security advisorysoftware updatedebian
Several vulnerabilities have been discovered in Tunapie, a GUI frontend to video and radio streams. The Common Vulnerabilities and Exposures project identifies the following problems: . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1764-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Moritz Muehlenhoff April 07, 2009 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : tunapie Vulnerability : several Problem type : local(remote) Debian-specific: no CVE Id(s) : CVE-2009-1253 CVE-2009-1254 Several vulnerabilities have been discovered in Tunapie, a GUI frontend to video and radio streams. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1253 Kees Cook discovered that insecure handling of temporary files may lead to local denial of service through symlink attacks. CVE-2009-1254 Mike Coleman discovered that insufficient escaping of stream URLs may lead to the execution of arbitrary commands if a user is tricked into opening a malformed stream URL. For the old stable distribution (etch), these problems have been fixed in version 1.3.1-1+etch2. Due to a technical problem, this update cannot be released synchronously with the stable (lenny) version, but will appear soon. For the stable distribution (lenny), these problems have been fixed in version 2.1.8-2. For the unstable distribution (sid), these problems will be fixed soon. We recommend that you upgrade your tunapie package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 5.0 alias lenny - -------------------------------- Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: Size/MD5 checksum: 986 65d527cb9fc306fa3fb84f9e46533e40 Size/MD5 checksum: 49859 74228ac48e1633749fe3774d225917d9 Size/MD5 checksum: 5878 cb5766c089606fb839b327483a2a27ca Architecture independent packages: Size/MD5 checksum: 46692 d3e0539b43b439f944ca68294937ed9c These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show ' and https://www.debian.org/distrib/packages . Resolution for Tunapie security flaws highlighted in DSA-1764-1, safeguarding system stability by tackling both internal and external risks.. Tunapie, Debian Security, Local DoS Threats, Remote Execution Risks. . Severity: Critical. LinuxSecurity.com Team
Apr 07, 2009
•Critical
Debian
Refine advisories
