Security World: [SECURITY] [DSA 2058-1] New glibc packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2058-1 security@debian.org
http://www.debian.org/security/ Aurelien Jarno
June 10, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : glibc, eglibc
Vulnerability : multiple
Problem type : remote (local)
Debian-specific: no
CVE Id(s) : CVE-2008-1391 CVE-2009-4880, CVE-2009-4881
CVE-2010-0296 CVE-2010-0830
Debian Bug : 583908

Several vulnerabilities have been discovered in the GNU C Library (aka
glibc) and its derivatives. The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2008-1391, CVE-2009-4880, CVE-2009-4881

Maksymilian Arciemowicz discovered that the GNU C library did not
correctly handle integer overflows in the strfmon family of
functions. If a user or automated system were tricked into
processing a specially crafted format string, a remote attacker
could crash applications, leading to a denial of service.

CVE-2010-0296

Jeff Layton and Dan Rosenberg discovered that the GNU C library did
not correctly handle newlines in the mntent family of functions. If
a local attacker were able to inject newlines into a mount entry
through other vulnerable mount helpers, they could disrupt the
system or possibly gain root privileges.

CVE-2010-0830

Dan Rosenberg discovered that the GNU C library did not correctly
validate certain ELF program headers. If a user or automated system
were tricked into verifying a specially crafted ELF program, a
remote attacker could execute arbitrary code with user privileges.

For the stable distribution (lenny), these problems have been fixed in
version 2.7-18lenny4 of the glibc package.

For the testing distribution (squeeze), these problems will be fixed soon.

For the unstable distribution (sid), these problems has been fixed in
version 2.1.11-1 of the eglibc package.

We recommend that you upgrade your glibc or eglibc packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7-18lenny4.diff.gz
Size/MD5 checksum: 749289 dcb022bd274969ef458933d45b06cca8
http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7.orig.tar.gz
Size/MD5 checksum: 15386750 8816fbab13a072c0ccef6640c9d20833
http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7-18lenny4.dsc
Size/MD5 checksum: 2564 f5b705bcda1bc7674aa33fb07f417f98

Architecture independent packages:

http://security.debian.org/pool/updates/main/g/glibc/glibc-source_2.7-18lenny4_all.deb
Size/MD5 checksum: 16007014 fd3b316ef085ea9ce71dc67fefd92dc0
http://security.debian.org/pool/updates/main/g/glibc/locales_2.7-18lenny4_all.deb
Size/MD5 checksum: 4488186 b9beabe612fbfb014faadef6543e7fab
http://security.debian.org/pool/updates/main/g/glibc/glibc-doc_2.7-18lenny4_all.deb
Size/MD5 checksum: 1629166 da396340195ba0214d1d7827ed225341

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkwQnroACgkQNxpp46476aozLwCeIRM+xiDfFkRRlTez3Xbg4RQC
KhQAn01X/1yCs2fhqc+V8psHcJJELFCC
=w4y3
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/20100610081346.GA13993@SD6-Casa.iuculano.it

Security World

Search This Blog

Thursday, June 10, 2010

[SECURITY] [DSA 2058-1] New glibc packages fix several vulnerabilities

No comments: