Debians sikkerhedsbulletin

DSA-1505-1 alsa-driver -- kernehukommelseslækage

Rapporteret den:
22. feb 2008
Berørte pakker:
alsa-driver
Sårbar:
Ja
Referencer i sikkerhedsdatabaser:
I Mitres CVE-ordbog: CVE-2007-4571.
Yderligere oplysninger:

Takashi Iwai leverede en rettelse af en hukommelseslækage i modulet snd_page_alloc. Lokale brugere kunne udnytte problemet til at få adgang til følsomme oplysninger fra kernen (CVE-2007-4571).

I den gamle stabile distribution (sarge), er dette problem rettet i version 1.0.8-7sarge1. De færdigopbyggede moduler der leveres i alsa-modules-i386 er blevet genopbygget for at kunne anvende denne opdatering, og er tilgængelige i version 1.0.8+2sarge2.

I den stabile distribution (etch), er dette problem rettet i version 1.0.13-5etch1. Problemet í den version af ALSA, der leveres med linux-2.6, blev allerede rettet i forbindelse med DSA 1479.

I den ustabile distributions (sid), er dette problem rettet i version 1.0.15-1.

Vi anbefaler at du opgraderer dine alsa-driver- og alsa-modules-i386-pakker.

Rettet i:

Debian GNU/Linux 3.1 (sarge)

Kildekode:
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-driver_1.0.8-7sarge1.dsc
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-driver_1.0.8-7sarge1.diff.gz
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-driver_1.0.8.orig.tar.gz
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-i386_1.0.8+2sarge2.dsc
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-i386_1.0.8+2sarge2.tar.gz
Arkitekturuafhængig komponent:
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-headers_1.0.8-7sarge1_all.deb
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-source_1.0.8-7sarge1_all.deb
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-base_1.0.8-7sarge1_all.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4.27-4-386_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4.27-4-686_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4-386_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4.27-4-k7-smp_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4-k7-smp_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4.27-4-686-smp_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4-686-smp_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4-686_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4.27-4-k6_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4-k7_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4.27-4-k7_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4.27-4-586tsc_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4-586tsc_1.0.8+2sarge2_i386.deb
http://security.debian.org/pool/updates/main/a/alsa-modules-i386/alsa-modules-2.4-k6_1.0.8+2sarge2_i386.deb

Debian GNU/Linux 4.0 (etch)

Kildekode:
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-driver_1.0.13-5etch1.diff.gz
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-driver_1.0.13.orig.tar.gz
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-driver_1.0.13-5etch1.dsc
Arkitekturuafhængig komponent:
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-source_1.0.13-5etch1_all.deb
http://security.debian.org/pool/updates/main/a/alsa-driver/alsa-base_1.0.13-5etch1_all.deb
http://security.debian.org/pool/updates/main/a/alsa-driver/linux-sound-base_1.0.13-5etch1_all.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.