[SECURITY] [DSA 1416-1] New tk8.3 packages fix arbitrary code execution
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1416-1 security@xxxxxxxxxx
http://www.debian.org/security/ Moritz Muehlenhoff
November 27, 2007 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : tk8.3
Vulnerability : buffer overflow
Problem type : local(remote)
Debian-specific: no
CVE Id(s) : CVE-2007-5378
It was discovered that Tk, a cross-platform graphical toolkit for Tcl
performs insufficient input validation in the code used to load GIF
images, which may lead to the execution of arbitrary code.
For the stable distribution (etch), this problem has been fixed in
version 8.3.5-6etch1.
Due to the technical limitation in the Debian archive scripts the update
for the old stable distribution (sarge) cannot be released in sync with
the update for the stable distribution. It will be provided in the next
days.
We recommend that you upgrade your tk8.3 packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian (stable)
- ---------------
Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips,
mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1.dsc
Size/MD5 checksum: 672 de719ed8329448b60a2aa5222d94b4c5
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1.diff.gz
Size/MD5 checksum: 28583 de9d57ab9820f98f01a71cab78b9a51c
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5.orig.tar.gz
Size/MD5 checksum: 2598030 363a55d31d94e05159e9212074c68004
Architecture independent packages:
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-doc_8.3.5-6etch1_all.deb
Size/MD5 checksum: 656798 11b87b5e83e8adfa2e19dc93567c422f
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_alpha.deb
Size/MD5 checksum: 808264 05534d541c67856fd7df57bee0b7448f
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_alpha.deb
Size/MD5 checksum: 870224 c8f3c39de9dbdbe34afc0558653e97f2
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_amd64.deb
Size/MD5 checksum: 691340 3aa055a50b0c1864712cad543240cab6
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_amd64.deb
Size/MD5 checksum: 830790 50c07325658b74d25d06e239012da590
arm architecture (ARM)
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_arm.deb
Size/MD5 checksum: 649782 33621a77aaf49894dc7962d7579ae2c3
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_arm.deb
Size/MD5 checksum: 802848 7619e44e0c07804307f3b3d59d97589a
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_hppa.deb
Size/MD5 checksum: 888990 d9eaf0227c0594236389bf877747744e
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_hppa.deb
Size/MD5 checksum: 773376 c06fc4983e04a409811c6b070a7d0b4a
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_i386.deb
Size/MD5 checksum: 670426 3bf93bae2527f043b01edb3018de4d90
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_i386.deb
Size/MD5 checksum: 803736 99d6c8562e60a2648817db63555fcbc1
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_ia64.deb
Size/MD5 checksum: 1057842 45e3159db424788b401d4a98c1dfb511
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_ia64.deb
Size/MD5 checksum: 959436 9cce282e61e257655301ad47ddc03ac1
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_mips.deb
Size/MD5 checksum: 824708 437a50b7cfd05d863b9a4a97b596969e
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_mips.deb
Size/MD5 checksum: 725262 8a50f4b098e50fec648ce187139f8af8
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_mipsel.deb
Size/MD5 checksum: 822976 3451e740c116b8fbf77c07e744624637
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_mipsel.deb
Size/MD5 checksum: 725896 6c09774f07d8463251684f26c1bcda1f
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_powerpc.deb
Size/MD5 checksum: 824230 2251a2ee8548aeeb72dd4a1f425fc2b0
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_powerpc.deb
Size/MD5 checksum: 659860 d0332098901ff52792d9ab560b242b61
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_s390.deb
Size/MD5 checksum: 693954 324775b60e7224a3aab44b895a3eb7b9
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_s390.deb
Size/MD5 checksum: 838370 1a04c4abe7846022366f401a7049e83e
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_sparc.deb
Size/MD5 checksum: 805234 9bc0cd3ac6d1a375ffe56d889d4967a7
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_sparc.deb
Size/MD5 checksum: 680440 328ed71bd6147eb48d1843ad04d7406c
These files will probably be moved into the stable distribution on
its next update.
-
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFHTIQpXm3vHE4uyloRAu3YAJ9RDQkX0xRClWaEiZVkEU1A7/IHAgCdECYE
O227xjm2evaV0ZuE5krU8lU=
=ywra
-----END PGP SIGNATURE-----