- -------------------------------------------------------------------------- Debian Security Advisory DSA 139-1 [email protected] http://www.debian.org/security/ Martin Schulze August 1st, 2002 - -------------------------------------------------------------------------- Package : super Vulnerability : format string vulnerability Problem-Type : local Debian-specific: no GOBBLES found an insecure use of format strings in the super package. The included program super is intended to provide access to certain system users for particular users and programs, similar to the program super. Exploiting this format string vulnerability a local user can gain unauthorized root accesss. This problem has been fixed in version 3.12.2-2.1 for the old stable distribution (potato), in version 3.16.1-1.1 for the current stable distribution (woody) and in version 3.18.0-3 for the unstable distribution (sid). We recommend that you upgrade your super package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 2.2 alias potato - ------------------------------------ Source archives: http://security.debian.org/pool/updates/main/s/super/super_3.12.2-2.1.dsc Size/MD5 checksum: 525 e7d8d68670dbbe1be3b4d3da143f7301 http://security.debian.org/pool/updates/main/s/super/super_3.12.2.orig.tar.gz Size/MD5 checksum: 170839 4b9be58190fd965bb8b5bdc0351aea5a http://security.debian.org/pool/updates/main/s/super/super_3.12.2-2.1.diff.gz Size/MD5 checksum: 5061 7da15c978b9ba8187e68dcafe1a02925 Alpha architecture: http://security.debian.org/pool/updates/main/s/super/super_3.12.2-2.1_alpha.deb Size/MD5 checksum: 113136 bbd91617476dd6733799e13165b66f7f ARM architecture: http://security.debian.org/pool/updates/main/s/super/super_3.12.2-2.1_arm.deb Size/MD5 checksum: 101638 33a4e450ca4dd532cc59a2db58f4a676 Intel ia32 architecture: http://security.debian.org/pool/updates/main/s/super/super_3.12.2-2.1_i386.deb Size/MD5 checksum: 97404 fddd44e7a6a73143bf6ca1127ec5f7df Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/s/super/super_3.12.2-2.1_m68k.deb Size/MD5 checksum: 94634 a92d5a82eb5c58326b087f6919260d30 PowerPC architecture: http://security.debian.org/pool/updates/main/s/super/super_3.12.2-2.1_powerpc.deb Size/MD5 checksum: 102352 fd6e7fc3c2af75a9d36c0e4c29dd04bf Sun Sparc architecture: http://security.debian.org/pool/updates/main/s/super/super_3.12.2-2.1_sparc.deb Size/MD5 checksum: 106092 ca8af9d1b1430486fb738e76a7d0f856 Debian GNU/Linux 3.0 alias woody - ------------------------------------ Due to a bug in the libc6-dev package, we are currently unable to provide a fixed package for the ARM architecture. We will install it in the archive as soon as we're able to compile it again. Until that, please remove the super package from your arm systems. Due to an unknown failure we're also unable to provide a fixed package for the S/390 architecture, which will be installed later. Source archives: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1.dsc Size/MD5 checksum: 574 7b18da0326c7b93011f55ebc3cc48119 http://security.debian.org/pool/updates/main/s/super/super_3.16.1.orig.tar.gz Size/MD5 checksum: 192062 cc868b2fc2b44c47d86da314a11acf0b http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1.diff.gz Size/MD5 checksum: 9827 8f0f3415753f4d76c67820d582bd56c9 Alpha architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_alpha.deb Size/MD5 checksum: 126730 7ad7502c4d94657fee70d9791217e1e7 Intel ia32 architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_i386.deb Size/MD5 checksum: 110732 0401517e321fcd66793492d0d6a9bd1b Intel ia64 architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_ia64.deb Size/MD5 checksum: 144422 213076409ae41c0a2a5c3a0840bdf952 HP Precision architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_hppa.deb Size/MD5 checksum: 124002 710a1e693ee29e11a292b6608b61426c Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_m68k.deb Size/MD5 checksum: 108172 32e37a1deec47756e58426117affdf5d Big endian MIPS architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_mips.deb Size/MD5 checksum: 120640 c9bc05b458d8994b84efe78498128b13 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_mipsel.deb Size/MD5 checksum: 121102 929974f16338f318844b009214573948 PowerPC architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_powerpc.deb Size/MD5 checksum: 116702 672cc4164290ad95936507825a5c6c76 Sun Sparc architecture: http://security.debian.org/pool/updates/main/s/super/super_3.16.1-1.1_sparc.deb Size/MD5 checksum: 117370 0116b744cf929a830ea8fb0f972331a0 These files will probably be moved into the stable distribution on its next revision. - --------------------------------------------------------------------------------- - -------------------------------------------------------------------------- Debian Security Advisory DSA 140-1 [email protected] http://www.debian.org/security/ Martin Schulze August 1st, 2002 - -------------------------------------------------------------------------- Package : libpng2, libpng3 Vulnerability : buffer overflow Problem-Type : remote Debian-specific: no Developers of the PNG library have fixed a buffer overflow in the progressive reader when the PNG datastream contains more IDAT data than indicated by the IHDR chunk. Such deliberately malformed datastreams would crash applications which could potentially allow an attacker to execute malicious code. Programs such as Galeon, Konquerer and various others make use of these libraries. To find out which packages depend on this library, you may want to execute the following commands: apt-cache showpkg libpng2 apt-cache showpkg libpng3 This problem has been fixed in version 1.0.12-3.woody.1 of libpng and version 1.2.1-1.1.woody.1 of libpng3 for the current stable distribution (woody) and in version 1.0.12-4 of libpng and version 1.2.1-2 of libpng3 for the unstable distribution (sid). We recommend that you upgrade your libpng packages immediately and restart programs and daemons that link to these libraries and read external data, such as web browsers. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 2.2 alias potato - ------------------------------------ The potato release of Debian does not seem to be vulnerable. Debian GNU/Linux 3.0 alias woody - ------------------------------------ Source archives: http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.0.12-3.woody.1.diff.gz Size/MD5 checksum: 7669 be9367cff7f1dcf419d0d05d802c5944 http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.0.12-3.woody.1.dsc Size/MD5 checksum: 622 6d23d6e1158b9a9108992f796e75e19a http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.0.12.orig.tar.gz Size/MD5 checksum: 481387 3329b745968e41f6f9e55a4d04a4964c http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1.diff.gz Size/MD5 checksum: 8068 74ad33afe027c4707f82a6717d57fa61 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1.dsc Size/MD5 checksum: 625 d575b2e4bd1f603bd7587b7118592943 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1.orig.tar.gz Size/MD5 checksum: 493105 75a21cbfae566158a0ac6d9f39087c4d Alpha architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_alpha.deb Size/MD5 checksum: 129634 885ef09eee9a15be7ab4a31695235e36 http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_alpha.deb Size/MD5 checksum: 270222 2d798e90db55f3656f06e1cb704f2002 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_alpha.deb Size/MD5 checksum: 133058 b4ef97d3a57ad81c360d057a3c74850d http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_alpha.deb Size/MD5 checksum: 276350 417643ea3928b6c57179cace2a4fd416 ARM architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_arm.deb Size/MD5 checksum: 108116 5ba4eb39cd465795e144fb2a2ed90f6d http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_arm.deb Size/MD5 checksum: 241198 8739ebfde3e6a9880771cd8710b75c8d http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_arm.deb Size/MD5 checksum: 111416 527abeb9d914b678de915c30bd3f60cc http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_arm.deb Size/MD5 checksum: 247460 b796ea4b65914d932a61a47e6767dafc Intel ia32 architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_i386.deb Size/MD5 checksum: 106362 51afc4e74c966611d09c86cd7618232a http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_i386.deb Size/MD5 checksum: 227330 9d5ea3fb4a4f574bbca0b36d1bb920b0 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_i386.deb Size/MD5 checksum: 109626 fd82990366d175a321770f06a61a6f26 http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_i386.deb Size/MD5 checksum: 233096 29e7049076edc296c61efb686e5c4b9c Intel ia64 architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_ia64.deb Size/MD5 checksum: 146048 cb0232eda30d98203a6e558f27914f8c http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_ia64.deb Size/MD5 checksum: 271432 738fdbc5bb31ba8cb8219d0c403fa987 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_ia64.deb Size/MD5 checksum: 150706 125846df814500f3b7a5dff2411aadf2 http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_ia64.deb Size/MD5 checksum: 278564 b2bdc657ac4a4082bcc6b5f0aed740be HP Precision architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_hppa.deb Size/MD5 checksum: 128166 519fe3103b35427b8efab150cdc2fb46 http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_hppa.deb Size/MD5 checksum: 262308 d9e718d09f9242a928b05a10fc650a99 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_hppa.deb Size/MD5 checksum: 132228 1abf96179b015488e32f3a495ccbea2c http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_hppa.deb Size/MD5 checksum: 269380 9b27f309a41b55bba90c9efcd974e28a Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_m68k.deb Size/MD5 checksum: 103132 afb0223dd3c5c5fa596d3970604878af http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_m68k.deb Size/MD5 checksum: 220510 b425af1b1870364d829842cd50f8381c http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_m68k.deb Size/MD5 checksum: 106160 491dd7d27a543147f8b19e0afb1db887 http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_m68k.deb Size/MD5 checksum: 226062 6406be6fb4cb886ee021373b3ae940e3 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_mips.deb Size/MD5 checksum: 108226 f1f371cbe95cca227b05d0f6bf6c7fb1 http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_mips.deb Size/MD5 checksum: 240376 16b9cefda9e30c9ac506934113e7973c http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_mips.deb Size/MD5 checksum: 111644 81b7949f6b4c0b8d27ee725f60559dd5 http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_mips.deb Size/MD5 checksum: 246790 bc7e22c737c4a3a72afbd94f5bab3218 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_mipsel.deb Size/MD5 checksum: 108088 c7a0b8ed4b6c68a7ebb96892c9a1f5de http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_mipsel.deb Size/MD5 checksum: 240254 51f4930794d29dd2a1aa3b37bcc8cd7c http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_mipsel.deb Size/MD5 checksum: 111536 f502afa2e412a95290b1c3d280760e80 http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_mipsel.deb Size/MD5 checksum: 246746 6647409b70d96fb16573780d09ffd876 PowerPC architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_powerpc.deb Size/MD5 checksum: 109514 e71febcad15d3f0d28cddc9ceb290714 http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_powerpc.deb Size/MD5 checksum: 234372 eefc0d66ad68679f2aae41c3bfa2b899 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_powerpc.deb Size/MD5 checksum: 112560 8908c0e7790f694351b986f0d096e22b http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_powerpc.deb Size/MD5 checksum: 240360 70e8a84620d19f12cfe55577d95f2ff3 IBM S/390 architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_s390.deb Size/MD5 checksum: 107202 9d39ad63f8c78cdd836081257187d142 http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_s390.deb Size/MD5 checksum: 226482 31249db8c2d7fa0ed159ac6ff6c98c83 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_s390.deb Size/MD5 checksum: 110706 b2e96f3761da7ff4c4c659730573ac02 http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_s390.deb Size/MD5 checksum: 232376 84788818293819fed02c018a4ea17856 Sun Sparc architecture: http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.1_sparc.deb Size/MD5 checksum: 109606 694f22d22238be1359e9e78872baeaed http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.1_sparc.deb Size/MD5 checksum: 231804 5a79392f9c88084f41a24c6974f7d970 http://security.debian.org/pool/updates/main/libp/libpng3/libpng3_1.2.1-1.1.woody.1_sparc.deb Size/MD5 checksum: 112994 b2c030e60f9e7b8a31d37b76c7153650 http://security.debian.org/pool/updates/main/libp/libpng3/libpng-dev_1.2.1-1.1.woody.1_sparc.deb Size/MD5 checksum: 237614 27d9aa71bba26e9680cb5e7256f93a98 These files will probably be moved into the stable distribution on its next revision. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: [email protected] Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>;
Debian GNU/Linux Advisories: super, libpng2, libpng3
By
Get the Free Newsletter!
Subscribe to Developer Insider for top news, trends, & analysis