Bulletin d'alerte Debian
DSA-906-1 sylpheed -- Dépassements de tampon
- Date du rapport :
- 22 novembre 2005
- Paquets concernés :
- sylpheed
- Vulnérabilité :
- Oui
- Références dans la base de données de sécurité :
- Dans le système de suivi des bogues Debian : Bogue 338436.
Dans le dictionnaire CVE du Mitre : CVE-2005-3354. - Plus de précisions :
-
Colin Leroy a découvert plusieurs dépassements de tampon dans un certain nombre de routines d'importation de sylpheed, un client léger de courriel en GTK, qui pouvaient permettre l'exécution de code arbitraire.
Le tableau suivant explique pour chaque distribution quelle version contient la correction :
ancienne stable (Woody) stable (Sarge) instable (Sid) sylpheed 0.7.4-4woody1 1.0.4-1sarge1 2.0.4-1 sylpheed-gtk1 N.D. N.D. 1.0.6-1 sylpheed-claws 0.7.4claws-3woody1 1.0.4-1sarge1 1.0.5-2 sylpheed-claws-gtk2 N.D. N.D. 1.9.100-1 Nous vous recommandons de mettre à jour votre paquet sylpheed.
- Corrigé dans :
-
Debian GNU/Linux 3.0 (woody)
- Source :
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1.dsc
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1.diff.gz
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4.orig.tar.gz
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1.diff.gz
- Composant indépendant de l'architecture :
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed-doc_0.7.4-4woody1_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_0.7.4-4woody1_sparc.deb
Debian GNU/Linux 3.1 (sarge)
- Source :
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1.dsc
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1.diff.gz
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4.orig.tar.gz
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1.diff.gz
- Composant indépendant de l'architecture :
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed-i18n_1.0.4-1sarge1_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_amd64.deb
- ARM:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/s/sylpheed/sylpheed_1.0.4-1sarge1_sparc.deb
Les sommes MD5 des fichiers indiqués sont disponibles sur la page originale de l'alerte de sécurité.