Security World: [SECURITY] [DSA 1890-1] New wxwidgets packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1890-1 security@debian.org
http://www.debian.org/security/ Giuseppe Iuculano
September 19, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Packages : wxwindows2.4 wxwidgets2.6 wxwidgets2.8
Vulnerability : integer overflow
Problem type : remote
Debian-specific: no
CVE Id : CVE-2009-2369

Tielei Wang has discovered an integer overflow in wxWidgets, the wxWidgets
Cross-platform C++ GUI toolkit, which allows the execution of arbitrary
code via a crafted JPEG file.

For the oldstable distribution (etch), this problem has been fixed in version
2.4.5.1.1+etch1 for wxwindows2.4 and version 2.6.3.2.1.5+etch1 for
wxwidgets2.6.

For the stable distribution (lenny), this problem has been fixed in version
2.6.3.2.2-3+lenny1 for wxwidgets2.6 and version 2.8.7.1-1.1+lenny1 for
wxwidgets2.8.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 2.8.7.1-2 for wxwidgets2.8 and will be fixed soon for
wxwidgets2.6.

We recommend that you upgrade your wxwidgets packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/w/wxwidgets2.6/wxwidgets2.6_2.6.3.2.1.5+etch1.dsc
Size/MD5 checksum: 1070 122f76e514a09e27a2efeb83972508bf
http://security.debian.org/pool/updates/main/w/wxwindows2.4/wxwindows2.4_2.4.5.1.1+etch1.tar.gz
Size/MD5 checksum: 11008448 56e09f548341a24faab4e2494ccf3c2e
http://security.debian.org/pool/updates/main/w/wxwindows2.4/wxwindows2.4_2.4.5.1.1+etch1.dsc
Size/MD5 checksum: 1088 956079f1b2e0639fdd5edab2112c528a
http://security.debian.org/pool/updates/main/w/wxwidgets2.6/wxwidgets2.6_2.6.3.2.1.5+etch1.tar.gz
Size/MD5 checksum: 15785194 de6ed02cb129ce6393d132452999cd17

Architecture independent packages:

http://security.debian.org/pool/updates/main/w/wxwidgets2.6/wx2.6-i18n_2.6.3.2.1.5+etch1_all.deb
Size/MD5 checksum: 664476 ab249de067119db66091ecc4a4412d35
http://security.debian.org/pool/updates/main/w/wxwidgets2.6/python-wxtools_2.6.3.2.1.5+etch1_all.deb
Size/MD5 checksum: 17782 f176eaeafccacf0b965c68d3b61a0253
http://security.debian.org/pool/updates/main/w/wxwidgets2.6/wx2.6-examples_2.6.3.2.1.5+etch1_all.deb
Size/MD5 checksum: 3633304 e2b5d8c1c0edcd2287a35a327576ebdd
http://security.debian.org/pool/updates/main/w/wxwidgets2.6/wx2.6-doc_2.6.3.2.1.5+etch1_all.deb
Size/MD5 checksum: 1252698 cb859a2500031b5cd6d4397f7bfd5eb3
http://security.debian.org/pool/updates/main/w/wxwindows2.4/wx2.4-i18n_2.4.5.1.1+etch1_all.deb
Size/MD5 checksum: 372546 988d0727d645d9c75f4ae8509abd719b
http://security.debian.org/pool/updates/main/w/wxwidgets2.6/python-wxversion_2.6.3.2.1.5+etch1_all.deb
Size/MD5 checksum: 21782 a704638d51c4ef98ec5a2f9473ae68a7
http://security.debian.org/pool/updates/main/w/wxwindows2.4/wx2.4-doc_2.4.5.1.1+etch1_all.deb
Size/MD5 checksum: 1076678 e6271674af7b940be14ebfb52e23b92d
http://security.debian.org/pool/updates/main/w/wxwindows2.4/wx2.4-examples_2.4.5.1.1+etch1_all.deb
Size/MD5 checksum: 2709008 c7028e976a32f5244ebb27693db064c6

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/w/wxwidgets2.8/wxwidgets2.8_2.8.7.1-1.1+lenny1.dsc
Size/MD5 checksum: 1797 33a581cfe33271a4b4106f6e8ec83da4
http://security.debian.org/pool/updates/main/w/wxwidgets2.6/wxwidgets2.6_2.6.3.2.2-3+lenny1.dsc
Size/MD5 checksum: 1582 e375d8ab0c7603bf7920325d9ba81af7
http://security.debian.org/pool/updates/main/w/wxwidgets2.8/wxwidgets2.8_2.8.7.1-1.1+lenny1.diff.gz
Size/MD5 checksum: 40476 7175110c4231ee1ae2df920f545af50d
http://security.debian.org/pool/updates/main/w/wxwidgets2.6/wxwidgets2.6_2.6.3.2.2-3+lenny1.diff.gz
Size/MD5 checksum: 117286 15784243277609fbe69e759ce207202c
http://security.debian.org/pool/updates/main/w/wxwidgets2.8/wxwidgets2.8_2.8.7.1.orig.tar.gz
Size/MD5 checksum: 34856152 f75d2be063c2f2d180085b98e7775ecb
http://security.debian.org/pool/updates/main/w/wxwidgets2.6/wxwidgets2.6_2.6.3.2.2.orig.tar.gz
Size/MD5 checksum: 15136648 c07edbcab40c4a6ebd47df0cf3337ba8

Architecture independent packages:

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

powerpc architecture (PowerPC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkq0iKMACgkQ62zWxYk/rQc35QCfSVORowfEZuaNeg3czjsLDlIM
0oAAn2pvmprXrxy0ucq2w51BN5ETRvkW
=vXsu
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Saturday, September 19, 2009

[SECURITY] [DSA 1890-1] New wxwidgets packages fix arbitrary code execution

No comments: