Debians sikkerhedsbulletin

DSA-1684-1 lcms -- flere sårbarheder

Rapporteret den:

10. dec 2008

Berørte pakker:

lcms

Sårbar:

Referencer i sikkerhedsdatabaser:

I Mitres CVE-ordbog: CVE-2008-5316, CVE-2008-5317.

Yderligere oplysninger:

To sårbarheder er fundet i lcms, et bibliotek og samling af kommandolinjeværktøjer til håndteringer af farver i billeder. Projektet Common Vulnerabilities and Exposures har registreret følgende problemer:

CVE-2008-5316
Utilstrækkelig håndhævelse fast længde-buffergrænser gjorde det muligt for en angriber at få en buffer på stakken til at løbe over, hvilket potentielt gjorde det muligt at udføre vilkårlig kode når et ondsindet fremstillet billede blev åbnet.
CVS-2008-5317
En heltalsfortegnsfejl ved læsning af billeders gammadata, kunne gøre det muligt for en angriber at forårsage at en for lille buffer blev allokeret til efterfølgende data, med ukendte konsekvenser, potentielt mulighed for at udføre vilkårlig kode, hvis et ondsindet fremstillet billede blev åbnet.

I den stabile distribution (etch), er disse problemer rettet i version 1.15-1.1+etch1.

I den kommende stabile distribution (lenny), og i den ustabile distribution (sid), er disse problemer rettet i version 1.17.dfsg-1.

Vi anbefaler at du opgraderer dine lcms-pakker.

Rettet i:

Debian GNU/Linux 4.0 (etch)

Kildekode:: http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15-1.1+etch1.diff.gz; http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15.orig.tar.gz; http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15-1.1+etch1.dsc
Alpha:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_alpha.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_alpha.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_alpha.deb
AMD64:: http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_amd64.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_amd64.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_amd64.deb
ARM:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_arm.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_arm.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_arm.deb
HP Precision:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_hppa.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_hppa.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_hppa.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_i386.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_i386.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_ia64.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_ia64.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_ia64.deb
Big-endian MIPS:: http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_mips.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_mips.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_mips.deb
Little-endian MIPS:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_mipsel.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_mipsel.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_powerpc.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_powerpc.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_s390.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_s390.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch1_sparc.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch1_sparc.deb; http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch1_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.