[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[debian-users:50835] [Translate] [SECURITY] [DSA 1625-1] New cupsys packages fix arbitrary code execution

From: Seiji Kaneko <skaneko@xxxxxxxxxxxx>
Subject: [debian-users:50835] [Translate] [SECURITY] [DSA 1625-1] New cupsys packages fix arbitrary code execution
Date: Fri, 1 Aug 2008 23:01:15 +0900
List-help: <mailto:debian-users-ctl@debian.or.jp?body=help>
List-id: debian-users.debian.or.jp
List-owner: <mailto:debian-users-admin@debian.or.jp>
List-post: <mailto:debian-users@debian.or.jp>
List-software: fml [fml 4.0.3 release (20011202/4.0.3)]
List-unsubscribe: <mailto:debian-users-ctl@debian.or.jp?body=unsubscribe>
X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
X-ml-name: debian-users
X-mlserver: fml [fml 4.0.3 release (20011202/4.0.3)]; post only (only members can post)
X-spam-checker-version: SpamAssassin 3.1.7-deb (2006-10-05) on osdn.debian.or.jp
X-spam-level:
X-spam-status: No, score=-2.3 required=10.0 tests=AWL,KI autolearn=disabled version=3.1.7-deb
Message-id: <48931724.70209@xxxxxxxxxxxx>
X-mail-count: 50835
User-agent: Thunderbird 2.0.0.16 (Macintosh/20080707)
かねこです。
URL 等は Debian-security-announce メーリングリストの元記事を確認
ください。

------>8------------>8------------>8------------>8------------>8-
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1625-1                  security@debian.org
http://www.debian.org/security/                          Thijs Kinkhorst
August 01, 2008                       http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : cupsys
Vulnerability  : バッファオーバフロー
Problem type   : リモート
Debian-specific: いいえ
CVE Id(s)      : CVE-2008-0053 CVE-2008-1373 CVE-2008-1722
Debian Bug     : 476305

Common Unix Printing System (CUPS)に、リモートから攻撃可能な複数の問題が
発見されました。The Common Vulnerabilities and Exposures project は以下の
問題を認識しています。

CVE-2008-0053

    HP-GL 形式の入力フィルタにバッファオーバフローがあり、細工された
    HP-GL ファイルにより任意のコードが実行できる可能性があります。

CVE-2008-1373

    GIF 形式の入力フィルタにバッファオーバフローがあり、細工された GIF フ
    ァイルにより任意のコードが実行できる可能性があります。

CVE-2008-1722

    PNG 形式の入力フィルタにバッファオーバフローがあり、細工された PNG フ
    ァイルにより任意のコードが実行できる可能性があります。

安定版 (stable) ディストリビューション (etch) では、これらの問題はバージ
ョン 1.2.7-4etch4 の cupsys パッケージで修正されています。

テスト版 (testing) および不安定版 (unstable) ディストリビューション
 (lenny および sid) では、これらの問題は cups のバージョン 1.3.7-2 で修正
 されています。

直ぐに cupsys パッケージをアップグレードすることを勧めます。


アップグレード手順
------------------

wget url
        	でファイルを取得できます。
dpkg -i file.deb
                で参照されたファイルをインストールできます。

apt-get パッケージマネージャを用いている場合には、本メールのフッタ記載の
行を sources.list に加えて、

apt-get update
        を実行して内部データベースを更新し、
apt-get upgrade
        によって修正されたパッケージをインストールしてください。

本メールのフッタ記載の設定を自ホストの設定に加えることにより、自動更新を
行うこともできます。


Debian GNU/Linux 4.0 alias etch
- -------------------------------

ソースアーカイブ:

  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7.orig.tar.gz
    Size/MD5 checksum:  4214272 c9ba33356e5bb93efbcf77b6e142e498
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4.diff.gz
    Size/MD5 checksum:   107641 b1ae0953050580975ef0c6ff495e912d
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4.dsc
    Size/MD5 checksum:     1376 4f8938f4dac4a9732efd621f4aabb63a

アーキテクチャに依存しないパッケージ:


http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-gnutls10_1.2.7-4etch4_all.deb
    Size/MD5 checksum:    45758 fbb5c3eaf74a1207d887e12bb75f6182

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-common_1.2.7-4etch4_all.deb
    Size/MD5 checksum:   924012 43e775475535e31f2f6963947c03525d

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_amd64.deb
    Size/MD5 checksum:  1087542 cb6a29323e4cd1069b669c89963a1fac

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_amd64.deb
    Size/MD5 checksum:    53024 090d638da135798424a129257b51b157

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_amd64.deb
    Size/MD5 checksum:   142544 0d446b8acb588ec2b1c8c22067aa2364
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_amd64.deb
    Size/MD5 checksum:  1574904 cdd7afb0953a56cf8d213778cbe1773e

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_amd64.deb
    Size/MD5 checksum:    80706 687de2f8bf779ca898863fb94a07a12b

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_amd64.deb
    Size/MD5 checksum:    85968 8d69f2ac63f2d4fbd923c2caa33c604d
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_amd64.deb
    Size/MD5 checksum:    36352 02c24a715c2f06dd8bc62a851591948e
  http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_amd64.deb
    Size/MD5 checksum:   162230 0e2325c67bf23841038be68557ba8758

arm architecture (ARM)


http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_arm.deb
    Size/MD5 checksum:    48718 28a8ac4acad82bd582358e38c0c23013

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_arm.deb
    Size/MD5 checksum:    78910 6566d320a557b02cf94f379b84f0dba9
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_arm.deb
    Size/MD5 checksum:    35936 6ae06d35d6c40084adfd8bfd65866174
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_arm.deb
    Size/MD5 checksum:  1025732 5c3e851e94f3a41216d7a7149839c8d4

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_arm.deb
    Size/MD5 checksum:   132040 3eb0b900c59ea118d768b1459898ea90
  http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_arm.deb
    Size/MD5 checksum:   154878 02d749b77969111a813a4cba408bd74d
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_arm.deb
    Size/MD5 checksum:  1568968 5c60803b01b551503017f750bea5526e

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_arm.deb
    Size/MD5 checksum:    85168 5b2a0162f00efdcc8cd1d93e0bc7486b

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_hppa.deb
    Size/MD5 checksum:   172120 3b9de8875c9be02866143463b0c919f0

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_hppa.deb
    Size/MD5 checksum:    91152 ab272c582600f995706b46709c510f32
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_hppa.deb
    Size/MD5 checksum:  1022644 b587ee12458f80bd76a1d7b84869b741

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_hppa.deb
    Size/MD5 checksum:    57192 4e117dab53e958404f958b99b08da4c1

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_hppa.deb
    Size/MD5 checksum:   154086 2a27882b763ce10df0fd172cfa8d22bb

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_hppa.deb
    Size/MD5 checksum:    86898 aebbadb4ddb70dde9a524fd56b7bfb46
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_hppa.deb
    Size/MD5 checksum:  1624440 67216c81ae5f4d2f1d8b571f7099492e
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_hppa.deb
    Size/MD5 checksum:    39270 1bbd6351cb6cd5f686faaddbeb731c4f

i386 architecture (Intel ia32)


http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_i386.deb
    Size/MD5 checksum:    86844 5dd05c3c3f08b1e2a60405bcaef83146

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_i386.deb
    Size/MD5 checksum:    79334 2002dc686f12bb5250d9fafb9b63a268

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_i386.deb
    Size/MD5 checksum:    53272 1723eb6d5f00ce02702b52b60610c586
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_i386.deb
    Size/MD5 checksum:    36230 cda0348c0c9b6dbd145e3c02e0c44fd2
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_i386.deb
    Size/MD5 checksum:  1004104 10a43e1b53f782d065362e92ff0998f9

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_i386.deb
    Size/MD5 checksum:   137972 203602cf657f98ee38a372c3922b7ae1
  http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_i386.deb
    Size/MD5 checksum:   160382 2fa7444168c9f43a22eb776bd9638827
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_i386.deb
    Size/MD5 checksum:  1559230 dfca65e3edd6f0fb4bdc18973efef89a

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_ia64.deb
    Size/MD5 checksum:   203930 b457e7ae7fb11f876225150e559a4272
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_ia64.deb
    Size/MD5 checksum:    46330 922f2bd1d98fcbb40badcebd7c0cc07c

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_ia64.deb
    Size/MD5 checksum:   106642 b61d48e93e413245d3fd5ebe47c31243
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_ia64.deb
    Size/MD5 checksum:  1107892 65945b9397a13a31fb8646cb71ef7794

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_ia64.deb
    Size/MD5 checksum:   192372 eea62b30397305acdf6f98a6df50cf8e
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_ia64.deb
    Size/MD5 checksum:  1770682 398872427b493f8206c38a3504fc1904

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_ia64.deb
    Size/MD5 checksum:    74158 e1f00e7e8be7549ac2b58adaeba0f5b2

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_ia64.deb
    Size/MD5 checksum:   106226 fb838547edf473df7efaa8fe41cf42f1

mips architecture (MIPS (Big Endian))


http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_mips.deb
    Size/MD5 checksum:    86546 02bd3a3bb274f21179f65edfb28c1f7e

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_mips.deb
    Size/MD5 checksum:    76158 53a90a54e6cf7418b81e0b40db39566b
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_mips.deb
    Size/MD5 checksum:    36116 8d78c13d605160ee0caa835961667913

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_mips.deb
    Size/MD5 checksum:   150982 b48a8bcf9dbff3e842f83f4ca05e0421
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_mips.deb
    Size/MD5 checksum:  1097820 db2ff50e5555b022b54252f07b442992
  http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_mips.deb
    Size/MD5 checksum:   157742 94a7c2d49b7234c0a54291446c5ba06d
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_mips.deb
    Size/MD5 checksum:  1567460 dffd05c006a78e53bc8c03dc8beaa4ea

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_mips.deb
    Size/MD5 checksum:    57688 cbce6e984252bef94c0bd7ace9afdcdf

mipsel architecture (MIPS (Little Endian))


http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_mipsel.deb
    Size/MD5 checksum:    86688 7c91af84b2fab2419fa4939bb8080097
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_mipsel.deb
    Size/MD5 checksum:  1552918 7d7af09023892fdd9e862ddcbb590fb3

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_mipsel.deb
    Size/MD5 checksum:   150896 ba6b2f7c16957759b63e20d66d5964f2

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_mipsel.deb
    Size/MD5 checksum:    36064 702ec7fbc7b2716e10a97f7b7c11e75a

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_mipsel.deb
    Size/MD5 checksum:   158270 0354f63d7126c3775cc74a95426052d4

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_mipsel.deb
    Size/MD5 checksum:    57846 2ee768d4dc5f9c8cbd046a801f154ef8

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_mipsel.deb
    Size/MD5 checksum:  1084676 bb31572c9939fe22762ceef59550b25e

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_mipsel.deb
    Size/MD5 checksum:    77456 5884939dabb325cda97351bafdb62cfe

powerpc architecture (PowerPC)


http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_powerpc.deb
    Size/MD5 checksum:   162918 05df3db670b3f2a4dbb9d8a2d666eaca

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_powerpc.deb
    Size/MD5 checksum:    88204 4546a01b202669d3ffa97dca5b93bf03
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_powerpc.deb
    Size/MD5 checksum:  1576028 67c38bd81585274c0844efeedca40153

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_powerpc.deb
    Size/MD5 checksum:    51894 321b1c0c9d59643294a87b00f81f7895

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_powerpc.deb
    Size/MD5 checksum:    41310 45f55f0797900433a145028d63f6a6ef

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_powerpc.deb
    Size/MD5 checksum:    90004 61698739b3b436e6d1651dc388a89575

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_powerpc.deb
    Size/MD5 checksum:  1142660 10680b3b7efdeb10e9d834e869944206

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_powerpc.deb
    Size/MD5 checksum:   136880 e5c2d81190a9233eb291b519c3b83de6

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_s390.deb
    Size/MD5 checksum:   166424 a2a07e7c586a10000b519c6f6c2ec4e2
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_s390.deb
    Size/MD5 checksum:  1586828 1e581be3892b978e7284de896c3121de

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_s390.deb
    Size/MD5 checksum:    87588 b3d0d3e7dbb84414f606b4670c6e2692
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_s390.deb
    Size/MD5 checksum:  1036620 bd1b35bd24260dfb340e0a3173a811a2
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_s390.deb
    Size/MD5 checksum:    37430 622787f6d8b910f3657f98e0f5bf97bc

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_s390.deb
    Size/MD5 checksum:    82342 40a55f0afa5b2fa03285fd4d4cd8666c

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_s390.deb
    Size/MD5 checksum:    52468 470a81c78c7ececae0569e75bfab9ca7

http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_s390.deb
    Size/MD5 checksum:   144932 9ab43b87566469af9e4a79c9c1fae493

sparc architecture (Sun SPARC/UltraSPARC)


http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2-dev_1.2.7-4etch4_sparc.deb
    Size/MD5 checksum:   139570 5f5faa6504275ed43f4a55787519fdfe

http://security.debian.org/pool/updates/main/c/cupsys/cupsys-client_1.2.7-4etch4_sparc.deb
    Size/MD5 checksum:    78516 7066d103f739cd570fd141aa4fa780f6
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-bsd_1.2.7-4etch4_sparc.deb
    Size/MD5 checksum:    36032 c4e4289091dc19e5fbf7a6937ffb36f7
  http://security.debian.org/pool/updates/main/c/cupsys/libcupsys2_1.2.7-4etch4_sparc.deb
    Size/MD5 checksum:   158816 f33bda24ec7774227b3bdb3dddcf1c46

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2-dev_1.2.7-4etch4_sparc.deb
    Size/MD5 checksum:    51754 47ce5271662e6b980e34badfc9689009

http://security.debian.org/pool/updates/main/c/cupsys/libcupsimage2_1.2.7-4etch4_sparc.deb
    Size/MD5 checksum:    84956 96aa28ac50548723754274f30db15379
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys-dbg_1.2.7-4etch4_sparc.deb
    Size/MD5 checksum:   991408 13a41c49f94085ca6a7f74a030506d3c
  http://security.debian.org/pool/updates/main/c/cupsys/cupsys_1.2.7-4etch4_sparc.deb
    Size/MD5 checksum:  1562092 2bfd90bca7dbac40df73303f8e1e4b6f


  これらのファイルは次の版の安定版リリース時そちらに移されます。


- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
------>8------------>8------------>8------------>8------------>8-
-- 
Seiji Kaneko                         skaneko@xxxxxxxxxxxx
---------------------------------------------------------
Prev by Date: [debian-users:50834] [Translate] [SECURITY] [DSA 1626-1] New httrack packages fix arbitrary code execution
Next by Date: [debian-users:50836] [Translate] [SECURITY] [DSA 1627-1] New opensc packages fix smart card vulnerability
Previous by thread: [debian-users:50834] [Translate] [SECURITY] [DSA 1626-1] New httrack packages fix arbitrary code execution
Next by thread: [debian-users:50836] [Translate] [SECURITY] [DSA 1627-1] New opensc packages fix smart card vulnerability
Index(es):
- Date
- Thread