Security World: [SECURITY] [DSA-1977-1] New python packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1977-1 security@debian.org
http://www.debian.org/security/ Giuseppe Iuculano
January 25, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Packages : python2.4 python2.5
Vulnerability : several vulnerabilities
Problem type : local (remote)
Debian-specific: no
CVE Id : CVE-2008-2316 CVE-2009-3560 CVE-2009-3720
Debian Bug : 493797 560912 560913

Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that the embedded Expat copy
in the interpreter for the Python language, does not properly process malformed or
crafted XML files. (CVE-2009-3560 CVE-2009-3720)
This vulnerability could allow an attacker to cause a denial of service while parsing
a malformed XML file.

In addition, this update fixes an integer overflow in the hashlib module in python2.5.
This vulnerability could allow an attacker to defeat cryptographic digests. (CVE-2008-2316)
It only affects the oldstable distribution (etch).

For the oldstable distribution (etch), these problems have been fixed in
version 2.4.4-3+etch3 for python2.4 and version 2.5-5+etch2 for python2.5.

For the stable distribution (lenny), these problems have been fixed in
version 2.4.6-1+lenny1 for python2.4 and version 2.5.2-15+lenny1 for python2.5.

For the unstable distribution (sid), these problems have been fixed in
version 2.5.4-3.1 for python2.5, and will migrate to the testing distribution (squeeze)
shortly.
python2.4 has been removed from the testing distribution (squeeze), and it will
be removed from the unstable distribution soon.

We recommend that you upgrade your python packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/p/python2.5/python2.5_2.5-5+etch2.dsc
Size/MD5 checksum: 1313 61c8f540d768731518e649f759ad1500
http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4-3+etch3.dsc
Size/MD5 checksum: 1210 647efe66b35aa00c2f0416e41920fdf8
http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4.orig.tar.gz
Size/MD5 checksum: 9508940 f74ef9de91918f8927e75e8c3024263a
http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.4-3+etch3.diff.gz
Size/MD5 checksum: 207460 c9b1b80a1aae12db910e353dab5cd0fb
http://security.debian.org/pool/updates/main/p/python2.5/python2.5_2.5-5+etch2.diff.gz
Size/MD5 checksum: 271887 2d1944512d0eaa925a4a158b2c3a5845
http://security.debian.org/pool/updates/main/p/python2.5/python2.5_2.5.orig.tar.gz
Size/MD5 checksum: 11010528 2ce301134620012ad6dafb27bbcab7eb

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/python2.5/idle-python2.5_2.5-5+etch2_all.deb
Size/MD5 checksum: 62226 9de6fad0cf4c106d77c4189ecf3f0fab
http://security.debian.org/pool/updates/main/p/python2.4/python2.4-examples_2.4.4-3+etch3_all.deb
Size/MD5 checksum: 589766 e33c071f8e1864e1c5a63d2e39f21d2f
http://security.debian.org/pool/updates/main/p/python2.5/python2.5-examples_2.5-5+etch2_all.deb
Size/MD5 checksum: 645704 8732b224b59cd6488596117d074831f9
http://security.debian.org/pool/updates/main/p/python2.4/idle-python2.4_2.4.4-3+etch3_all.deb
Size/MD5 checksum: 60154 8ac06e4c9ad4c1830ee90ece429690fe

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/p/python2.5/python2.5_2.5.2-15+lenny1.diff.gz
Size/MD5 checksum: 259402 0e938435302fecede43e1bae39fadec0
http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.6-1+lenny1.dsc
Size/MD5 checksum: 1635 d834b90d21b73518ccccb726f18f05c3
http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.6-1+lenny1.diff.gz
Size/MD5 checksum: 227322 f71561ec858f0e70c4c4a3170b70d825
http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.6.orig.tar.gz
Size/MD5 checksum: 9594954 1f81e15ea22838260d5c094d31107443
http://security.debian.org/pool/updates/main/p/python2.5/python2.5_2.5.2.orig.tar.gz
Size/MD5 checksum: 11577883 87619e5bf07b3506fec639b7e4d86215
http://security.debian.org/pool/updates/main/p/python2.5/python2.5_2.5.2-15+lenny1.dsc
Size/MD5 checksum: 1843 aba282dff875feff56c253b049599973

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/python2.4/python2.4-examples_2.4.6-1+lenny1_all.deb
Size/MD5 checksum: 592970 acd6acbc49867555f82a0973d3ea3634
http://security.debian.org/pool/updates/main/p/python2.4/idle-python2.4_2.4.6-1+lenny1_all.deb
Size/MD5 checksum: 62960 3ab8888a4f25fc99665468e1b9b6a532
http://security.debian.org/pool/updates/main/p/python2.5/idle-python2.5_2.5.2-15+lenny1_all.deb
Size/MD5 checksum: 67614 ab990a7d6b2e5551c2d2f4142adde757
http://security.debian.org/pool/updates/main/p/python2.5/python2.5-examples_2.5.2-15+lenny1_all.deb
Size/MD5 checksum: 650540 c7f2447d4ec76295ca1ed34b042c4fcd

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

http://security.debian.org/pool/updates/main/p/python2.4/python2.4-dev_2.4.6-1+lenny1_arm.deb
Size/MD5 checksum: 1480810 2ecf375fefba0aadc6c9072ae094f705
http://security.debian.org/pool/updates/main/p/python2.4/python2.4-minimal_2.4.6-1+lenny1_arm.deb
Size/MD5 checksum: 986362 99d2766a01407f95b9efa15b468cf2ae
http://security.debian.org/pool/updates/main/p/python2.4/python2.4-dbg_2.4.6-1+lenny1_arm.deb
Size/MD5 checksum: 6697802 2e708c97d70e1c078860f2c7ab66c4cf
http://security.debian.org/pool/updates/main/p/python2.4/python2.4_2.4.6-1+lenny1_arm.deb
Size/MD5 checksum: 2822456 b3cf69fbc7ae3088bcf67262c0e0f432

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEUEARECAAYFAkteFKsACgkQNxpp46476apn5gCWL3yZRnmPzkO8JhBn4jv8oH7A
IACeJBsK3uQaKC/13piqztzvO/DGiLA=
=1pB5
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Monday, January 25, 2010

[SECURITY] [DSA-1977-1] New python packages fix several vulnerabilities

No comments:

Post a Comment