"-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1912-1 security@debian.org
http://www.debian.org/security/ Steffen Joeris
October 16, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : camlimages
Vulnerability : integer overflow
Problem type : local (remote)
Debian-specific: no
CVE Ids : CVE-2009-3296 CVE-2009-2660
It was discovered that CamlImages, an open source image processing
library, suffers from several integer overflows, which may lead to a
potentially exploitable heap overflow and result in arbitrary code
execution. This advisory addresses issues with the reading of TIFF
files. It also expands the patch for CVE-2009-2660 to cover another
potential overflow in the processing of JPEG images.
For the oldstable distribution (etch), this problem has been fixed in
version 2.20-8+etch3.
For the stable distribution (lenny), this problem has been fixed in
version 1:2.2.0-4+lenny3.
For the testing distribution (squeeze) and the unstable distribution
(sid), this problem will be fixed soon.
We recommend that you upgrade your camlimages package.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Debian (oldstable)
- ------------------
Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/c/camlimages/camlimages_2.20-8+etch3.dsc
Size/MD5 checksum: 1545 1170baf359b7ca7bd0490a4482e2cdcd
http://security.debian.org/pool/updates/main/c/camlimages/camlimages_2.20-8+etch3.diff.gz
Size/MD5 checksum: 9758 0c6c814cf06b854f2078747d166d714f
http://security.debian.org/pool/updates/main/c/camlimages/camlimages_2.20.orig.tar.gz
Size/MD5 checksum: 1385525 d933eb58c7983f70b1a000fa01893aa4
Architecture independent packages:
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-doc_2.20-8+etch3_all.deb
Size/MD5 checksum: 598648 ee530d7dc14ff4250358f7354fc4a8a1
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_alpha.deb
Size/MD5 checksum: 1024484 72e9aea9c06f1ae264d70d1f7a6c85d2
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_alpha.deb
Size/MD5 checksum: 29570 eaa6ec5925c36acc5a155c72c7f29b01
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_amd64.deb
Size/MD5 checksum: 872188 24f06eda9f7ca39b28b25932981b4cda
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_amd64.deb
Size/MD5 checksum: 28126 7d3cf0404d52d005103206dd7f30aa8a
arm architecture (ARM)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_arm.deb
Size/MD5 checksum: 26196 6c735d474717b7025b1b594bf515a2de
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_arm.deb
Size/MD5 checksum: 880106 7e9b0c0b13949b71f1a23010f5ef68c8
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_hppa.deb
Size/MD5 checksum: 30408 6c6afd274d1f944887d318394efe1dc2
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_hppa.deb
Size/MD5 checksum: 483264 1f1f707859dca186cc518241390f6b84
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_i386.deb
Size/MD5 checksum: 24670 01ed837cea61b5fd6143edaede81636c
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_i386.deb
Size/MD5 checksum: 845016 a2a7c9d64df8e2be8933ff994c9ace7e
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_ia64.deb
Size/MD5 checksum: 1102148 001cb473b718078fbe7186f7e772633e
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_ia64.deb
Size/MD5 checksum: 36800 d877b308032849966a1f6cb5c2a00b6a
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_mips.deb
Size/MD5 checksum: 428882 bd86f4f9c1158b4776008370b41be622
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_mips.deb
Size/MD5 checksum: 25790 de5ac9debe1bb1348b951cb9f1dfd388
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_mipsel.deb
Size/MD5 checksum: 25834 768d6a896e11ae46e179f35190995f57
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_mipsel.deb
Size/MD5 checksum: 428224 58c7839e5389a64094606de277d087ba
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_powerpc.deb
Size/MD5 checksum: 895248 43b16604d6881ab4804f94456048a48a
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_powerpc.deb
Size/MD5 checksum: 32570 f1af72abb55c3e32f9ae222bdfc22056
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.20-8+etch3_sparc.deb
Size/MD5 checksum: 25030 210e8127fb4036a1f1992e07d2157352
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.20-8+etch3_sparc.deb
Size/MD5 checksum: 935978 15ef02c3ce9d7459f8671312167549e0
Debian GNU/Linux 5.0 alias lenny
- --------------------------------
Debian (stable)
- ---------------
Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/c/camlimages/camlimages_2.2.0-4+lenny3.diff.gz
Size/MD5 checksum: 10720 d4f5baa708d8aa4712fcc33c1f7ffff3
http://security.debian.org/pool/updates/main/c/camlimages/camlimages_2.2.0-4+lenny3.dsc
Size/MD5 checksum: 2345 4ad8de6c2d37f872d7c2e2b0ab43b808
http://security.debian.org/pool/updates/main/c/camlimages/camlimages_2.2.0.orig.tar.gz
Size/MD5 checksum: 1385525 d933eb58c7983f70b1a000fa01893aa4
Architecture independent packages:
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-doc_2.2.0-4+lenny3_all.deb
Size/MD5 checksum: 599582 10bab3213572595c00e0352af8f4dfe4
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_alpha.deb
Size/MD5 checksum: 592116 06ab9d71856b10193bc79f01aedf8756
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_alpha.deb
Size/MD5 checksum: 32984 a17be3ec372d3c4d6a1a8168f8e9f32e
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_amd64.deb
Size/MD5 checksum: 980586 f534bd73c8d30474e828a240b3e2b4a5
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_amd64.deb
Size/MD5 checksum: 31590 80a337fa12104d9c0fce29ff8f461ed2
arm architecture (ARM)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_arm.deb
Size/MD5 checksum: 572050 605f010519b443711d7cd522583bb926
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_arm.deb
Size/MD5 checksum: 29434 f76c8d0f13a1543951849c977f4e70b1
armel architecture (ARM EABI)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_armel.deb
Size/MD5 checksum: 571320 3c100fd7afae68885505eecc94af093e
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_armel.deb
Size/MD5 checksum: 30372 fe84c2007671320780b8a728e6273764
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_hppa.deb
Size/MD5 checksum: 33366 8a28b12eae0b4e3b7286b3f891f3568f
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_hppa.deb
Size/MD5 checksum: 589268 e25d4c0c1e381e3d694cc71a1ea2d7b5
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_i386.deb
Size/MD5 checksum: 935914 0fb5e0b4a858dcbdd5d90e743ef90226
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_i386.deb
Size/MD5 checksum: 28040 468978ba1d5eab25954dea743ed7676c
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_ia64.deb
Size/MD5 checksum: 40320 0cad2f2198840bd55f29ba2e3554faa8
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_ia64.deb
Size/MD5 checksum: 546854 4d0e5c2498ff2de52a7657d6c9fb570d
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_mips.deb
Size/MD5 checksum: 28634 b16e535428d491997508a80036624255
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_mips.deb
Size/MD5 checksum: 517920 519bc5fab6b7de22b9f14da703f2def8
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_mipsel.deb
Size/MD5 checksum: 28662 93f62626a5451e1721b6bbacf8124e15
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_mipsel.deb
Size/MD5 checksum: 516758 91cf3745a3cca541514057f4a7ac628a
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_powerpc.deb
Size/MD5 checksum: 39120 13370abfdd27dd90c30bad71752ac033
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_powerpc.deb
Size/MD5 checksum: 988834 0eebdfd25514ec7449fd345f42df562f
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml_2.2.0-4+lenny3_sparc.deb
Size/MD5 checksum: 28332 147a027feb48eabf9e836d553ca3da94
http://security.debian.org/pool/updates/main/c/camlimages/libcamlimages-ocaml-dev_2.2.0-4+lenny3_sparc.deb
Size/MD5 checksum: 1041264 3de6d0ac50434c647e544181d115cee1
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAkrYSTYACgkQ62zWxYk/rQeunQCdHYBog6ekM3gl3yEHxHbCjdJ6
09AAoL91LGNRUgz8XqN2ywg6g66vVe22
=HoVL
-----END PGP SIGNATURE-----
"
DSA 1910-1: New mysql-ocaml packages provide secure escapingMoby to release ltd edition deluxe version of Wait For Me
This entry was posted
on 9:09 AM
.
Archives
-
▼
2009
(488)
-
▼
October
(44)
- DSA 1915-1: New Linux 2.6.26 packages fix several ...
- RHSA-2009:1529-01 Moderate: samba security update
- USN-850-2: poppler regression
- GLSA 200910-03 Adobe Reader: Multiple vulnerabili...
- DSA 1919-1: New smarty packages fix several vulner...
- DSA 1917-1: New mimetex packages fix several vulne...
- DSA 1912-2: New advi packages fix arbitrary code e...
- GLSA 200910-02 Pidgin: Multiple vulnerabilities
- USN-850-1: poppler vulnerabilities
- RHSA-2009:1522-01 Moderate: kernel security and bu...
- RHSA-2009:1512-01 Important: kdegraphics security ...
- DSA 1912-1: New camlimages fix arbitrary code exec...
- DSA 1913-1: New bugzilla packages fix SQL injection
- DSA 1911-1: New pygresql packages provide secure e...
- RHSA-2009:1499-01 Critical: acroread security update
- RHSA-2009:1501-01 Important: xpdf security update
- USN-848-1: Zope vulnerabilities
- RHSA-2009:1503-01 Important: gpdf security update
- RHSA-2009:1505-01 Moderate: java-1.4.2-ibm securit...
- RHSA-2009:1504-01 Important: poppler security and ...
- DSA 1910-1: New mysql-ocaml packages provide secur...
- USN-849-1: libsndfile vulnerabilities
- RHSA-2009:1502-01 Important: kdegraphics security ...
- RHSA-2009:1513-01 Moderate: cups security update
- USN-847-1: Devscripts vulnerability
- DSA 1895-2: New opensaml2 and shibboleth-sp2 packa...
- DSA 1906-1: End-of-life announcement for clamav in...
- USN-846-1: ICU vulnerability
- USN-845-1: Pan vulnerability
- RHSA-2009:1484-01 Moderate: postgresql security up...
- USN-843-1: BackupPC vulnerability
- USN-842-1: Wget vulnerability
- USN-841-1: GLib vulnerability
- DSA 1902-1: New elinks packages fix arbitrary code...
- DSA 1899-1: New strongswan packages fix denial of ...
- DSA 1901-1: New mediawiki1.7 packages fix several ...
- RHSA-2009:1471-01 Important: elinks security update
- USN-839-1: Samba vulnerabilities
- DSA 1898-1: New openswan packages fix denial of se...
- RHSA-2009:1470-01 Moderate: openssh security update
- USN-838-1: Dovecot vulnerabilities
- RHSA-2009:1472-01 Moderate: xen security and bug f...
- RHSA-2009:1469-01 Important: kernel security update
- RHSA-2009:1455-01 Moderate: kernel security and bu...
-
▼
October
(44)