:Advisories: September 5, 2005
Advisories: September 5, 2005 0 Talkback[s]
Debian Security Advisory DSA 795-1 security@debian.org http://www.debian.org/security/ Michael Stonehttp://www.debian.org/security/faq
Package : proftpd
infamous42md reported that proftpd suffers from two format string
vulnerabilities. In the first, a user with the ability to create a
directory could trigger the format string error if there is a
proftpd shutdown message configured to use the "%C", "%R", or "%U"
variables. In the second, the error is triggered if mod_sql is used
to retrieve messages from a database and if format strings have been
inserted into the database by a user with permission to do so.
The old stable distribution (woody) is not affected by these
vulnerabilities.
For the stable distribution (sarge) this problem has been fixed in
version 1.2.10-15sarge1.
For the unstable distribution (sid) this problem has been fixed in
version 1.2.10-20.
We recommend that you upgrade your proftpd package.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10.orig.tar.gz http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1.dsc http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1.diff.gz
Architecture independent packages:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-doc_1.2.10-15sarge1_all.deb
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_alpha.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_alpha.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_alpha.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_alpha.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_alpha.deb
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_amd64.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_amd64.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_amd64.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_amd64.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_amd64.deb
arm architecture (ARM)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_arm.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_arm.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_arm.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_arm.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_arm.deb
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_hppa.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_hppa.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_hppa.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_hppa.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_hppa.deb
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_i386.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_i386.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_i386.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_i386.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_i386.deb
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_ia64.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_ia64.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_ia64.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_ia64.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_ia64.deb
m68k architecture (Motorola Mc680x0)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_m68k.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_m68k.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_m68k.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_m68k.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_m68k.deb
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_mips.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_mips.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_mips.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_mips.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_mips.deb
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_mipsel.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_mipsel.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_mipsel.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_mipsel.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_mipsel.deb
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_powerpc.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_powerpc.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_powerpc.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_powerpc.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_powerpc.deb
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_s390.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_s390.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_s390.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_s390.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_s390.deb
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1_sparc.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1_sparc.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1_sparc.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1_sparc.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 795-2 security@debian.org http://www.debian.org/security/ Michael Stonehttp://www.debian.org/security/faq
Package : proftpd
infamous42md reported that proftpd suffers from two format string
vulnerabilities. In the first, a user with the ability to create a
directory could trigger the format string error if there is a
proftpd shutdown message configured to use the "%C", "%R", or "%U"
variables. In the second, the error is triggered if mod_sql is used
to retrieve messages from a database and if format strings have been
inserted into the database by a user with permission to do so.
There was a build error for the sarge i386 proftpd packages released
in DSA 795-1. A new build, 1.2.10-15sarge1.0.1, has been prepared to
correct this error. The packages for other architectures are
unaffected.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge1.0.1_i386.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge1.0.1_i386.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge1.0.1_i386.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge1.0.1_i386.deb http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge1.0.1_i386.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 796-1 security@debian.org http://www.debian.org/security/ Michael Stonehttp://www.debian.org/security/faq
Package : affix
Kevin Finisterre reports that affix, a package used to manage
bluetooth sessions under Linux, uses the popen call in an unsafe
fashion. A remote attacker can exploit this vulnerability to execute
arbitrary commands on a vulnerable system.
The old stable distribution (woody) does not contain the affix
package.
For the stable distribution (sarge) this problem has been fixed in
version 2.1.1-3.
For the unstable distribution (sid) this problem has been fixed in
version 2.1.2-3.
We recommend that you upgrade your affix package.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3.diff.gz http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3.dsc
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_alpha.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_alpha.deb http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_alpha.deb
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_amd64.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_amd64.deb http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_amd64.deb
arm architecture (ARM)
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_arm.deb http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_arm.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_arm.deb
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_hppa.deb http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_hppa.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_hppa.deb
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_i386.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_i386.deb http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_i386.deb
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_ia64.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_ia64.deb http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_ia64.deb
m68k architecture (Motorola Mc680x0)
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_m68k.deb http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_m68k.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_m68k.deb
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_mips.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_mips.deb http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_mips.deb
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_mipsel.deb http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_mipsel.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_mipsel.deb
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_powerpc.deb http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_powerpc.deb http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_powerpc.deb
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_s390.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_s390.deb http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_s390.deb
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_sparc.deb http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-3_sparc.deb http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 797-1 security@debian.org http://www.debian.org/security/ Michael Stonehttp://www.debian.org/security/faq
Package : zsync
zsync, a file transfer program, includes a modified local copy of
the zlib library, and is vulnerable to certain bugs fixed previously
in the zlib package.
The old stable distribution (woody) does not contain the zsync
package.
For the stable distribution (sarge) this problem has been fixed in
version 0.3.3-1.sarge.1.
For the unstable distribution (sid) this problem has been fixed in
version 0.4.0-2.
We recommend that you upgrade your zsync package.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1.dsc http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1.diff.gz http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3.orig.tar.gz
Alpha architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_alpha.deb
AMD64 architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_amd64.deb
ARM architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/z/zsync/zsync_0.3.3-1.sarge.1_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 798-1 security@debian.org http://www.debian.org/security/ Martin Schulzehttp://www.debian.org/security/faq
Package : phpgroupware
Several vulnerabilities have been discovered in phpgroupware, a web
based groupware system written in PHP. The Common Vulnerabilities and
Exposures project identifies the following problems:
CAN-2005-2498
Stefan Esser discovered another vulnerability in the XML-RPC
libraries that allows injection of arbitrary PHP code into eval()
statements. The XMLRPC component has been disabled.
CAN-2005-2600
Alexander Heidenreich discovered a cross-site scriptiong problem
in the tree view of FUD Forum Bulletin Board Software, which is
also present in phpgroupware.
CAN-2005-2761
A global cross-site scripting fix has also been included that
protects against potential malicious scripts embedded in CSS and
xmlns in various parts of the application and modules.
This update also contains a postinst bugfix that has been approved for
the next update to the stable release.
For the old stable distribution (woody) these problems don't apply.
For the stable distribution (sarge) these problems have been fixed in
version 0.9.16.005 -3.sarge2.
For the unstable distribution (sid) these problems have been fixed in
version 0.9.16.008 .
We recommend that you upgrade your phpgroupware packages.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware_0.9.16.005-3.sarge2.dsc http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware_0.9.16.005-3.sarge2.diff.gz http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware_0.9.16.005.orig.tar.gz
Architecture independent components:
http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-addressbook_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-admin_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-bookmarks_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-calendar_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-chat_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-comic_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-core_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-developer-tools_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-dj_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-eldaptir_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-email_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-etemplate_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-felamimail_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-filemanager_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-folders_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-forum_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-ftp_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-fudforum_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-headlines_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-hr_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-img_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-infolog_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-manual_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-messenger_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-news-admin_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-nntp_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-notes_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-phonelog_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-phpbrain_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-phpgwapi_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-phpsysinfo_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-polls_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-preferences_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-projects_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-qmailldap_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-registration_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-setup_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-sitemgr_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-skel_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-soap_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-stocks_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-todo_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-tts_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-wiki_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware-xmlrpc_0.9.16.005-3.sarge2_all.deb http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupware_0.9.16.005-3.sarge2_all.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 798-1 security@debian.org http://www.debian.org/security/ Michael Stonehttp://www.debian.org/security/faq
Package : webcalendar
A trivially-exploitable bug was discovered in webcalendar that
allows an attacker to execute arbitrary code with the privileges of
the HTTP daemon on a system running a vulnerable version.
The old stable distribution (woody) does not contain the webcalendar
package.
For the stable distribution (sarge) this problem has been fixed in
version 0.9.45-4sarge2.
For the unstable distribution (sid) this problem will be fixed
shortly.
We recommend that you upgrade your webcalendar package immediately.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/w/webcalendar/webcalendar_0.9.45-4sarge2.diff.gz http://security.debian.org/pool/updates/main/w/webcalendar/webcalendar_0.9.45-4sarge2.dsc http://security.debian.org/pool/updates/main/w/webcalendar/webcalendar_0.9.45.orig.tar.gz
Architecture independent packages:
http://security.debian.org/pool/updates/main/w/webcalendar/webcalendar_0.9.45-4sarge2_all.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 800-1 security@debian.org http://www.debian.org/security/ Martin Schulzehttp://www.debian.org/security/faq
Package : pcre3
An integer overflow with subsequent buffer overflow has been detected
in PCRE, the Perl Compatible Regular Expressions library, which allows
an attacker to execute arbitrary code.
Since several packages link dynamically to this library you are
advised to restart the corresponding services or programs
respectively. The command ``apt-caches showpkg libpcre3'' will list
the corresponding packages in the "Reverse Depends:" section.
For the old stable distribution (woody) this problem has been fixed in
version 3.4-1.1woody1.
For the stable distribution (sarge) this problem has been fixed in
version 4.5-1.2sarge1.
For the unstable distribution (sid) this problem has been fixed in
version 6.3-1.
We recommend that you upgrade your libpcre3 package.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/p/pcre3/pcre3_3.4-1.1woody1.dsc http://security.debian.org/pool/updates/main/p/pcre3/pcre3_3.4-1.1woody1.diff.gz http://security.debian.org/pool/updates/main/p/pcre3/pcre3_3.4.orig.tar.gz
Alpha architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_alpha.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_alpha.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_alpha.deb
ARM architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_arm.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_arm.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_i386.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_i386.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_ia64.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_ia64.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_hppa.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_hppa.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_m68k.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_m68k.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_mips.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_mips.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_mipsel.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_mipsel.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_powerpc.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_powerpc.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_s390.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_s390.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_3.4-1.1woody1_sparc.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_3.4-1.1woody1_sparc.deb http://security.debian.org/pool/updates/main/p/pcre3/pgrep_3.4-1.1woody1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/p/pcre3/pcre3_4.5-1.2sarge1.dsc http://security.debian.org/pool/updates/main/p/pcre3/pcre3_4.5-1.2sarge1.diff.gz http://security.debian.org/pool/updates/main/p/pcre3/pcre3_4.5.orig.tar.gz
Architecture independent components:
http://security.debian.org/pool/updates/main/p/pcre3/pgrep_4.5-1.2sarge1_all.deb
Alpha architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_alpha.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_alpha.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_alpha.deb
AMD64 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_amd64.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_amd64.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_amd64.deb
ARM architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_arm.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_arm.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_i386.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_i386.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_ia64.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_ia64.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_hppa.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_hppa.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_m68k.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_m68k.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_mips.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_mips.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_mipsel.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_mipsel.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_powerpc.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_powerpc.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_s390.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_s390.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/p/pcre3/libpcre3_4.5-1.2sarge1_sparc.deb http://security.debian.org/pool/updates/main/p/pcre3/libpcre3-dev_4.5-1.2sarge1_sparc.deb http://security.debian.org/pool/updates/main/p/pcre3/pcregrep_4.5-1.2sarge1_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 801-1 security@debian.org http://www.debian.org/security/ Martin Schulzehttp://www.debian.org/security/faq
Package : ntp
SuSE developers discovered that ntp confuses the given group id with
the group id of the given user when called with a group id on the
commandline that is specified as a string and not as a numeric gid,
which causes ntpd to run with different privileges than intended.
The old stable distribution (woody) is not affected by this problem.
For the stable distribution (sarge) this problem has been fixed in
version 4.2.0a+stable-2sarge1.
The unstable distribution (sid) is not affected by this problem.
We recommend that you upgrade your ntp-server package.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1.dsc http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1.diff.gz http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable.orig.tar.gz
Architecture independent components:
http://security.debian.org/pool/updates/main/n/ntp/ntp-doc_4.2.0a+stable-2sarge1_all.deb
Alpha architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_alpha.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_alpha.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_alpha.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_alpha.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_alpha.deb
AMD64 architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_amd64.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_amd64.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_amd64.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_amd64.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_amd64.deb
ARM architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_arm.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_arm.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_arm.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_arm.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_i386.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_i386.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_i386.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_i386.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_ia64.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_ia64.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_ia64.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_ia64.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_hppa.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_hppa.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_hppa.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_hppa.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_m68k.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_m68k.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_m68k.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_m68k.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_mips.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_mips.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_mips.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_mips.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_mipsel.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_mipsel.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_mipsel.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_mipsel.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_powerpc.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_powerpc.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_powerpc.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_powerpc.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_s390.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_s390.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_s390.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_s390.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/n/ntp/ntp_4.2.0a+stable-2sarge1_sparc.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-refclock_4.2.0a+stable-2sarge1_sparc.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-server_4.2.0a+stable-2sarge1_sparc.deb http://security.debian.org/pool/updates/main/n/ntp/ntp-simple_4.2.0a+stable-2sarge1_sparc.deb http://security.debian.org/pool/updates/main/n/ntp/ntpdate_4.2.0a+stable-2sarge1_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
http://security.debian.org/ stable/updates mainftp://security.debian.org/debian-security dists/stable/updates/maindebian-security-announce@lists.debian.org http://packages.debian.org/<pkg>
