Debian: libgd2 arbitrary code execution fix

    Date29 Nov 2004
    CategoryDebian
    7365
    Posted ByLinuxSecurity Advisories
    More potential integer overflows have been found in the GD graphics library which weren't covered by our security advisory DSA 589. They could be exploited by a specially crafted graphic and could lead to the execution of arbitrary code on the victim's machine.
    
    --------------------------------------------------------------------------
    Debian Security Advisory DSA 601-1                     This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                             Martin Schulze
    November 29th, 2004                      http://www.debian.org/security/faq
    --------------------------------------------------------------------------
    
    Package        : libgd1
    Vulnerability  : integer overflow
    Problem-Type   : remote
    Debian-specific: no
    CVE ID         : CAN-2004-0941 CAN-2004-0990
    
    More potential integer overflows have been found in the GD graphics
    library which weren't covered by our security advisory DSA 589.  They
    could be exploited by a specially crafted graphic and could lead to
    the execution of arbitrary code on the victim's machine.
    
    For the stable distribution (woody) these problems have been fixed in
    version 1.8.4-17.woody4.
    
    For the unstable distribution (sid) these problems will be fixed soon.
    
    We recommend that you upgrade your libgd1 packages.
    
    
    Upgrade Instructions
    --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.0 alias woody
    --------------------------------
    
      Source archives:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd_1.8.4-17.woody4.dsc
          Size/MD5 checksum:      707 93634a4d33738a412a0554f49a8b9d40
         http://security.debian.org/pool/updates/main/libg/libgd/libgd_1.8.4-17.woody4.diff.gz
          Size/MD5 checksum:     9965 b3f6bb9f8269f7ac51cff0fc90d6617e
         http://security.debian.org/pool/updates/main/libg/libgd/libgd_1.8.4.orig.tar.gz
          Size/MD5 checksum:   559248 813625508e31f5c205904a305bdc8669
    
      Alpha architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_alpha.deb
          Size/MD5 checksum:   135268 4081dc6cb206bfc5b1cda52848477db6
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_alpha.deb
          Size/MD5 checksum:   133882 f3fc4248b544b666c9da66802955261e
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_alpha.deb
          Size/MD5 checksum:   112150 bbab42fc652e4b735790d0de813676a2
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_alpha.deb
          Size/MD5 checksum:   111514 d20afbe1269e0e7f56d73a259dac326d
    
      ARM architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_arm.deb
          Size/MD5 checksum:   123886 8192e767d6bb9ae979ac5b0031bb9b60
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_arm.deb
          Size/MD5 checksum:   123426 bbc5f441b18551da49239c2d496412dc
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_arm.deb
          Size/MD5 checksum:   104492 a8e41e0cf59296301a07c7175681ea83
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_arm.deb
          Size/MD5 checksum:   103866 657a40da6ae0fb0a98ef39359ecf09f4
    
      Intel IA-32 architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_i386.deb
          Size/MD5 checksum:   121370 9f75236cecdc4300281637b7ff0e6f19
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_i386.deb
          Size/MD5 checksum:   120872 6156511cd4f42f6ac1c0ab7f02e4efd7
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_i386.deb
          Size/MD5 checksum:   104316 3b752d25dc603e1c22cfc8c9d3652d39
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_i386.deb
          Size/MD5 checksum:   103768 ce23f2ec399e3b03afd6187f267c5c44
    
      Intel IA-64 architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_ia64.deb
          Size/MD5 checksum:   146000 add35b37fde3258d0bbace805fb53bbc
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_ia64.deb
          Size/MD5 checksum:   145044 4435f6176f328a78ccefdfe577e7ace9
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_ia64.deb
          Size/MD5 checksum:   126062 09461d4fbd83910d2e2d9bf9bb498a32
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_ia64.deb
          Size/MD5 checksum:   124688 e548cf3792b430145297be8cb0fc1148
    
      HP Precision architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_hppa.deb
          Size/MD5 checksum:   132370 6f44ec992062767c437a1eec29a5811f
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_hppa.deb
          Size/MD5 checksum:   131562 947d10314f9ae5ebb330dedcf9114c96
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_hppa.deb
          Size/MD5 checksum:   111716 8ca65c20c5e68f8d78cd77bb4bd065e7
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_hppa.deb
          Size/MD5 checksum:   111198 11f0ed821eef8eae926a001748a6ec03
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_m68k.deb
          Size/MD5 checksum:   119412 64ad2486eaec36a62126c4c236b12b4a
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_m68k.deb
          Size/MD5 checksum:   118876 058c5e042eab276f9c054d63f0cb276e
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_m68k.deb
          Size/MD5 checksum:   102588 b395ac9ab99000983bf8fd48196d5614
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_m68k.deb
          Size/MD5 checksum:   102144 f08e703ec62969f178cf06955149a606
    
      Big endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_mips.deb
          Size/MD5 checksum:   129264 dc786f699111737bfb6f415e61d66553
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_mips.deb
          Size/MD5 checksum:   128468 610ae2712619c7a7614795198a7f4143
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_mips.deb
          Size/MD5 checksum:   106732 335c3345b9d936f144a151e7ee1cb147
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_mips.deb
          Size/MD5 checksum:   106128 ad4974e0dea304ca0026b44d780965d1
    
      Little endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_mipsel.deb
          Size/MD5 checksum:   129454 8f65e73363314e981b49ead4fe377571
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_mipsel.deb
          Size/MD5 checksum:   128600 b07298698afd4415c545d4dba0f0642d
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_mipsel.deb
          Size/MD5 checksum:   106750 65621045098ed9c1ae14a5ac26d848a3
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_mipsel.deb
          Size/MD5 checksum:   106174 ca5be6fd6631e1af4b5a8413c09152af
    
      PowerPC architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_powerpc.deb
          Size/MD5 checksum:   126704 9dc8d2c7e7ac7612d7060c50a9891ff5
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_powerpc.deb
          Size/MD5 checksum:   125832 6c46a4587c269ad692f3897617a13cca
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_powerpc.deb
          Size/MD5 checksum:   107162 0247901b207dde950db5cf6f64b74f09
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_powerpc.deb
          Size/MD5 checksum:   106626 b8a6de56f1eb995717615ff245e791af
    
      IBM S/390 architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_s390.deb
          Size/MD5 checksum:   122748 20c39c114c631325e077c57fd6211aa5
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_s390.deb
          Size/MD5 checksum:   122184 c9108d0471bb1825159cc5f8a58496d0
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_s390.deb
          Size/MD5 checksum:   106588 82ba4f2b04e549deb0f22834ea5cc452
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_s390.deb
          Size/MD5 checksum:   105890 da80b129742d8b427e52f6ee0afa8594
    
      Sun Sparc architecture:
    
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_sparc.deb
          Size/MD5 checksum:   123594 b230f7aa1beaa534f411e1de18e847e0
         http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_sparc.deb
          Size/MD5 checksum:   123086 a68b2ff47c4801bf409027915ffa085c
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_sparc.deb
          Size/MD5 checksum:   105088 32eb04da2010c77616faacfd7737cc33
         http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_sparc.deb
          Size/MD5 checksum:   104800 7a78072a008f89d561222ea29695f7af
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    ---------------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"7","type":"x","order":"1","pct":58.33,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":25,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"2","type":"x","order":"3","pct":16.67,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.