-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3772-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso January 26, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libxpm CVE ID : CVE-2016-10164 Tobias Stoeckmann discovered that the libXpm library contained two integer overflow flaws, leading to a heap out-of-bounds write, while parsing XPM extensions in a file. An attacker can provide a specially crafted XPM file that, when processed by an application using the libXpm library, would cause a denial-of-service against the application, or potentially, the execution of arbitrary code with the privileges of the user running the application. For the stable distribution (jessie), this problem has been fixed in version 1:3.5.12-0+deb8u1. This update is based on a new upstream version of libxpm including additional bug fixes. For the testing distribution (stretch) and the unstable distribution (sid), this problem has been fixed in version 1:3.5.12-1. We recommend that you upgrade your libxpm packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAliKSw5fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0Ri9Q//Z3BxxTXj2xOhUA6sYvs+9ikwYDGP0AznBA0SRLk0KV/Gu+CNzQIaXDiY ZD4eU7Hb8hICGnBpQVSG3bsgC6bPWmfD1jKzj+dwQSdVjdFdYiNDfVN3NPUY0L54 Ssx/xT8PbPgD3XZI+kVCbdphKJNvmudAxrBHWAfsUgDVs9heWDfFYQ+s8h6FOspX SqNO6Bmcplkx27U2I/dKsRhuho8ZqK3SjYJEBmDzXlSC/PDFTykPxjt4Fzw10RD8 FxwEfQpHJD/U2GIQe5JsekOhlaQiXeIGzD7DdmipTFXtKkQ9eZO8EWY1p3pgwF/a tohJ64r0616iUYTN15HcYcRxVfGCzN9ULuyUEMXI263O/fFGvKeSorXZmxupy7OM HePCDp3CuzqqsR8PvbsLXsPobDpEfj441FKhZ84qnbfOsZ7p4FttdQPeL8/4wket 6y9MHvcMo4dTMfc5g++MZY+PtA3aOGl7k7jwPz08otuCtClX23f23BFuDECzmh8H 2Fe82x2FnfMdN0Xy7FzDdyMPSlp1O6QhKNWw8bNSWNUNBR7th2BT7HkerKag3Xvh mckzSAF/+IHsDYUy84X5sDeRcBylfTCPp96HQrkSrpJklNRP33QzJ85HVFNjmVOC KprZP5Tz2rTS60zJyz58DjVxbK8rKMkm46XauLFSTSJQj1yraYM= =V3wb -----END PGP SIGNATURE-----