Debian: DSA-1923-1: New libhtml-parser-perl packages fix denial of service

    Date29 Oct 2009
    CategoryDebian
    38
    Posted ByLinuxSecurity Advisories
    A denial of service vulnerability has been found in libhtml-parser-perl, a collection of modules to parse HTML in text documents which is used by several other projects like e.g. SpamAssassin.
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA-1923-1                    This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                                 Nico Golde
    October 27th, 2009                      http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : libhtml-parser-perl
    Vulnerability  : denial of service
    Problem type   : remote
    Debian-specific: no
    Debian bug     : #552531
    CVE ID         : CVE-2009-3627
    
    A denial of service vulnerability has been found in libhtml-parser-perl,
    a collection of modules to parse HTML in text documents which is used by
    several other projects like e.g. SpamAssassin.
    
    Mark Martinec discovered that the decode_entities() function will get stuck
    in an infinite loop when parsing certain HTML entities with invalid UTF-8
    characters.  An attacker can use this to perform denial of service attacks
    by submitting crafted HTML to an application using this functionality.
    
    
    For the oldstable distribution (etch), this problem has been fixed in
    version 3.55-1+etch1.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 3.56-1+lenny1.
    
    For the testing (squeeze) and unstable (sid) distribution, this problem
    will be fixed soon.
    
    
    We recommend that you upgrade your libhtml-parser-perl packages.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Debian (oldstable)
    - ------------------
    
    Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55.orig.tar.gz
        Size/MD5 checksum:    84746 75eb683f1fb7aa7c0ffa46ded4564b54
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.diff.gz
        Size/MD5 checksum:     6136 8c713a84e3df953ae77d83d9f2cff5bc
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.dsc
        Size/MD5 checksum:      882 0f38d699bda26190ea4764aa74eac2c8
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_alpha.deb
        Size/MD5 checksum:   108540 a6d69a440e25b3d3b4e9c5057f6b6908
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_amd64.deb
        Size/MD5 checksum:   108168 ddafcee82387004c4d55a39a8ca54eb6
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_arm.deb
        Size/MD5 checksum:   106962 9842d5bc00c6b308d01fae6d20676e9e
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_hppa.deb
        Size/MD5 checksum:   109602 2d4a2d3ff134cfdd70135e71caf9043a
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_i386.deb
        Size/MD5 checksum:   108032 b542502d5b1d4fff66c2d730e8c02790
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_ia64.deb
        Size/MD5 checksum:   117524 ce065d8d05996cdc4c436104b578ed0a
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mips.deb
        Size/MD5 checksum:   106518 25feabc68e1aa4aff02b6aff00a2a9df
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mipsel.deb
        Size/MD5 checksum:   105742 17a4f0fafa183a3794fad636e4e26ce4
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_powerpc.deb
        Size/MD5 checksum:   106504 beb784e9d723ba717d207c6e9c58414b
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_s390.deb
        Size/MD5 checksum:   106630 1de105f77b55dd920dbfccb7712e3dc1
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_sparc.deb
        Size/MD5 checksum:   106222 bd1cd736644c4f2dceb76cc5192f18d0
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Debian (stable)
    - ---------------
    
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.diff.gz
        Size/MD5 checksum:     6147 18b2407d8b26d6225b82a880b16a0e05
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.dsc
        Size/MD5 checksum:     1316 5a923d6089e2ffddf050ea5b017a7956
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56.orig.tar.gz
        Size/MD5 checksum:    86040 bddc432e5ed9df4d4153a62234f04fc2
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_alpha.deb
        Size/MD5 checksum:   111160 928145a65d633d76bf3db6a42bcf9173
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_amd64.deb
        Size/MD5 checksum:   111614 9152d47982c212aa1ee9ec8d6293c97e
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_arm.deb
        Size/MD5 checksum:   109442 e559abada6a045e2a8d51b1c54a89655
    
    armel architecture (ARM EABI)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_armel.deb
        Size/MD5 checksum:   109388 47e0480a189e752018d27ffb4b19d9e1
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_hppa.deb
        Size/MD5 checksum:   112026 52d258a94e332f7f1c527ae0c47d77d6
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_i386.deb
        Size/MD5 checksum:   109680 da9426f29d77127b954a77263a5b7665
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_ia64.deb
        Size/MD5 checksum:   121744 90933c7e204254b4c308424af76917b2
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_mips.deb
        Size/MD5 checksum:   109378 f46f9971f7d22fe40a1d15cc224cdc70
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_mipsel.deb
        Size/MD5 checksum:   109870 af19cea178841be6c1fc658cac4c468d
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_powerpc.deb
        Size/MD5 checksum:   112450 1a2d490c6120185ec0cbddc2bb73e792
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_s390.deb
        Size/MD5 checksum:   110958 2f21853d729b141554b39132ecf21f5c
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_sparc.deb
        Size/MD5 checksum:   108682 a1831a4919f5c7b30eab0def292928b5
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.