Debian: New wordnet packages fix arbitrary code execution

    Date01 Sep 2008
    CategoryDebian
    3576
    Posted ByLinuxSecurity Advisories
    Rob Holland discovered several programming errors in WordNet, an electronic lexical database of the English language. These flaws could allow arbitrary code execution when used with untrusted input, for example when WordNet is in use as a back end for a web application.
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1634-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                          Thijs Kinkhorst
    September 01, 2008                    http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : wordnet
    Vulnerability  : stack and heap overflows
    Problem type   : local (remote)
    Debian-specific: no
    CVE id(s)      : CVE-2008-2149
    Debian Bug     : 481186
    
    Rob Holland discovered several programming errors in WordNet, an
    electronic lexical database of the English language. These flaws could
    allow arbitrary code execution when used with untrusted input, for
    example when WordNet is in use as a back end for a web application.
    
    For the stable distribution (etch), these problems have been fixed in
    version 1:2.1-4+etch1.
    
    For the testing distribution (lenny), these problems have been fixed in
    version 1:3.0-11+lenny1.
    
    For the unstable distribution (sid), these problems will be fixed soon.
    
    We recommend that you upgrade your wordnet package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1.dsc
        Size/MD5 checksum:      772 24980d288101a1c11e60e38fe5ea945a
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1.diff.gz
        Size/MD5 checksum:    22912 bb970bd2ccd457c6310ba0c75e5ed2be
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1.orig.tar.gz
        Size/MD5 checksum:  6379385 95a6e8144254a92a5ea0e97771ef9d07
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-sense-index_2.1-4+etch1_all.deb
        Size/MD5 checksum:  2242538 dc75e162b0013a5d7d0c0679115b134c
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-base_2.1-4+etch1_all.deb
        Size/MD5 checksum:  8701430 a680094a45ddf87dd0bcbb5fd63ceae2
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_alpha.deb
        Size/MD5 checksum:    80734 3186aeb6b9365a333fdd608d5fa62ffe
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_alpha.deb
        Size/MD5 checksum:   109466 cc441b73b2ded97fff9fc5c668f2fbb0
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_amd64.deb
        Size/MD5 checksum:   104990 b7b3225b10df973e2d8a652f770a6e1b
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_amd64.deb
        Size/MD5 checksum:    65118 bc75f17d4f5b1375fc3862ba80335d2f
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_arm.deb
        Size/MD5 checksum:    61020 57e49d1f532015f07cbf3f71bba24237
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_arm.deb
        Size/MD5 checksum:   100056 43a1c7d6c272412f4f1eff5ff284fd54
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_hppa.deb
        Size/MD5 checksum:   108312 f6ed8345d69a1e13e9cd87f7974566fd
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_hppa.deb
        Size/MD5 checksum:    69896 a1649115a5bba73602f4c6dba8a57964
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_i386.deb
        Size/MD5 checksum:    63096 ff93d37e8edeb63fd9268b19b052f3e2
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_i386.deb
        Size/MD5 checksum:   101738 65a6a41a5bf4de85c6ce474de7155c73
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_ia64.deb
        Size/MD5 checksum:    83014 98d7592aac60e394cca7262dbae45dc5
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_ia64.deb
        Size/MD5 checksum:   119716 a4a53c0fe7acf1828386d2e08e443b7a
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_mips.deb
        Size/MD5 checksum:   105498 f76685b8631f82c01b0fc604d22cb7b3
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_mips.deb
        Size/MD5 checksum:    73082 73a315a1e3706cc313559c7f8532232f
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_mipsel.deb
        Size/MD5 checksum:   104700 22d5b12949930d49d4d49ac63f106747
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_mipsel.deb
        Size/MD5 checksum:    71604 78f164f9758891934cb3854c8a10c6e7
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_powerpc.deb
        Size/MD5 checksum:   108852 0b0448af12ac1052b11833252a269765
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_powerpc.deb
        Size/MD5 checksum:    69846 44d14734b11f31fb1f3522d68fae68ad
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_s390.deb
        Size/MD5 checksum:   107032 a83524f4bc09a6f78a53216356043175
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_s390.deb
        Size/MD5 checksum:    65640 241a7fa7673077cfc762492a44c7764d
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet_2.1-4+etch1_sparc.deb
        Size/MD5 checksum:   102918 1f7f85106a3f41cfc2162db49ce0ac1f
      http://security.debian.org/pool/updates/main/w/wordnet/wordnet-dev_2.1-4+etch1_sparc.deb
        Size/MD5 checksum:    64812 89d27a34508044af76f2eeac4e1c696a
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"4","type":"x","order":"1","pct":57.14,"resources":[]},{"id":"88","title":"Should be more technical","votes":"2","type":"x","order":"2","pct":28.57,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":14.29,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.