DebianDEBIAN:DSA-1745-2:6CD15

HistoryMar 25, 2009 - 11:32 a.m.

[SECURITY] [DSA 1745-2] New lcms packages fix regression

2009-03-2511:32:18

lists.debian.org

Debian Security Advisory DSA-1745-2 [email protected]
http://www.debian.org/security/ Steffen Joeris
March 25, 2009 http://www.debian.org/security/faq

Package : lcms
Vulnerability : several vulnerabilities
Problem type : local (remote)
Debian-specific: no
CVE Ids : CVE-2009-0581 CVE-2009-0723 CVE-2009-0733

This update fixes a possible regression introduced in DSA-1745-1 and
also enhances the security patch. For reference the original advisory
text is below.

Several security issues have been discovered in lcms, a color management
library. The Common Vulnerabilities andi Exposures project identifies
the following problems:

CVE-2009-0581

Chris Evans discovered that lcms is affected by a memory leak, which
could result in a denial of service via specially crafted image files.

CVE-2009-0723

Chris Evans discovered that lcms is prone to several integer overflows
via specially crafted image files, which could lead to the execution of
arbitrary code.

CVE-2009-0733

Chris Evans discovered the lack of upper-gounds check on sizes leading
to a buffer overflow, which could be used to execute arbitrary code.

For the stable distribution (lenny), these problems have been fixed in
version 1.17.dfsg-1+lenny2.

For the oldstable distribution (etch), these problems have been fixed
in version 1.15-1.1+etch3.

For the testing distribution (squeeze) and the unstable distribution
(sid), these problems will be fixed soon.

We recommend that you upgrade your lcms packages.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch

Debian (oldstable)

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15-1.1+etch3.diff.gz
Size/MD5 checksum: 5160 16d7404b4dc2f31cfe8c83336013cddd
http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15-1.1+etch3.dsc
Size/MD5 checksum: 644 5fe77039701cfa261d3ef84842d0e81e
http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15.orig.tar.gz
Size/MD5 checksum: 791543 95a710dc757504f6b02677c1fab68e73

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_alpha.deb
Size/MD5 checksum: 181316 b06ba5e4b64f5199ef241bd9fe8f293c
http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_alpha.deb
Size/MD5 checksum: 60246 89c087c9dd7e2d5dd2d78cbfb80c4017
http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_alpha.deb
Size/MD5 checksum: 154378 9ab10ab4eae2ad103b2a7abc18e6cfc4

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_amd64.deb
Size/MD5 checksum: 149534 1c06e35f87a683ad05c0fb1503859b4b
http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_amd64.deb
Size/MD5 checksum: 141016 f957d77d929d2e5ab9a4749cafab3b65
http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_amd64.deb
Size/MD5 checksum: 53242 52fe759a62f8b111a65550f074c5037b

arm architecture (ARM)

http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_arm.deb
Size/MD5 checksum: 136610 d7c849cdf0eef3e2c0c1318a31f9e7c1
http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_arm.deb
Size/MD5 checksum: 135176 501beeb4b4309ae863c8c0d46fde6b1a
http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_arm.deb
Size/MD5 checksum: 51742 bc7e60d9b5ac44efdf24a0b384f0f173

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_hppa.deb
Size/MD5 checksum: 169464 312f7f7f841c09396a6c30ca76a35754
http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_hppa.deb
Size/MD5 checksum: 158496 9d0fa35be0159f82709447b53df2a003
http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_hppa.deb
Size/MD5 checksum: 59260 88e7279014e0482a797d54140e74e828

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_i386.deb
Size/MD5 checksum: 50258 fa63f21e62c9fc8b863b60a3b470a840
http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_i386.deb
Size/MD5 checksum: 144134 58a63611f27e80b39537c28171211699
http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_i386.deb
Size/MD5 checksum: 138128 4c01410bae1d6508a77708206032871d

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_ia64.deb
Size/MD5 checksum: 78588 17da81143523be8e6ea70be3c4044422
http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_ia64.deb
Size/MD5 checksum: 196180 68a05087486894adae92031ed3c7d510
http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_ia64.deb
Size/MD5 checksum: 205450 66244f6ebdf34dd656cf7bbbe649e110

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_mips.deb
Size/MD5 checksum: 149686 8d5cb21c8f47d5576aa8d7aa5bfc6aa8
http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_mips.deb
Size/MD5 checksum: 173982 7101d5218722dc09f7c89e09b93bd9be
http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_mips.deb
Size/MD5 checksum: 52094 72ec336e06cf4042648d9ddd00509f35

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_mipsel.deb
Size/MD5 checksum: 150926 c6a286b60bc31d2f48f3fb05209f0c83
http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_mipsel.deb
Size/MD5 checksum: 52290 91070dc723d6e000a7b78cb3221ef280
http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_mipsel.deb
Size/MD5 checksum: 175070 6f59ce0571035853680e96134062857d

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_powerpc.deb
Size/MD5 checksum: 148372 30e1c544cbe11d7b207a361d0f8fadc7
http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_powerpc.deb
Size/MD5 checksum: 148342 68e7d1bd20e8a05ea8edc165e746a784
http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_powerpc.deb
Size/MD5 checksum: 57778 ac6467e6d888c9e64aed8612f0ec0f16

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_s390.deb
Size/MD5 checksum: 54298 37e6c4d12f4f33b9b0e95119a27e9714
http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_s390.deb
Size/MD5 checksum: 143172 a95270d1b8a7c1f282fabdf349bea783
http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_s390.deb
Size/MD5 checksum: 145324 619d5b581922e40d17de03b31db02faf

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch3_sparc.deb
Size/MD5 checksum: 51562 bf67e60a217cf1157fcd0a29a8ac1907
http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch3_sparc.deb
Size/MD5 checksum: 147482 cfef0937ca2d432f04bacbd1e7f8472a
http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch3_sparc.deb
Size/MD5 checksum: 138088 e40a9fb196fd26caec11619fbaf60cda

Debian GNU/Linux 5.0 alias lenny

Debian (stable)

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.