Security Information / 2012 / Security Information -- DSA-2576-1 trousers

Debian Security Advisory

DSA-2576-1 trousers -- denial of service

Date Reported:

23 Nov 2012

Affected Packages:

trousers

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 692649.
In Mitre's CVE dictionary: CVE-2012-0698.

More information:

Andy Lutomirski discovered that tcsd (the TPM userspace daemon) was missing input validation. Using carefully crafted input, it can lead to a denial of service by making the daemon crash with a segmentation fault.

For the stable distribution (squeeze), this problem has been fixed in version 0.3.5-2+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in version 0.3.9-1.

For the unstable distribution (sid), this problem has been fixed in version 0.3.9-1.

We recommend that you upgrade your trousers packages.