Debian: UPDATE: html2ps arbitrary code execution

    Date06 Dec 2002
    Posted ByLinuxSecurity Advisories
    The security update from DSA 192-1 contained a syntax error which is now fixed.
    Debian Security Advisory DSA 192-2                     This email address is being protected from spambots. You need JavaScript enabled to view it.%MINIFYHTML88ee381d6c7f2a955fa78d4f6ad659c413%                             Martin Schulze
    December 6th, 2002 ://
    Package        : html2ps
    Vulnerability  : arbitrary code execution
    Problem-Type   : local
    Debian-specific: no
    The security update from DSA 192-1 contained a syntax error which is
    now fixed.  For completeness we include the text of the old advisory:
       The SuSE Security Team found a vulnerability in html2ps, a HTML to
       PostScript converter, that opened files based on unsanitized input
       insecurely.  This problem can be exploited when html2ps is
       installed as filter within lrpng and the attacker has previously
       gained access to the lp account.
    This problem has been fixed in version 1.0b3-1.2 for the current
    stable distribution (woody), in version 1.0b1-8.2 for the old stable
    distribution (potato) and in version 1.0b3-3 for the unstable
    distribution (sid).
    We recommend that you upgrade your html2ps package.
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    Debian GNU/Linux 2.2 alias potato
      Source archives:
          Size/MD5 checksum:      532 a95c08f237b3ae51f0f16e86b16b8d4b
          Size/MD5 checksum:    35618 63878fa43db620e918b4bc27a217f79f
          Size/MD5 checksum:   107435 00fb5ac8c3769473b53ec4ad20e9b7cb
      Architecture independent components:
          Size/MD5 checksum:   134772 f5df85ec5e0a8113ae5f9bc31a324142
    Debian GNU/Linux 3.0 alias woody
      Source archives:
          Size/MD5 checksum:      532 d340b5eba901049f512ff77fac127b3e
          Size/MD5 checksum:    38215 1876826cf5be35f56f1c4c417b45fc48
          Size/MD5 checksum:   121826 984eff60249bcf2d6ce871e32acefb9a
      Architecture independent components:
          Size/MD5 checksum:   146438 ee707e980052c595a6a778f65ceafa57
      These files will probably be moved into the stable distribution on
      its next revision.
    For apt-get: deb stable/updates main
    For dpkg-ftp: dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.%MINIFYHTML88ee381d6c7f2a955fa78d4f6ad659c414%
    Package info: `apt-cache show ' and
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the LinuxSecurity Privacy news articles?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    [{"id":"90","title":"Love them!","votes":"35","type":"x","order":"1","pct":92.11,"resources":[]},{"id":"91","title":"I'm indifferent","votes":"2","type":"x","order":"2","pct":5.26,"resources":[]},{"id":"92","title":"Not interested in this topic","votes":"1","type":"x","order":"3","pct":2.63,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.