Debian Security Advisory

DSA-1043-1 abcmidi -- buffer overflows

Date Reported:
26 Apr 2006
Affected Packages:
abcmidi
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2006-1514.
More information:

Erik Sjölund discovered that abcmidi-yaps, a translator for ABC music description files into PostScript, does not check the boundaries when reading in ABC music files resulting in buffer overflows.

For the old stable distribution (woody) these problems have been fixed in version 17-1woody1.

For the stable distribution (sarge) these problems have been fixed in version 20050101-1sarge1.

For the unstable distribution (sid) these problems have been fixed in version 20060422-1.

We recommend that you upgrade your abcmidi-yaps package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1.dsc
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1.diff.gz
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_alpha.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_arm.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_i386.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_ia64.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_hppa.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_m68k.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_mips.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_mipsel.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_powerpc.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_s390.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_17-1woody1_sparc.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_17-1woody1_sparc.deb

Debian GNU/Linux 3.1 (sarge)

Source:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1.dsc
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1.diff.gz
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_alpha.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_alpha.deb
AMD64:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_amd64.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_amd64.deb
ARM:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_arm.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_i386.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_ia64.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_hppa.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_m68k.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_mips.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_mipsel.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_powerpc.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_s390.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi_20050101-1sarge1_sparc.deb
http://security.debian.org/pool/updates/main/a/abcmidi/abcmidi-yaps_20050101-1sarge1_sparc.deb

MD5 checksums of the listed files are available in the original advisory.