-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1416-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff November 27, 2007 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : tk8.3 Vulnerability : buffer overflow Problem type : local(remote) Debian-specific: no CVE Id(s) : CVE-2007-5378 It was discovered that Tk, a cross-platform graphical toolkit for Tcl performs insufficient input validation in the code used to load GIF images, which may lead to the execution of arbitrary code. For the stable distribution (etch), this problem has been fixed in version 8.3.5-6etch1. Due to the technical limitation in the Debian archive scripts the update for the old stable distribution (sarge) cannot be released in sync with the update for the stable distribution. It will be provided in the next days. We recommend that you upgrade your tk8.3 packages. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian (stable) - --------------- Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1.dsc Size/MD5 checksum: 672 de719ed8329448b60a2aa5222d94b4c5 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1.diff.gz Size/MD5 checksum: 28583 de9d57ab9820f98f01a71cab78b9a51c http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5.orig.tar.gz Size/MD5 checksum: 2598030 363a55d31d94e05159e9212074c68004 Architecture independent packages: http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-doc_8.3.5-6etch1_all.deb Size/MD5 checksum: 656798 11b87b5e83e8adfa2e19dc93567c422f alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_alpha.deb Size/MD5 checksum: 808264 05534d541c67856fd7df57bee0b7448f http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_alpha.deb Size/MD5 checksum: 870224 c8f3c39de9dbdbe34afc0558653e97f2 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_amd64.deb Size/MD5 checksum: 691340 3aa055a50b0c1864712cad543240cab6 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_amd64.deb Size/MD5 checksum: 830790 50c07325658b74d25d06e239012da590 arm architecture (ARM) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_arm.deb Size/MD5 checksum: 649782 33621a77aaf49894dc7962d7579ae2c3 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_arm.deb Size/MD5 checksum: 802848 7619e44e0c07804307f3b3d59d97589a hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_hppa.deb Size/MD5 checksum: 888990 d9eaf0227c0594236389bf877747744e http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_hppa.deb Size/MD5 checksum: 773376 c06fc4983e04a409811c6b070a7d0b4a i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_i386.deb Size/MD5 checksum: 670426 3bf93bae2527f043b01edb3018de4d90 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_i386.deb Size/MD5 checksum: 803736 99d6c8562e60a2648817db63555fcbc1 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_ia64.deb Size/MD5 checksum: 1057842 45e3159db424788b401d4a98c1dfb511 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_ia64.deb Size/MD5 checksum: 959436 9cce282e61e257655301ad47ddc03ac1 mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_mips.deb Size/MD5 checksum: 824708 437a50b7cfd05d863b9a4a97b596969e http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_mips.deb Size/MD5 checksum: 725262 8a50f4b098e50fec648ce187139f8af8 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_mipsel.deb Size/MD5 checksum: 822976 3451e740c116b8fbf77c07e744624637 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_mipsel.deb Size/MD5 checksum: 725896 6c09774f07d8463251684f26c1bcda1f powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_powerpc.deb Size/MD5 checksum: 824230 2251a2ee8548aeeb72dd4a1f425fc2b0 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_powerpc.deb Size/MD5 checksum: 659860 d0332098901ff52792d9ab560b242b61 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_s390.deb Size/MD5 checksum: 693954 324775b60e7224a3aab44b895a3eb7b9 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_s390.deb Size/MD5 checksum: 838370 1a04c4abe7846022366f401a7049e83e sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3_8.3.5-6etch1_sparc.deb Size/MD5 checksum: 805234 9bc0cd3ac6d1a375ffe56d889d4967a7 http://security.debian.org/pool/updates/main/t/tk8.3/tk8.3-dev_8.3.5-6etch1_sparc.deb Size/MD5 checksum: 680440 328ed71bd6147eb48d1843ad04d7406c These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFHTIQpXm3vHE4uyloRAu3YAJ9RDQkX0xRClWaEiZVkEU1A7/IHAgCdECYE O227xjm2evaV0ZuE5krU8lU= =ywra -----END PGP SIGNATURE-----