --
| To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
| with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
|
|
Reply to: