Debian セキュリティ勧告

DSA-296-1 kdebase -- 安全でない呼び出し方

報告日時:
2003-04-30
影響を受けるパッケージ:
kdebase
危険性:
あり
参考セキュリティデータベース:
(SecurityFocus の) Bugtraq データベース: BugTraq ID 7318.
Mitre の CVE 辞書: CVE-2003-0204.
詳細:

KDE チームは、KDE で PostScript (PS) や PDF ファイルの処理に使う Ghostscript ソフトウェアの呼び出し方に脆弱性を発見しました。攻撃者は、悪意を持った PostScript や PDF ファイルをメールやウェブサイト経由でユーザに与えることで、このファイルを閲覧したユーザ、 あるいはブラウザがディレクトリリストをサムネイル付で生成した際のユーザの権限で、 任意のコードを実行可能になります。

安定版ディストリビューション (stable、コードネーム woody) では、この問題は kdebase とその関連パッケージのバージョン 2.2.2-14.4 で修正されています。

以前の安定版ディストリビューション (コードネーム potato) では、KDE が含まれていないので影響を受けません。

不安定版ディストリビューション (unstable、コードネーム sid) では、この問題はまもなく修正される予定です。

Ralf Nolden さんによる woody 用の KDE 3.1.1 の非公式バックポートが download.kde.org にあります。この問題は kdebase の version 3.1.1-0woody3 で修正されています。いつもの apt-get 用のバックポート設定を指定することで、 更新されたパッケージを入手できます:

deb http://download.kde.org/stable/latest/Debian stable main

kdebase とその関連パッケージのアップグレードをお勧めします。

修正:

Debian GNU/Linux 3.0 (woody)

ソース:
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4.dsc
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4.diff.gz
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2.orig.tar.gz
アーキテクチャ非依存コンポーネント:
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-doc_2.2.2-14.4_all.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdewallpapers_2.2.2-14.4_all.deb
Alpha:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_alpha.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_arm.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_i386.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_ia64.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_hppa.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_m68k.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_mips.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_mipsel.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_s390.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/k/kdebase/kate_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-audiolibs_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-dev_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-libs_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kdm_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/konqueror_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/konsole_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/kscreensaver_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq-dev_2.2.2-14.4_sparc.deb
http://security.debian.org/pool/updates/main/k/kdebase/libkonq3_2.2.2-14.4_sparc.deb

一覧にあるファイルの MD5 チェックサムは勧告の原文にあります。