Debian: cadaver Heap overflow vulnerability
Summary
Stefan Esser discovered a problem in neon, an HTTP and WebDAV client
library, which is also present in cadaver, a command-line client for
WebDAV server. User input is copied into variables not large enough
for all cases. This can lead to an overflow of a static heap
variable.
For the stable distribution (woody) this problem has been fixed in
version 0.18.0-1woody3.
For the unstable distribution (sid) this problem has been fixed in
version 0.22.1-3.
We recommend that you upgrade your cadaver package.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
Size/MD5 checksum: 668 cc085f1e27ca315d3443c7e536c9b349
Size/MD5 checksum: 1674 d60b429cc57107856ffd180f3cb2836f
Size/MD5 checksum: 405643 40fc8cf38c71b2f74692a91ba891845b
Alpha architecture:
Size/MD5 checksum: 102242 3b45e150425b73405453f03c2e45f63b
ARM architecture:
Size/MD5 checksum: 83448 1a8f45defcd34ef51b3cb678e3106d27
Intel IA-32 architecture:
Size/MD5 checksum: 81472 e5476b51ea6efbcff662258effdfd5ee
Intel IA-64 architecture:
Size/MD5 checksum: 125782 7b7dbd87a96e73ef3116c22c406d4bbb
HP Precision architecture:
Size/MD5 checksum: 96250 f37a834f4a1cb9e80d36e50188e1bddf
Motorola 680x0 architecture:
Size/MD5 checksum: 77522 c1c630fba52ac06d9e54a35d31922fb6
Big endian MIPS architecture:
Size/MD5 checksum: 95090 e74a612892d09b1e80fdc2129497bc6a
Little endian MIPS architecture:
Size/MD5 checksum: 94924 51eae2cf3b195cb7f25ec7b685bf18d2
PowerPC architecture:
Size/MD5 checksum: 87566 43894c27a77b6e5e64224aec283f1a39
IBM S/390 architecture:
Size/MD5 checksum: 84718 3787dd1d00c5b415822b3ec9763bbec9
Sun Sparc architecture:
Size/MD5 checksum: 84288 13421f421d7a8f712b7047d6d69de01c
These files will probably be moved into the stable distribution on
its next update.
For apt-get: deb Debian -- Security Information stable/updates main
For dpkg-ftp: dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show