Debian GNU/Linux
Debian Security Advisory DSA 651-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
January 20th, 2005 http://www.debian.org/security/faq
Package : squid
Vulnerability : buffer overflow, integer overflow
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2005-0094 CAN-2005-0095
Several vulnerabilities have been discovered in Squid, the
internet object cache, the popular WWW proxy cache. The Common
Vulnerabilities and Exposures Project identifies the following
vulnerabilities:
CAN-2005-0094
“infamous41md” discovered a buffer overflow in the parser for
Gopher responses which will lead to memory corruption and usually
crash Squid.
CAN-2005-0095
“infamous41md” discovered an integer overflow in the receiver of
WCCP (Web Cache Communication Protocol) messages. An attacker could
send a specially crafted UDP datagram that will cause Squid to
crash.
For the stable distribution (woody) these problems have been
fixed in version 2.4.6-2woody5.
For the unstable distribution (sid) these problems have been
fixed in version 2.5.7-4.
We recommend that you upgrade your squid package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5.dsc
Size/MD5 checksum: 612 69bd41324bb88cc4a76fcacba1f6cb9b
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5.diff.gz
Size/MD5 checksum: 227846 52f6d82e486f23dba4240260dc64ea57
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6.orig.tar.gz
Size/MD5 checksum: 1081920 59ce2c58da189626d77e27b9702ca228
Alpha architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_alpha.deb
Size/MD5 checksum: 814804 684a7a602a7dce53d3e2d5ea526cdfeb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_alpha.deb
Size/MD5 checksum: 75340 061412b8ca998b1ae5a7c576eac51425
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_alpha.deb
Size/MD5 checksum: 60094 8ecf3345226d4023c661cb5950929d5c
ARM architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_arm.deb
Size/MD5 checksum: 725286 b9103ba40dfcc47200b971a0ad123bb9
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_arm.deb
Size/MD5 checksum: 73116 fe083c2e4e65e0bcff82b42c292f9c69
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_arm.deb
Size/MD5 checksum: 58444 225728ea1d83a4f999cbcd1cbc918471
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_i386.deb
Size/MD5 checksum: 684376 bd4f50309316282ffdf9012e6a051349
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_i386.deb
Size/MD5 checksum: 72850 f0f790e828a53ae94406c68d8c386ac7
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_i386.deb
Size/MD5 checksum: 58014 9f2e5d189aa0df9d01d47c6870ca25f9
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_ia64.deb
Size/MD5 checksum: 953366 146cb3cfadbb09b473289462fcb85c4e
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_ia64.deb
Size/MD5 checksum: 79224 6a83889272e28d86602d86358929196b
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_ia64.deb
Size/MD5 checksum: 62766 6b48ca53c8bc2f0972a1b4653d04fa54
HP Precision architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_hppa.deb
Size/MD5 checksum: 779204 684c9f7e7b7bd4abda5eda0890974951
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_hppa.deb
Size/MD5 checksum: 74562 861f28d3d058c56d620ce557b488780f
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_hppa.deb
Size/MD5 checksum: 59574 16d03b269cb3d067cd6129b9bf1eccdc
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_m68k.deb
Size/MD5 checksum: 665532 da4701e4506c91a7297ebe41314d88cd
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_m68k.deb
Size/MD5 checksum: 72460 3ad96b1dc107bbaafd67592f8477bab4
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_m68k.deb
Size/MD5 checksum: 57678 0202dafa52ea24eb34c3d477459ad287
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_mips.deb
Size/MD5 checksum: 764854 c97c148f54c9d80e9d3d6c127894813b
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_mips.deb
Size/MD5 checksum: 74028 d49e9634ed353d8b713f4d80de731b61
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_mips.deb
Size/MD5 checksum: 58730 762b4bb651f8531208db4cd941a06560
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_mipsel.deb
Size/MD5 checksum: 764702 d134fdcf4916a521147f94837e2e544e
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_mipsel.deb
Size/MD5 checksum: 74118 9bdfc6bc5e7f752df213cdffb197f877
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_mipsel.deb
Size/MD5 checksum: 58838 edc757de19a59274fcb2a3d32791dcc0
PowerPC architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_powerpc.deb
Size/MD5 checksum: 722068 9c18747e4a7e6b15c05ab547efc59993
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_powerpc.deb
Size/MD5 checksum: 73100 7af618b2b8b1e225af2631a07da615d8
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_powerpc.deb
Size/MD5 checksum: 58322 23f79cf266df794a375ba75b2a973026
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_s390.deb
Size/MD5 checksum: 711584 f750ce9dd12460574b2c69031d3933bf
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_s390.deb
Size/MD5 checksum: 73442 e9a485219baaec097b7d432ba4ea8a26
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_s390.deb
Size/MD5 checksum: 58876 4ab64ae10b353e69facfcc59fa6fa0ab
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_sparc.deb
Size/MD5 checksum: 724314 d4af1a337ee603d7b1039f132996b0bf
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_sparc.deb
Size/MD5 checksum: 75728 9974f32b84edb4969c9216742e9c9f73
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_sparc.deb
Size/MD5 checksum: 60762 a7aad73eabef840dd648ef058dc852d5
These files will probably be moved into the stable distribution
on its next update.
Debian Security Advisory DSA 649-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
January 20th, 2005 http://www.debian.org/security/faq
Package : xtrlock
Vulnerability : buffer overflow
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2005-0079
Debian Bug : 278190 278191
A buffer overflow has been discovered in xtrlock, a minimal X
display lock program which can be exploited by a malicious local
attacker to crash the lock program and take over the desktop
session.
For the stable distribution (woody) this problem has been fixed
in version 2.0-6woody2.
For the unstable distribution (sid) this problem has been fixed
in version 2.0-9.
We recommend that you upgrade your xtrlock package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2.dsc
Size/MD5 checksum: 500 d39ea1ae4ee66338786d018406065022
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2.tar.gz
Size/MD5 checksum: 6977 6e6cfc0627bb74bd5014b550c2ea7a5f
Alpha architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_alpha.deb
Size/MD5 checksum: 9604 d05e56b7856e770b1b43daaf43a0dc3d
ARM architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_arm.deb
Size/MD5 checksum: 8604 f0d46d569f47ecb8a138c9f91be6cdc6
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_i386.deb
Size/MD5 checksum: 8730 63b6233b95553ffa59de4811c06a6502
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_ia64.deb
Size/MD5 checksum: 10104 ab12fc340b57cb3cbd58cbb0e6e1c188
HP Precision architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_hppa.deb
Size/MD5 checksum: 8988 cd59712f225ec6d790ad608a8c0dac3a
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_m68k.deb
Size/MD5 checksum: 8606 abac92671aefe845c7fd609668a9f367
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_mips.deb
Size/MD5 checksum: 8830 1a09a3a4e99e8c5f94a555ad8f9fc0c0
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_mipsel.deb
Size/MD5 checksum: 8828 7f56d17dd068abe7cb99a47f2e328fc9
PowerPC architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_powerpc.deb
Size/MD5 checksum: 8636 cd7dfdba990035bc942e1c16844eefcd
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_s390.deb
Size/MD5 checksum: 9128 f85ab602c4160b29bdb98170114b2368
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_sparc.deb
Size/MD5 checksum: 11340 c5b11b174068e3b0ebc61aa5f6cf9412
These files will probably be moved into the stable distribution
on its next update.
Debian Security Advisory DSA 650-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
January 20th, 2005 http://www.debian.org/security/faq
Package : sword
Vulnerability : missing input sanitising
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2005-0015
Ulf Härnhammar discovered that due to missing
input sanitising in diatheke, a CGI script for making and browsing
a bible website, it is possible to execute arbitrary commands via a
specially crafted URL.
For the stable distribution (woody) this problem has been fixed
in version 1.5.3-3woody2.
For the unstable distribution (sid) this problem will be fixed
soon.
We recommend that you upgrade your diatheke package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/s/sword/sword_1.5.3-3woody2.dsc
Size/MD5 checksum: 612 9204579e3a264d7d43297c1b7bf98438
http://security.debian.org/pool/updates/main/s/sword/sword_1.5.3-3woody2.diff.gz
Size/MD5 checksum: 21169 c355f97deb2ef2c39b82aec857b15a21
http://security.debian.org/pool/updates/main/s/sword/sword_1.5.3.orig.tar.gz
Size/MD5 checksum: 2389613 055f9c1e7c081a667674d9f4112abf11
Alpha architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_alpha.deb
Size/MD5 checksum: 82154 2c73838e4e5d1112ded21365df2578a3
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_alpha.deb
Size/MD5 checksum: 1712920 e3914e31b0b0217ac8f227f8730c0ace
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_alpha.deb
Size/MD5 checksum: 13312 29c89888a4b51b5aa555ff55b0a410ad
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_alpha.deb
Size/MD5 checksum: 601828 dfcf6f97b2b3eead528e92b5dc387fe6
ARM architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_arm.deb
Size/MD5 checksum: 56756 0a83537894f73c59aac38b8698d68dc8
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_arm.deb
Size/MD5 checksum: 989694 18f31fc2d82aec5b342a62822f6421d8
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_arm.deb
Size/MD5 checksum: 13326 f8a405bc39b9e73d84cb42448144b4ec
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_arm.deb
Size/MD5 checksum: 298826 53df2455c33de26ddc7f661f1ff74a43
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_i386.deb
Size/MD5 checksum: 54788 7329737ccfe2988b667bf1cf4d0b684d
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_i386.deb
Size/MD5 checksum: 923510 87cbc45e59453e36004331d8a1ba4950
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_i386.deb
Size/MD5 checksum: 13320 190147bb90a295003c9bf6ad0e0a48d4
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_i386.deb
Size/MD5 checksum: 281460 c0c5beeb00046e67a6fa9089e9d43d14
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_ia64.deb
Size/MD5 checksum: 62174 fbf8fac6dfc7d61a739b3bdb3f499566
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_ia64.deb
Size/MD5 checksum: 1291474 d38e91788454487c3fc8b40e017fc682
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_ia64.deb
Size/MD5 checksum: 13308 b24742b3c41724e34669d0b921cb3d27
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_ia64.deb
Size/MD5 checksum: 333424 7aaaaf076026a95ac0d0bdbe488777fb
HP Precision architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_hppa.deb
Size/MD5 checksum: 62118 2504df74d92b6adb4910a6a4f3452183
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_hppa.deb
Size/MD5 checksum: 1104178 07328cd8ee7dde27dfed04296e3ae908
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_hppa.deb
Size/MD5 checksum: 13320 d62ee10092df4e13ad703662fd5ffdda
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_hppa.deb
Size/MD5 checksum: 321394 ab1a13bf24f55ca743a8c760adebc8e9
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_m68k.deb
Size/MD5 checksum: 53082 39829e678361864e1da30406d34b63eb
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_m68k.deb
Size/MD5 checksum: 932564 a1189885065e93581e8467cc85b270cd
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_m68k.deb
Size/MD5 checksum: 13340 2b3407e4e1f8e272f86d297d6ff73738
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_m68k.deb
Size/MD5 checksum: 298670 47ec4a13a6a9492deaa50d841366458d
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_mips.deb
Size/MD5 checksum: 52350 e4c719c9a0dda7691232f30eef22dbde
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_mips.deb
Size/MD5 checksum: 1109974 878366a171bca33b56ee9710119412c9
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_mips.deb
Size/MD5 checksum: 13332 91fe931443f5ae22621628db2deef543
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_mips.deb
Size/MD5 checksum: 256508 82fb17f0ff951a96d406d1f65eac8a26
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_mipsel.deb
Size/MD5 checksum: 52126 5e61bca3b51666582fbb182398f0f9bd
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_mipsel.deb
Size/MD5 checksum: 1099316 5de4d4a7a89bc24bb3e50f4bf6edf740
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_mipsel.deb
Size/MD5 checksum: 13346 f0fcbee29448cd9c32d906ecdee962f3
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_mipsel.deb
Size/MD5 checksum: 240420 b71294049ac28ea1fafe85968b6499de
PowerPC architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_powerpc.deb
Size/MD5 checksum: 53026 4063714e63bb48f93c16c70be949d2c1
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_powerpc.deb
Size/MD5 checksum: 1000066 7eda6d983cd89dee3543b6db26a3bdfe
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_powerpc.deb
Size/MD5 checksum: 13318 3687a1d751652c987d9e658463e71e9a
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_powerpc.deb
Size/MD5 checksum: 306722 8d01c00d9235925512c46b5e4efe5bfe
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_s390.deb
Size/MD5 checksum: 50260 6dafccc1e39907a9852bb8f73be90c30
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_s390.deb
Size/MD5 checksum: 889972 dc0a114eb6df20568623173363c34fab
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_s390.deb
Size/MD5 checksum: 13322 520de046e8134166d87d0ea4eb699d1f
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_s390.deb
Size/MD5 checksum: 278278 9fcd920f31203c18884a74d3e2b208ad
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_sparc.deb
Size/MD5 checksum: 53248 ed0cafc23539322dd589c13d74fef525
http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_sparc.deb
Size/MD5 checksum: 953876 862ce2d7c89eeb445a1348158439838f
http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_sparc.deb
Size/MD5 checksum: 13322 d7db9daeb609981e322caa1549b84015
http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_sparc.deb
Size/MD5 checksum: 281526 2d918e10ef4eba590d5185410e11340d
These files will probably be moved into the stable distribution
on its next update.
For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>
Mandrakelinux
Mandrakelinux Security Update Advisory
Package name: mpg123
Advisory ID: MDKSA-2005:009
Date: January 19th, 2005
Affected versions: 10.0, 10.1, Corporate Server 2.1, Corporate
Server 3.0
Problem Description:
A vulnerability in mpg123’s ability to parse frame headers in
input streams could allow a malicious file to exploit a buffer
overflow and execute arbitray code with the permissions of the user
running mpg123.
The updated packages have been patched to prevent these
problems.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0991
Updated Packages:
Mandrakelinux 10.0:
c6853d42d98e62393a7f819a2ffe3356
10.0/RPMS/mpg123-0.59r-22.2.100mdk.i586.rpm
a23d6bfb05fa6ac27067bc31428092eb
10.0/SRPMS/mpg123-0.59r-22.2.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
4ee7ef6a8d53837780ed7f2b03839673
amd64/10.0/RPMS/mpg123-0.59r-22.2.100mdk.amd64.rpm
a23d6bfb05fa6ac27067bc31428092eb
amd64/10.0/SRPMS/mpg123-0.59r-22.2.100mdk.src.rpm
Mandrakelinux 10.1:
3f9c35756148f51b279631123545b75b
10.1/RPMS/mpg123-0.59r-22.2.101mdk.i586.rpm
4cf62de0ff365cd0e74c417f84b7730e
10.1/SRPMS/mpg123-0.59r-22.2.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
ee70a13d4ccfcf5f8fbd9ed778186647
x86_64/10.1/RPMS/mpg123-0.59r-22.2.101mdk.x86_64.rpm
4cf62de0ff365cd0e74c417f84b7730e
x86_64/10.1/SRPMS/mpg123-0.59r-22.2.101mdk.src.rpm
Corporate Server 2.1:
b68e025bfc40ff120c63d77bed97270b
corporate/2.1/RPMS/mpg123-0.59r-21.3.C21mdk.i586.rpm
437ddd9bda9615417690f737e9722990
corporate/2.1/SRPMS/mpg123-0.59r-21.3.C21mdk.src.rpm
Corporate Server 2.1/x86_64:
deb362353f3912ed0154847947c45543
x86_64/corporate/2.1/RPMS/mpg123-0.59r-21.3.C21mdk.x86_64.rpm
437ddd9bda9615417690f737e9722990
x86_64/corporate/2.1/SRPMS/mpg123-0.59r-21.3.C21mdk.src.rpm
Corporate Server 3.0:
2d5fd7533161e466ba3f3b1307be77d1
corporate/3.0/RPMS/mpg123-0.59r-22.2.C30mdk.i586.rpm
7aab2dce78c90489c8da66e715b61bf5
corporate/3.0/SRPMS/mpg123-0.59r-22.2.C30mdk.src.rpm
To upgrade automatically use MandrakeUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandrakesoft for security. You can
obtain the GPG public key of the Mandrakelinux Security Team by
executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
Mandrakelinux Security Update Advisory
Package name: playmidi
Advisory ID: MDKSA-2005:010
Date: January 19th, 2005
Affected versions: 10.0, 10.1, Corporate Server 3.0
Problem Description:
Erik Sjolund discovered a buffer overflow in playmidi that could
be exploited by a local attacker if installed setuid root. Note
that by default Mandrakelinux does not ship playmidi installed
setuid root.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0020
Updated Packages:
Mandrakelinux 10.0:
11b39014c3c354c549f4b510d0e59ad5
10.0/RPMS/playmidi-2.5-3.1.100mdk.i586.rpm
930ad98832bc68b4f2d97cde16fbb589
10.0/RPMS/playmidi-X11-2.5-3.1.100mdk.i586.rpm
ac2bef9ddcba160bf52f9a883c759fdf
10.0/SRPMS/playmidi-2.5-3.1.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
629089b1281e17784bd3fc4d69d8424a
amd64/10.0/RPMS/playmidi-2.5-3.1.100mdk.amd64.rpm
d8cf76271cfab47e597090400c32ca4a
amd64/10.0/RPMS/playmidi-X11-2.5-3.1.100mdk.amd64.rpm
ac2bef9ddcba160bf52f9a883c759fdf
amd64/10.0/SRPMS/playmidi-2.5-3.1.100mdk.src.rpm
Mandrakelinux 10.1:
1be61eeb85b0c916771fc5a834691835
10.1/RPMS/playmidi-2.5-3.1.101mdk.i586.rpm
e43429abba5378ab18d5d8cb1b61c345
10.1/RPMS/playmidi-X11-2.5-3.1.101mdk.i586.rpm
c1958aeb4fe6a620b43c90581c5cbef8
10.1/SRPMS/playmidi-2.5-3.1.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
acbe49ee3b86227a0757cd8ebf7b1d08
x86_64/10.1/RPMS/playmidi-2.5-3.1.101mdk.x86_64.rpm
3f1bd829359d1d5b26d879ca3ed20c8b
x86_64/10.1/RPMS/playmidi-X11-2.5-3.1.101mdk.x86_64.rpm
c1958aeb4fe6a620b43c90581c5cbef8
x86_64/10.1/SRPMS/playmidi-2.5-3.1.101mdk.src.rpm
Corporate Server 3.0:
ee62926bf969895976b99bafb79d12a6
corporate/3.0/RPMS/playmidi-2.5-3.1.C30mdk.i586.rpm
983da3f98fd776bdeb484ce6228e8a8d
corporate/3.0/RPMS/playmidi-X11-2.5-3.1.C30mdk.i586.rpm
70a3be81e9afce9341faf9ce61e7e60a
corporate/3.0/SRPMS/playmidi-2.5-3.1.C30mdk.src.rpm
To upgrade automatically use MandrakeUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandrakesoft for security. You can
obtain the GPG public key of the Mandrakelinux Security Team by
executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
Mandrakelinux Security Update Advisory
Package name: xine-lib
Advisory ID: MDKSA-2005:011
Date: January 19th, 2005
Affected versions: 10.0, 10.1
Problem Description:
iDefense discovered that the PNA_TAG handling code in
pnm_get_chunk() does not check if the input size is larger than the
buffer size (CAN-2004-1187). As well, they discovered that in this
same function, a negative value could be given to an unsigned
variable that specifies the read length of input data
(CAN-2004-1188).
Ariel Berkman discovered that xine-lib reads specific input data
into an array without checking the input size making it vulnerable
to a buffer overflow problem (CAN-2004-1300).
The updated packages have been patched to prevent these
problems.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1187
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1300
http://xinehq.de/index.php/security/XSA-2004-6
http://xinehq.de/index.php/security/XSA-2004-7
Updated Packages:
Mandrakelinux 10.0:
04cf16b28902e4591e11ae72fd87d662
10.0/RPMS/libxine1-1-0.rc3.6.3.100mdk.i586.rpm
b4229121fb5e1c2e8e3150fb770d20b1
10.0/RPMS/libxine1-devel-1-0.rc3.6.3.100mdk.i586.rpm
dedf902f1106a5d2962169e0d384484b
10.0/RPMS/xine-aa-1-0.rc3.6.3.100mdk.i586.rpm
0e794be9dcbe0d7df7ac7023f90b9ce7
10.0/RPMS/xine-arts-1-0.rc3.6.3.100mdk.i586.rpm
e2129af73ff087513cf3e206b6243a22
10.0/RPMS/xine-dxr3-1-0.rc3.6.3.100mdk.i586.rpm
465023e0d347cc68e50cd18e7e035d7f
10.0/RPMS/xine-esd-1-0.rc3.6.3.100mdk.i586.rpm
3aba7156985636b52cf388ee65efa61a
10.0/RPMS/xine-flac-1-0.rc3.6.3.100mdk.i586.rpm
442d828c5c5c477fb4056eec27ac99ac
10.0/RPMS/xine-gnomevfs-1-0.rc3.6.3.100mdk.i586.rpm
73e2c9d0af08f7af594897963ad2acee
10.0/RPMS/xine-plugins-1-0.rc3.6.3.100mdk.i586.rpm
987634217ee50058b309ce153c0d71cd
10.0/SRPMS/xine-lib-1-0.rc3.6.3.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
66d763149801966fb38c9a07666eced3
amd64/10.0/RPMS/lib64xine1-1-0.rc3.6.3.100mdk.amd64.rpm
486eaa41ea24dc895ab68a7221efa641
amd64/10.0/RPMS/lib64xine1-devel-1-0.rc3.6.3.100mdk.amd64.rpm
5b454fdc3cc84ce2bd9aa8d4495971af
amd64/10.0/RPMS/xine-aa-1-0.rc3.6.3.100mdk.amd64.rpm
f8a5ce8ccdb495f23c879a58dc4a005b
amd64/10.0/RPMS/xine-arts-1-0.rc3.6.3.100mdk.amd64.rpm
aa3a3a29c478a444bbcb4fe7f48d217c
amd64/10.0/RPMS/xine-esd-1-0.rc3.6.3.100mdk.amd64.rpm
051f953d91864f0609d55d9f5d13c545
amd64/10.0/RPMS/xine-flac-1-0.rc3.6.3.100mdk.amd64.rpm
7288d9764ff125053834cc3cbc56618b
amd64/10.0/RPMS/xine-gnomevfs-1-0.rc3.6.3.100mdk.amd64.rpm
8c11dd4c0453b8236494df5e177985b0
amd64/10.0/RPMS/xine-plugins-1-0.rc3.6.3.100mdk.amd64.rpm
987634217ee50058b309ce153c0d71cd
amd64/10.0/SRPMS/xine-lib-1-0.rc3.6.3.100mdk.src.rpm
Mandrakelinux 10.1:
dc10ced310a94ac2b1cdaa26d5065309
10.1/RPMS/libxine1-1-0.rc5.9.1.101mdk.i586.rpm
2ff06644e8ba40de686faea2870be099
10.1/RPMS/libxine1-devel-1-0.rc5.9.1.101mdk.i586.rpm
dab77c7bb2d958fb34fd07dd525b7026
10.1/RPMS/xine-aa-1-0.rc5.9.1.101mdk.i586.rpm
c0daf0f0835a0831251e725edb491d98
10.1/RPMS/xine-arts-1-0.rc5.9.1.101mdk.i586.rpm
a9d901fa51bd439c5e6b54fb799afcde
10.1/RPMS/xine-dxr3-1-0.rc5.9.1.101mdk.i586.rpm
6e2e9ac54916eb1409347968bddc0903
10.1/RPMS/xine-esd-1-0.rc5.9.1.101mdk.i586.rpm
954f717131a3079ea5dff56ab3a20a8e
10.1/RPMS/xine-flac-1-0.rc5.9.1.101mdk.i586.rpm
72a82036a27f6bed29412b81417603eb
10.1/RPMS/xine-gnomevfs-1-0.rc5.9.1.101mdk.i586.rpm
a76f9f553c97aa55fe4849225d7921a2
10.1/RPMS/xine-plugins-1-0.rc5.9.1.101mdk.i586.rpm
dab247b679d8cb6f7bdf06b71d5e54b8
10.1/SRPMS/xine-lib-1-0.rc5.9.1.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
5cfbd8787d4c8e0207437f048d5994a4
x86_64/10.1/RPMS/lib64xine1-1-0.rc5.9.1.101mdk.x86_64.rpm
8a4b9b26b8b58fd29477a6b260bd79c6
x86_64/10.1/RPMS/lib64xine1-devel-1-0.rc5.9.1.101mdk.x86_64.rpm
c2bc72cfbfe95f18a6ae0b18b98807c8
x86_64/10.1/RPMS/xine-aa-1-0.rc5.9.1.101mdk.x86_64.rpm
7f059dfbc7e445a255510c9a5a7338b7
x86_64/10.1/RPMS/xine-arts-1-0.rc5.9.1.101mdk.x86_64.rpm
53b293f453695e7104a1ae593f79608a
x86_64/10.1/RPMS/xine-dxr3-1-0.rc5.9.1.101mdk.x86_64.rpm
6efb0ca6be7650e60961e13f479b117a
x86_64/10.1/RPMS/xine-esd-1-0.rc5.9.1.101mdk.x86_64.rpm
4caa5c113d95773e4ca462b69bb17e76
x86_64/10.1/RPMS/xine-flac-1-0.rc5.9.1.101mdk.x86_64.rpm
ba0f5f739785622cac85034055fa7304
x86_64/10.1/RPMS/xine-gnomevfs-1-0.rc5.9.1.101mdk.x86_64.rpm
d3c1a9cca1ae3800d72f82486b26f0e1
x86_64/10.1/RPMS/xine-plugins-1-0.rc5.9.1.101mdk.x86_64.rpm
dab247b679d8cb6f7bdf06b71d5e54b8
x86_64/10.1/SRPMS/xine-lib-1-0.rc5.9.1.101mdk.src.rpm
To upgrade automatically use MandrakeUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandrakesoft for security. You can
obtain the GPG public key of the Mandrakelinux Security Team by
executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>