Hosting Provided By

[SECURITY] [DSA 1416-1] New tk8.3 packages fix arbitrary code execution

From: Moritz Muehlenhoff <jmm(at)debian.org>
Date: Tue Nov 27 2007 - 15:56:39 EST

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

------------------------------------------------------------------------ Debian Security Advisory DSA-1416-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq
------------------------------------------------------------------------

Package        : tk8.3
Vulnerability  : buffer overflow
Problem type   : local(remote)
Debian-specific: no
CVE Id(s)      : CVE-2007-5378

It was discovered that Tk, a cross-platform graphical toolkit for Tcl performs insufficient input validation in the code used to load GIF images, which may lead to the execution of arbitrary code.

For the stable distribution (etch), this problem has been fixed in version 8.3.5-6etch1.

Due to the technical limitation in the Debian archive scripts the update for the old stable distribution (sarge) cannot be released in sync with the update for the stable distribution. It will be provided in the next days.

We recommend that you upgrade your tk8.3 packages.

Upgrade instructions

- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update

Do you need help?

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1.dsc
    Size/MD5 checksum:      672 de719ed8329448b60a2aa5222d94b4c5
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1.diff.gz
    Size/MD5 checksum:    28583 de9d57ab9820f98f01a71cab78b9a51c
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5.orig.tar.gz
    Size/MD5 checksum:  2598030 363a55d31d94e05159e9212074c68004

Architecture independent packages:

http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-doc_8.3.5-6etch1_all.deb Size/MD5 checksum: 656798 11b87b5e83e8adfa2e19dc93567c422f

Do you need more help?

alpha architecture (DEC Alpha)

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_alpha.deb
    Size/MD5 checksum:   808264 05534d541c67856fd7df57bee0b7448f
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_alpha.deb
    Size/MD5 checksum:   870224 c8f3c39de9dbdbe34afc0558653e97f2

amd64 architecture (AMD x86_64 (AMD64))

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_amd64.deb
    Size/MD5 checksum:   691340 3aa055a50b0c1864712cad543240cab6
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_amd64.deb
    Size/MD5 checksum:   830790 50c07325658b74d25d06e239012da590

arm architecture (ARM)

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_arm.deb
    Size/MD5 checksum:   649782 33621a77aaf49894dc7962d7579ae2c3
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_arm.deb
    Size/MD5 checksum:   802848 7619e44e0c07804307f3b3d59d97589a

hppa architecture (HP PA RISC)

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_hppa.deb
    Size/MD5 checksum:   888990 d9eaf0227c0594236389bf877747744e
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_hppa.deb
    Size/MD5 checksum:   773376 c06fc4983e04a409811c6b070a7d0b4a

i386 architecture (Intel ia32)

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_i386.deb
    Size/MD5 checksum:   670426 3bf93bae2527f043b01edb3018de4d90
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_i386.deb
    Size/MD5 checksum:   803736 99d6c8562e60a2648817db63555fcbc1

ia64 architecture (Intel ia64)

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_ia64.deb
    Size/MD5 checksum:  1057842 45e3159db424788b401d4a98c1dfb511
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_ia64.deb
    Size/MD5 checksum:   959436 9cce282e61e257655301ad47ddc03ac1

mips architecture (MIPS (Big Endian))

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_mips.deb
    Size/MD5 checksum:   824708 437a50b7cfd05d863b9a4a97b596969e
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_mips.deb
    Size/MD5 checksum:   725262 8a50f4b098e50fec648ce187139f8af8

mipsel architecture (MIPS (Little Endian))

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_mipsel.deb
    Size/MD5 checksum:   822976 3451e740c116b8fbf77c07e744624637
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_mipsel.deb
    Size/MD5 checksum:   725896 6c09774f07d8463251684f26c1bcda1f

Can we help you?

powerpc architecture (PowerPC)

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_powerpc.deb
    Size/MD5 checksum:   824230 2251a2ee8548aeeb72dd4a1f425fc2b0
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_powerpc.deb
    Size/MD5 checksum:   659860 d0332098901ff52792d9ab560b242b61

s390 architecture (IBM S/390)

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_s390.deb
    Size/MD5 checksum:   693954 324775b60e7224a3aab44b895a3eb7b9
Can't find what you're looking for? 
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software:Learn more about Pantek's Technical Support offerings
Place an order for 24/7/365 Technical Support here
Learn more about Pantek, who we are, and what we do
Chat with a Live Operator
Related lists.debian.org Links
debian-announce
debian-apache
debian-arm-changes
debian-beowulf
debian-boot
debian-cd
debian-cd-vendors
debian-changes
debian-changes-digest
debian-isp
debian-kde
debian-laptop
debian-mirrors-announce
debian-news
debian-security
debian-security-announce
debian-testing
debian-user
debian-user-digest
Request more information about Pantek
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_s390.deb
    Size/MD5 checksum:   838370 1a04c4abe7846022366f401a7049e83e

sparc architecture (Sun SPARC/UltraSPARC)

  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_sparc.deb
    Size/MD5 checksum:   805234 9bc0cd3ac6d1a375ffe56d889d4967a7
  
http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_sparc.deb
    Size/MD5 checksum:   680440 328ed71bd6147eb48d1843ad04d7406c

These files will probably be moved into the stable distribution on its next update.

--------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHTIQpXm3vHE4uyloRAu3YAJ9RDQkX0xRClWaEiZVkEU1A7/IHAgCdECYE O227xjm2evaV0ZuE5krU8lU=
=ywra
-----END PGP SIGNATURE-----

-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Received on Tue Nov 27 21:11:34 2007

This message: [ Message body ]
Next message: Steve Kemp: "[SECURITY] [DSA 1409-3] New samba packages fix several vulnerabilities"
Previous message: Moritz Muehlenhoff: "[SECURITY] [DSA 1415-1] New tk8.4 packages fix arbitrary code execution"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ] [ By messages with attachments ]

This archive was generated by hypermail 2.1.8 : Wed Mar 19 2008 - 06:53:37 EDT