The OVAL Repository 5.4 2015-09-03T06:24:34.737-04:00 Debian 5.0 Debian 4.0 fetchmail It was discovered that fetchmail, a full-featured remote mail retrieval and forwarding utility, is vulnerable to the "Null Prefix Attacks Against SSL/TLS Certificates" recently published at the Blackhat conference. This allows an attacker to perform undetected man-in-the-middle attacks via a crafted ITU-T X.509 certificate with an injected null byte in the subjectAltName or Common Name fields. Note, as a fetchmail user you should always use strict certificate validation through either these option combinations: sslcertck ssl sslproto ssl3 or sslcertck sslproto tls1 For the oldstable distribution , this problem has been fixed in version 6.3.6-1etch2. For the stable distribution , this problem has been fixed in version 6.3.9~rc2-4+lenny1. For the testing distribution , this problem will be fixed soon. For the unstable distribution , this problem has been fixed in version 6.3.9~rc2-6. We recommend that you upgrade your fetchmail packages. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 Debian 4.0 libmodplug Several vulnerabilities have been discovered in libmodplug, the shared libraries for mod music based on ModPlug. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1438 It was discovered that libmodplug is prone to an integer overflow when processing a MED file with a crafted song comment or song name. CVE-2009-1513 It was discovered that libmodplug is prone to a buffer overflow in the PATinst function, when processing a long instrument name. For the stable distribution , these problems have been fixed in version 1:0.8.4-1+lenny1. For the oldstable distribution , these problems have been fixed in version 1:0.7-5.2+etch1. For the testing distribution and the unstable distribution , this problem has been fixed in version 1:0.8.7-1. We recommend that you upgrade your libmodplug packages. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 python-cjson Matt Giuca discovered a buffer overflow in python-cjson, a fast JSON encoder/decoder for Python. This allows a remote attacker to cause a denial of service through a specially-crafted Python script. For the stable distribution , this problem has been fixed in version 1.0.5-1+lenny1 For the testing and the unstable distribution, this problem has been fixed in version 1.0.5-3 We recommend that you upgrade your python-cjson package. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 Debian 4.0 qemu Several vulnerabilities have been discovered in the QEMU processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-0928 Ian Jackson discovered that range checks of file operations on emulated disk devices were insufficiently enforced. CVE-2008-1945 It was discovered that an error in the format auto detection of removable media could lead to the disclosure of files in the host system. CVE-2008-4539 A buffer overflow has been found in the emulation of the Cirrus graphics adaptor. For the old stable distribution , these problems have been fixed in version 0.8.2-4etch3. For the stable distribution , these problems have been fixed in version 0.9.1-10lenny1. For the unstable distribution , these problems have been fixed in version 0.9.1+svn20081101-1. We recommend that you upgrade your qemu packages. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 Debian 4.0 camlimages Tielei Wang discovered that CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. For the old stable distribution , this problem has been fixed in version 2.20-8+etch1. For the stable distribution , this problem has been fixed in version 2.2.0-4+lenny1. For the unstable distribution , this problem has been fixed in version 3.0.1-2. We recommend that you upgrade your camlimages package. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 Debian 4.0 openexr Several vulnerabilities have been discovered in the OpenEXR image library, which can lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1720 Drew Yao discovered integer overflows in the preview and compression code. CVE-2009-1721 Drew Yao discovered that an uninitialised pointer could be freed in the decompression code. CVE-2009-1722 A buffer overflow was discovered in the compression code. For the old stable distribution , these problems have been fixed in version 1.2.2-4.3+etch2. For the stable distribution , these problems have been fixed in version 1.6.1-3+lenny3. For the unstable distribution , these problems will be fixed soon. We recommend that you upgrade your openexr packages. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 dvipng Dan Rosenberg discovered that in dvipng, a utility that converts DVI files to PNG graphics, several array index errors allow context-dependent attackers, via a specially crafted DVI file, to cause a denial of service , and possibly arbitrary code execution. For the stable distribution , this problem has been fixed in version dvipng_1.11-1+lenny1. For the testing distribution , this problem has been fixed in version 1.13-1. For the unstable distribution , this problem has been fixed in version 1.13-1. We recommend that you upgrade your dvipng package. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 Debian 4.0 camlimages Tielei Wang discovered that CamlImages, an open source image processing library, suffers from several integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. This advisory addresses issues with the reading of JPEG and GIF Images, while DSA 1832-1 addressed the issue with PNG images. For the oldstable distribution , this problem has been fixed in version 2.20-8+etch2. For the stable distribution , this problem has been fixed in version 1:2.2.0-4+lenny2. For the unstable distribution , this problem has been fixed in version 1:3.0.1-3. We recommend that you upgrade your camlimages package. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 Debian 4.0 request-tracker3.4/request-tracker3.6 Mikal Gule discovered that request-tracker, an extensible trouble-ticket tracking system, is prone to an attack, where an attacker with access to the same domain can hijack a user"s RT session. For the stable distribution , this problem has been fixed in version 3.6.7-5+lenny3. For the oldstable distribution , this problem has been fixed in version 3.6.1-4+etch1 of request-tracker3.6 and version 3.4.5-2+etch1 of request-tracker3.4. For the testing distribution , this problem will be fixed soon. For the unstable distribution , this problem has been fixed in version 3.6.9-2. We recommend that you upgrade your request-tracker packages. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 4.0 Debian GNU/Linux 4.0 (etch) is installed SecPod Team DRAFT INTERIM ACCEPTED Preeti Subramanian INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Debian 5.0 typo3-src Several remote vulnerabilities have been discovered in TYPO3. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-3714 Multiple remote file disclosure vulnerabilities in the jumpUrl mechanism and the Extension Manager allowed attackers to read files with the privileges of the account under which the web server was running. CVE-2010-3715 The TYPO3 backend contained several cross-site scripting vulnerabilities, and the RemoveXSS function did not filter all Javascript code. CVE-2010-3716 Malicious editors with user creation permission could escalate their privileges by creating new users in arbitrary groups, due to lack of input validation in the taskcenter. CVE-2010-3717 TYPO3 exposed a crasher bug in the PHP filter_var function, enabling attackers to cause the web server process to crash and thus consume additional system resources. For the stable distribution , these problems have been fixed in version 4.2.5-1+lenny6. For the unstable distribution and the upcoming stable distribution , these problems have been fixed in version 4.3.7-1. We recommend that you upgrade your TYPO3 packages. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 openjdk-6 It was discovered that the floating point parser in OpenJDK, an implementation of the Java platform, can enter an infinite loop when processing certain input strings. Such input strings represent valid numbers and can be contained in data supplied by an attacker over the network, leading to a denial-of-service attack. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian 5.0 wget It was discovered that wget, a command line tool for downloading files from the WWW, uses server-provided file names when creating local files. This may lead to code execution in some scenarios. After this update, wget will ignore server-provided file names. You can restore the old behavior in cases where it is not desirable by invoking wget with the new --use-server-file-name option. For the stable distribution , this problem has been fixed in version 1.11.4-2+lenny2. For the unstable distribution , this problem will be fixed soon. We recommend that you upgrade your wget package. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 5.0 Debian GNU/Linux 5.0 (lenny) is installed SecPod Team DRAFT INTERIM ACCEPTED Preeti Subramanian INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED