<<< Date Index >>>     <<< Thread Index >>>

[SECURITY] [DSA 1634-1] New wordnet packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1634-1                  security@xxxxxxxxxx
http://www.debian.org/security/                          Thijs Kinkhorst
September 01, 2008                    http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : wordnet
Vulnerability  : stack and heap overflows
Problem type   : local (remote)
Debian-specific: no
CVE id(s)      : CVE-2008-2149
Debian Bug     : 481186

Rob Holland discovered several programming errors in WordNet, an
electronic lexical database of the English language. These flaws could
allow arbitrary code execution when used with untrusted input, for
example when WordNet is in use as a back end for a web application.

For the stable distribution (etch), these problems have been fixed in
version 1:2.1-4+etch1.

For the testing distribution (lenny), these problems have been fixed in
version 1:3.0-11+lenny1.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your wordnet package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

  http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1.dsc
    Size/MD5 checksum:      772 24980d288101a1c11e60e38fe5ea945a
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1.diff.gz
    Size/MD5 checksum:    22912 bb970bd2ccd457c6310ba0c75e5ed2be
  http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1.orig.tar.gz
    Size/MD5 checksum:  6379385 95a6e8144254a92a5ea0e97771ef9d07

Architecture independent packages:

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-sense-index_2.1-4+etch1_all.deb
    Size/MD5 checksum:  2242538 dc75e162b0013a5d7d0c0679115b134c
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-base_2.1-4+etch1_all.deb
    Size/MD5 checksum:  8701430 a680094a45ddf87dd0bcbb5fd63ceae2

alpha architecture (DEC Alpha)

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_alpha.deb
    Size/MD5 checksum:    80734 3186aeb6b9365a333fdd608d5fa62ffe
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_alpha.deb
    Size/MD5 checksum:   109466 cc441b73b2ded97fff9fc5c668f2fbb0

amd64 architecture (AMD x86_64 (AMD64))

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_amd64.deb
    Size/MD5 checksum:   104990 b7b3225b10df973e2d8a652f770a6e1b
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_amd64.deb
    Size/MD5 checksum:    65118 bc75f17d4f5b1375fc3862ba80335d2f

arm architecture (ARM)

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_arm.deb
    Size/MD5 checksum:    61020 57e49d1f532015f07cbf3f71bba24237
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_arm.deb
    Size/MD5 checksum:   100056 43a1c7d6c272412f4f1eff5ff284fd54

hppa architecture (HP PA RISC)

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_hppa.deb
    Size/MD5 checksum:   108312 f6ed8345d69a1e13e9cd87f7974566fd
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_hppa.deb
    Size/MD5 checksum:    69896 a1649115a5bba73602f4c6dba8a57964

i386 architecture (Intel ia32)

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_i386.deb
    Size/MD5 checksum:    63096 ff93d37e8edeb63fd9268b19b052f3e2
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_i386.deb
    Size/MD5 checksum:   101738 65a6a41a5bf4de85c6ce474de7155c73

ia64 architecture (Intel ia64)

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_ia64.deb
    Size/MD5 checksum:    83014 98d7592aac60e394cca7262dbae45dc5
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_ia64.deb
    Size/MD5 checksum:   119716 a4a53c0fe7acf1828386d2e08e443b7a

mips architecture (MIPS (Big Endian))

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_mips.deb
    Size/MD5 checksum:   105498 f76685b8631f82c01b0fc604d22cb7b3
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_mips.deb
    Size/MD5 checksum:    73082 73a315a1e3706cc313559c7f8532232f

mipsel architecture (MIPS (Little Endian))

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_mipsel.deb
    Size/MD5 checksum:   104700 22d5b12949930d49d4d49ac63f106747
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_mipsel.deb
    Size/MD5 checksum:    71604 78f164f9758891934cb3854c8a10c6e7

powerpc architecture (PowerPC)

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_powerpc.deb
    Size/MD5 checksum:   108852 0b0448af12ac1052b11833252a269765
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_powerpc.deb
    Size/MD5 checksum:    69846 44d14734b11f31fb1f3522d68fae68ad

s390 architecture (IBM S/390)

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_s390.deb
    Size/MD5 checksum:   107032 a83524f4bc09a6f78a53216356043175
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_s390.deb
    Size/MD5 checksum:    65640 241a7fa7673077cfc762492a44c7764d

sparc architecture (Sun SPARC/UltraSPARC)

  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_sparc.deb
    Size/MD5 checksum:   102918 1f7f85106a3f41cfc2162db49ce0ac1f
  
http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_sparc.deb
    Size/MD5 checksum:    64812 89d27a34508044af76f2eeac4e1c696a


  These files will probably be moved into the stable distribution on
  its next update.

- 
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security 
dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBSLw/n2z0hbPcukPfAQJtQwgAsW+ORtd4lhMAsOaZ6mFQrHj3EJ7AnXRH
0hMoBxUM/ViyWJ/iKFgGKzbmAndl/ylRH3dWKkd4j/E08yQocvM5Ym3kSlV9ni1X
sF6zNdD8eY9FLT6Ja7yT5RrKn7rriNhAr9MaktMq276eCaCpSoB85KfhJ+UGapPJ
cMXLPW59z5BqgFi708stButXe0PHUmMcp/Zd+pvSTvsH+fLaxKK3DBRp2pH4DNLM
Dceugrdzt10uZfeZGRClcDAX4u9HUPwHs7gW7EuaQH5Ni7Y+aZhsigJOGTOl4DOF
4nEgh5eth1WJ0iK1I01KOunfhXVxXWAxh6b27sZbHhpAvYoYl3aKNg==
=EsVl
-----END PGP SIGNATURE-----