Re: [SECURITY] [DSA 2422-1] file security update
Hi,
I've done the latest update, but apt-cache show file still shows
version 5.04-5 available, instead of 5.04-5+squeeze1.
My sources.list contains:
deb http://ftp.us.debian.org/debian/ squeeze main contrib non-free
deb-src http://ftp.us.debian.org/debian/ squeeze main contrib non-free
deb http://ftp.us.debian.org/debian/ squeeze-updates main contrib non-free
deb-src http://ftp.us.debian.org/debian/ squeeze-updates main contrib non-free
deb http://security.debian.org/ squeeze/updates main contrib non-free
deb-src http://security.debian.org/ squeeze/updates main contrib non-free
Thanks,
- Chris
On Wed, Feb 29, 2012 at 09:54:44PM +0100, Florian Weimer wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - -------------------------------------------------------------------------
> Debian Security Advisory DSA-2422-1 security@debian.org
> http://www.debian.org/security/ Florian Weimer
> February 29, 2012 http://www.debian.org/security/faq
> - -------------------------------------------------------------------------
>
> Package : file
> Vulnerability : missing bounds checks
> Problem type : remote
> Debian-specific: no
>
> The file type identification tool, file, and its associated library,
> libmagic, do not properly process malformed files in the Composite
> Document File (CDF) format, leading to crashes.
>
> Note that after this update, file may return different detection
> results for CDF files (well-formed or not). The new detections are
> believed to be more accurate.
>
> For the stable distribution (squeeze), this problem has been fixed in
> version 5.04-5+squeeze1.
>
> We recommend that you upgrade your file packages.
>
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: http://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
>
> iQEcBAEBAgAGBQJPTpUrAAoJEL97/wQC1SS+xjIH/RKCNTX9XDy9RmKnLubx5gME
> e3MOWFZHk0ZOaNAuorRmyrxygbRkLPVMNECTKenv2eE1CORYIHBvzFDZXNn0Yl+9
> +NS2KkmwpigU33Tu/8NfuG/xsoLl9fS1a3iJU+yVeEC14gdr0Nw5OtLzSP5C6HUS
> KcXZRXQZoHs21SrdotBm0Lx86tmoluZ1QtWmlacJcFnGwMLi3sRBwkE57UufEgCj
> dd8BD79tdVWm2YlPjnnfpG8Pe+ikq4tIxDHEKHfsFudUxgeSDAZaHjBvF/2xXrxn
> nEjOjbCpaQT9hUaaBzAxFh10qPiKKV4oA3ueR1RZt/T8XMbTXJAM54NYutF2b7Q=
> =kRH8
> -----END PGP SIGNATURE-----
>
>
> --
> To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> Archive: http://lists.debian.org/87aa41e4x7.fsf@mid.deneb.enyo.de
Reply to: