Date: Wed, 22 Nov 2000 11:43:40 -0500
From: Daniel Jacobowitz dan@debian.org
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] New Debian ncurses packages released
Debian Security Advisory security@debian.org
http://www.debian.org/security/ Daniel Jacobowitz
November 21, 2000
Package: ncurses
Vulnerability: local privilege escalation
Debian-specific: no
Vulnerable: yes
The version of the ncurses display library shipped with Debian
GNU/Linux 2.2 is vulnerable to several buffer overflows in the
parsing of terminfo database files. This problem was discovered by
Jouko Pynnönen jouko@solutions.fi. The problems
are only exploitable in the presence of setuid binaries linked to
ncurses which use these particular functions, including xmcd
versions before 2.5pl1-7.1.
This problem is fixed in ncurses 5.0-6.0potato1 for Debian
GNU/Linux 2.2, and in ncurses 5.0-8 for Debian Unstable.
Debian GNU/Linux 2.1 alias slink
Slink is no longer being supported by the Debian Security Team.
We highly recommend an upgrade to the current stable release.
Debian GNU/Linux 2.2 (stable) alias potato
Fixes are currently available for the Alpha, ARM, Intel ia32,
Motorola 680×0, PowerPC and Sun SPARC architectures, and will be
included in 2.2r2.
Source archives:
http://security.debian.org/dists/potato/updates/main/source/ncurses_5.0-6.0potato1.diff.gz
MD5 checksum: d474ae2d9cfc75191d0460d2fdeeafca
http://security.debian.org/dists/potato/updates/main/source/ncurses_5.0-6.0potato1.dsc
MD5 checksum: d2d53c5c9892ae5918141d9d9aa1f644
http://security.debian.org/dists/potato/updates/main/source/ncurses_5.0.orig.tar.gz
MD5 checksum: 0fa25059bc5e1e947f3109a3a168e976
Architecture indendent archives:
http://security.debian.org/dists/potato/updates/main/binary-all/ncurses-base_5.0-6.0potato1_all.deb
MD5 checksum: 251f5aae54dfbd95b64f45fdbadbdff5
http://security.debian.org/dists/potato/updates/main/binary-all/ncurses-term_5.0-6.0potato1_all.deb
MD5 checksum: b7de46e7b57038d8dde6d02130067afe
Alpha architecture:
http://security.debian.org/dists/potato/updates/main/binary-alpha/libncurses5-dbg_5.0-6.0potato1_alpha.deb
MD5 checksum: 88c939fd17c9a6de9eb24c9045278dba
http://security.debian.org/dists/potato/updates/main/binary-alpha/libncurses5-dev_5.0-6.0potato1_alpha.deb
MD5 checksum: 12d21571f296edf35f62342b36b37d4d
http://security.debian.org/dists/potato/updates/main/binary-alpha/libncurses5_5.0-6.0potato1_alpha.deb
MD5 checksum: e050361eea45c19173634013faaf6b29
http://security.debian.org/dists/potato/updates/main/binary-alpha/ncurses-bin_5.0-6.0potato1_alpha.deb
MD5 checksum: 6ccdea97302319984cf74c254ed09e99
ARM architecture:
http://security.debian.org/dists/potato/updates/main/binary-arm/libncurses5-dbg_5.0-6.0potato1_arm.deb
MD5 checksum: e03b834be5549f84fe4a00ff9ecaf33e
http://security.debian.org/dists/potato/updates/main/binary-arm/libncurses5-dev_5.0-6.0potato1_arm.deb
MD5 checksum: c7a060237f8914d01121c0ee67a1dd54
http://security.debian.org/dists/potato/updates/main/binary-arm/libncurses5_5.0-6.0potato1_arm.deb
MD5 checksum: 322d20cce7e1e1712bb31b1dc8d3526d
http://security.debian.org/dists/potato/updates/main/binary-arm/ncurses-bin_5.0-6.0potato1_arm.deb
MD5 checksum: 8c570cf9126e52710299dd94d3773c7e
Intel ia32 architecture:
http://security.debian.org/dists/potato/updates/main/binary-i386/libncurses5-dbg_5.0-6.0potato1_i386.deb
MD5 checksum: 3202f6ebb0ef4477a4c64d0a45f8298f
http://security.debian.org/dists/potato/updates/main/binary-i386/libncurses5-dev_5.0-6.0potato1_i386.deb
MD5 checksum: 7cc4c84e3d96c5799807249da584dcb4
http://security.debian.org/dists/potato/updates/main/binary-i386/libncurses5_5.0-6.0potato1_i386.deb
MD5 checksum: 1e897d8d39544d5b93ff504a367799e7
http://security.debian.org/dists/potato/updates/main/binary-i386/ncurses-bin_5.0-6.0potato1_i386.deb
MD5 checksum: 4c3ffd8d5280dd65152e35ec2d362575
Motorola 680×0 architecture:
http://security.debian.org/dists/potato/updates/main/binary-m68k/libncurses5-dbg_5.0-6.0potato1_m68k.deb
MD5 checksum: 75f2d464a509987263e93ea509b8c933
http://security.debian.org/dists/potato/updates/main/binary-m68k/libncurses5-dev_5.0-6.0potato1_m68k.deb
MD5 checksum: 885a9b7ebde8f3cb8acdcdc6d2cd1008
http://security.debian.org/dists/potato/updates/main/binary-m68k/libncurses5_5.0-6.0potato1_m68k.deb
MD5 checksum: 4584eec0d83236dfe76e835716c14c3a
http://security.debian.org/dists/potato/updates/main/binary-m68k/ncurses-bin_5.0-6.0potato1_m68k.deb
MD5 checksum: 737c25a357d1b2305e54754c2d21e9cc
PowerPC architecture:
http://security.debian.org/dists/potato/updates/main/binary-powerpc/libncurses5-dbg_5.0-6.0potato1_powerpc.deb
MD5 checksum: 70d7e9d4ef80af8bc862c721899535bd
http://security.debian.org/dists/potato/updates/main/binary-powerpc/libncurses5-dev_5.0-6.0potato1_powerpc.deb
MD5 checksum: e61cb0799d037010610c4449dc431db4
http://security.debian.org/dists/potato/updates/main/binary-powerpc/libncurses5_5.0-6.0potato1_powerpc.deb
MD5 checksum: 2b9fffa1aba531fca808c1c190a60c17
http://security.debian.org/dists/potato/updates/main/binary-powerpc/ncurses-bin_5.0-6.0potato1_powerpc.deb
MD5 checksum: 3ec093a1383396e769056b7979ebde12
Sun Sparc architecture:
http://security.debian.org/dists/potato/updates/main/binary-sparc/libncurses5-dbg_5.0-6.0potato1_sparc.deb
MD5 checksum: bfc87cdd9dcc612bffaef955610d20df
http://security.debian.org/dists/potato/updates/main/binary-sparc/libncurses5-dev_5.0-6.0potato1_sparc.deb
MD5 checksum: 22b1a269531edf1e993357faf4798431
http://security.debian.org/dists/potato/updates/main/binary-sparc/libncurses5_5.0-6.0potato1_sparc.deb
MD5 checksum: 6ab5fcb0a3e16e621c674de011ef3b11
http://security.debian.org/dists/potato/updates/main/binary-sparc/ncurses-bin_5.0-6.0potato1_sparc.deb
MD5 checksum: 1234052e8df0cb0b30ea7a562952816c
Debian GNU/Linux Unstable alias woody
This version of Debian is not yet released.
Fixes will be made available for Alpha, ARM, Intel ia32,
Motorola 680×0, PowerPC, and SPARC in the Debian archive over the
next several days.
For apt-get: deb http://security.debian.org/
stable/updates main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>