[BSA-041] Security Update for xml-security-c
-----BEGIN PGP SIGNED MESSAGE-----
Russ Allbery uploaded new packages for xml-security-c which fixed the
following security problems:
It has been discovered that xml-security-c, an implementation of the
XML Digital Signature and Encryption specifications, is not properly
handling RSA keys of sizes on the order of 8192 or more bits. This
allows an attacker to crash applications using this functionality or
potentially execute arbitrary code by tricking an application into
verifying a signature created with a sufficiently long RSA key.
For the lenny-backports distribution, this problem has been fixed in
We recommend that you upgrade your xml-security-c packages.
If you don't use pinning (see ) you have to update the package
manually via "apt-get -t lenny-backports install <packagelist>" with
the packagelist of your installed packages affected by this update.
We recommend to pin (in /etc/apt/preferences) the backports repository to
200 so that new versions of installed backports will be installed
Pin: release a=lenny-backports
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-----END PGP SIGNATURE-----