Debian: New libextractor packages fix arbitrary code execution

    Date27 Jan 2006
    CategoryDebian
    4067
    Posted ByJoe Shakespeare
    "infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, which is also present in libextractor, a library to extract arbitrary meta-data from files, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code.
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 936-1                     This email address is being protected from spambots. You need JavaScript enabled to view it.
    	
    http://www.debian.org/security/                             Martin Schulze
    January 11th, 2006                      http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : libextractor
    Vulnerability  : buffer overflows
    Problem type   : remote
    Debian-specific: no
    CVE IDs        : CVE-2005-3191 CVE-2005-3192 CVE-2005-3193 CVE-2005-2097
                     CVE-2005-3624 CVE-2005-3625 CVE-2005-3626 CVE-2005-3627
                     CVE-2005-3628
    
    "infamous41md" and Chris Evans discovered several heap based buffer
    overflows in xpdf, the Portable Document Format (PDF) suite, which is
    also present in libextractor, a library to extract arbitrary meta-data
    from files, and which can lead to a denial of service by crashing the
    application or possibly to the execution of arbitrary code.
    
    The old stable distribution (woody) does not contain libextractor
    packages.
    
    For the stable distribution (sarge) these problems have been fixed in
    version 0.4.2-2sarge2.
    
    For the unstable distribution (sid) these problems have been fixed in
    version 0.5.8-1.
    
    We recommend that you upgrade your libextractor packages.
    
    
    Upgrade Instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.1 alias sarge
    - --------------------------------
    
      Source archives:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor_0.4.2-2sarge2.dsc
          Size/MD5 checksum:      778 6906857074772199e2a8a892feb3aae2
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor_0.4.2-2sarge2.diff.gz
          Size/MD5 checksum:     6345 c214699bde0bfad501cede35488b4f09
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor_0.4.2.orig.tar.gz
          Size/MD5 checksum:  5887095 d99e1b13a017d39700e376a0edbf7ba2
    
      Alpha architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_alpha.deb
          Size/MD5 checksum:    19424 59bb8cddd5c80fb1cba57796b9445dab
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_alpha.deb
          Size/MD5 checksum:  5804676 9942575a95cb97dfcae26b156dca7a58
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_alpha.deb
          Size/MD5 checksum:    19204 fed48ebb930e6a7d3484bd75c8263a81
    
      AMD64 architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_amd64.deb
          Size/MD5 checksum:    18098 7d4a40679062c4d2d70f9c08dc785559
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_amd64.deb
          Size/MD5 checksum:  5641300 ff1bac0e15d1a6ff630a6ced168e284f
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_amd64.deb
          Size/MD5 checksum:    17364 54dd55236286550d6cadc8dbb3df9ccd
    
      ARM architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_arm.deb
          Size/MD5 checksum:    17480 aa541fc867f51588b676aa23d34e25a8
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_arm.deb
          Size/MD5 checksum:  5710616 ed153d5e88e899f4e27ae5a67c5e45d0
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_arm.deb
          Size/MD5 checksum:    16784 7a7f73139e8c0c62187179e993734932
    
      Intel IA-32 architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_i386.deb
          Size/MD5 checksum:    17624 5419b495e3df96a658e1323c83f7faf9
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_i386.deb
          Size/MD5 checksum:  5713300 1bc2a3ab8b321b543a1ae92590e76f8b
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_i386.deb
          Size/MD5 checksum:    16546 71e4044ff8d923cd56d4bb046be1b37f
    
      Intel IA-64 architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_ia64.deb
          Size/MD5 checksum:    20404 cdea8cf2f6cd2b8a761ccca2a2d85421
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_ia64.deb
          Size/MD5 checksum:  5905266 98f5de1716817b660791a92d5ee7c6a6
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_ia64.deb
          Size/MD5 checksum:    19140 d780e22f3cd6c6204de3db711f068dcd
    
      HP Precision architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_hppa.deb
          Size/MD5 checksum:    18560 70ae8b43a0cd581a36a8097fc94c2172
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_hppa.deb
          Size/MD5 checksum:  5687318 a241f7e800ac5cbd7f45fdafeae267ac
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_hppa.deb
          Size/MD5 checksum:    17710 c1848801758081872515d88f86938537
    
      Motorola 680x0 architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_m68k.deb
          Size/MD5 checksum:    17184 d64fcc89500919e03805e47dbb9eca52
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_m68k.deb
          Size/MD5 checksum:  5708190 0d20df48cd437a99544bf748a1c89ea9
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_m68k.deb
          Size/MD5 checksum:    16404 0e47447d4b7007d4016c32a81f2b66f4
    
      Big endian MIPS architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_mips.deb
          Size/MD5 checksum:    18416 38f460cbf16a6c2a3c735c5a6545013a
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_mips.deb
          Size/MD5 checksum:  5729074 76787645b83e4438fc79325410114c99
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_mips.deb
          Size/MD5 checksum:    17700 8cbf4e1556b59d982589d27e5af1211e
    
      Little endian MIPS architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_mipsel.deb
          Size/MD5 checksum:    18460 dfaad60fd479b74c72c46680d92c5920
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_mipsel.deb
          Size/MD5 checksum:  5726846 0d9ad0d53eddd3503cdc2fce6b118595
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_mipsel.deb
          Size/MD5 checksum:    17734 a74a4df56930cd6e1ec289a714fe2225
    
      PowerPC architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_powerpc.deb
          Size/MD5 checksum:    19600 0fbb4093db271d5924d8e1fb81d0c5c3
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_powerpc.deb
          Size/MD5 checksum:  5677812 543192c6a5b6b89fdc0cc0c5b3f2befe
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_powerpc.deb
          Size/MD5 checksum:    17556 bd868a198744609509201e7af0e33ab9
    
      IBM S/390 architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_s390.deb
          Size/MD5 checksum:    17974 f16109dd971b139abc8a2194731e33c8
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_s390.deb
          Size/MD5 checksum:  5768028 dfda84e8d1a0e53794418a77a09d801f
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_s390.deb
          Size/MD5 checksum:    17918 da3bb3df7f86443b1f36ed4b5bcc0113
    
      Sun Sparc architecture:
    
        http://security.debian.org/pool/updates/main/libe/libextractor/extract_0.4.2-2sarge2_sparc.deb
          Size/MD5 checksum:    17480 1ef23c92384723ab64b315b7d8d51089
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1_0.4.2-2sarge2_sparc.deb
          Size/MD5 checksum:  5752164 91a3ad11d2f029e99955b2c54088e034
        http://security.debian.org/pool/updates/main/libe/libextractor/libextractor1-dev_0.4.2-2sarge2_sparc.deb
          Size/MD5 checksum:    16696 87e4150b6738d9921728a1e594bc4904
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"37","type":"x","order":"1","pct":51.39,"resources":[]},{"id":"88","title":"Should be more technical","votes":"10","type":"x","order":"2","pct":13.89,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"25","type":"x","order":"3","pct":34.72,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.