-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1923-1 security@debian.org http://www.debian.org/security/ Nico Golde October 27th, 2009 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : libhtml-parser-perl Vulnerability : denial of service Problem type : remote Debian-specific: no Debian bug : #552531 CVE ID : CVE-2009-3627 A denial of service vulnerability has been found in libhtml-parser-perl, a collection of modules to parse HTML in text documents which is used by several other projects like e.g. SpamAssassin. Mark Martinec discovered that the decode_entities() function will get stuck in an infinite loop when parsing certain HTML entities with invalid UTF-8 characters. An attacker can use this to perform denial of service attacks by submitting crafted HTML to an application using this functionality. For the oldstable distribution (etch), this problem has been fixed in version 3.55-1+etch1. For the stable distribution (lenny), this problem has been fixed in version 3.56-1+lenny1. For the testing (squeeze) and unstable (sid) distribution, this problem will be fixed soon. We recommend that you upgrade your libhtml-parser-perl packages. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Debian (oldstable) - ------------------ Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55.orig.tar.gz Size/MD5 checksum: 84746 75eb683f1fb7aa7c0ffa46ded4564b54 http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.diff.gz Size/MD5 checksum: 6136 8c713a84e3df953ae77d83d9f2cff5bc http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.dsc Size/MD5 checksum: 882 0f38d699bda26190ea4764aa74eac2c8 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_alpha.deb Size/MD5 checksum: 108540 a6d69a440e25b3d3b4e9c5057f6b6908 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_amd64.deb Size/MD5 checksum: 108168 ddafcee82387004c4d55a39a8ca54eb6 arm architecture (ARM) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_arm.deb Size/MD5 checksum: 106962 9842d5bc00c6b308d01fae6d20676e9e hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_hppa.deb Size/MD5 checksum: 109602 2d4a2d3ff134cfdd70135e71caf9043a i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_i386.deb Size/MD5 checksum: 108032 b542502d5b1d4fff66c2d730e8c02790 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_ia64.deb Size/MD5 checksum: 117524 ce065d8d05996cdc4c436104b578ed0a mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mips.deb Size/MD5 checksum: 106518 25feabc68e1aa4aff02b6aff00a2a9df mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mipsel.deb Size/MD5 checksum: 105742 17a4f0fafa183a3794fad636e4e26ce4 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_powerpc.deb Size/MD5 checksum: 106504 beb784e9d723ba717d207c6e9c58414b s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_s390.deb Size/MD5 checksum: 106630 1de105f77b55dd920dbfccb7712e3dc1 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_sparc.deb Size/MD5 checksum: 106222 bd1cd736644c4f2dceb76cc5192f18d0 Debian GNU/Linux 5.0 alias lenny - -------------------------------- Debian (stable) - --------------- Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.diff.gz Size/MD5 checksum: 6147 18b2407d8b26d6225b82a880b16a0e05 http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.dsc Size/MD5 checksum: 1316 5a923d6089e2ffddf050ea5b017a7956 http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56.orig.tar.gz Size/MD5 checksum: 86040 bddc432e5ed9df4d4153a62234f04fc2 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_alpha.deb Size/MD5 checksum: 111160 928145a65d633d76bf3db6a42bcf9173 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_amd64.deb Size/MD5 checksum: 111614 9152d47982c212aa1ee9ec8d6293c97e arm architecture (ARM) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_arm.deb Size/MD5 checksum: 109442 e559abada6a045e2a8d51b1c54a89655 armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_armel.deb Size/MD5 checksum: 109388 47e0480a189e752018d27ffb4b19d9e1 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_hppa.deb Size/MD5 checksum: 112026 52d258a94e332f7f1c527ae0c47d77d6 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_i386.deb Size/MD5 checksum: 109680 da9426f29d77127b954a77263a5b7665 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_ia64.deb Size/MD5 checksum: 121744 90933c7e204254b4c308424af76917b2 mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_mips.deb Size/MD5 checksum: 109378 f46f9971f7d22fe40a1d15cc224cdc70 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_mipsel.deb Size/MD5 checksum: 109870 af19cea178841be6c1fc658cac4c468d powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_powerpc.deb Size/MD5 checksum: 112450 1a2d490c6120185ec0cbddc2bb73e792 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_s390.deb Size/MD5 checksum: 110958 2f21853d729b141554b39132ecf21f5c sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_sparc.deb Size/MD5 checksum: 108682 a1831a4919f5c7b30eab0def292928b5 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkrqO5QACgkQHYflSXNkfP8jYACgkATgE0BJ4ndT4SUaOhI8Qg0w gpkAnAzu0Jnb9nHUe/46Ggi7CdwAoApn =q4EB -----END PGP SIGNATURE-----