[SECURITY] [DSA 2844-1] djvulibre security update

2014-01-1506:55:18

lists.debian.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.8

Confidence

Low

EPSS

0.068

Percentile

94.0%

JSON

Debian Security Advisory DSA-2844-1 [email protected]
http://www.debian.org/security/ Raphael Geissert
January 15, 2014 http://www.debian.org/security/faq

Package : djvulibre
Vulnerability : arbitrary code execution
Problem type : local (remote)
Debian-specific: no
CVE ID : CVE-2012-6535

It was discovered that djvulibre, the Open Source DjVu implementation
project, can be crashed or possibly make it execute arbitrary code when
processing a specially crafted djvu file.

For the oldstable distribution (squeeze), this problem has been fixed in
version 3.5.23-3+squeeze1.

This problem has been fixed before the release of the stable distribution
(wheezy), therefore it is not affected.

We recommend that you upgrade your djvulibre packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian6ia64djvulibre-plugin< 3.5.23-3+squeeze1djvulibre-plugin_3.5.23-3+squeeze1_ia64.deb
Debian6mipsdjview< 3.5.23-3+squeeze1djview_3.5.23-3+squeeze1_mips.deb
Debian6i386libdjvulibre-text< 3.5.23-3+squeeze1libdjvulibre-text_3.5.23-3+squeeze1_i386.deb
Debian6amd64libdjvulibre-dev< 3.5.23-3+squeeze1libdjvulibre-dev_3.5.23-3+squeeze1_amd64.deb
Debian6kfreebsd-i386djvuserve< 3.5.23-3+squeeze1djvuserve_3.5.23-3+squeeze1_kfreebsd-i386.deb
Debian6kfreebsd-amd64libdjvulibre-dev< 3.5.23-3+squeeze1libdjvulibre-dev_3.5.23-3+squeeze1_kfreebsd-amd64.deb
Debian6armeldjvulibre-bin< 3.5.23-3+squeeze1djvulibre-bin_3.5.23-3+squeeze1_armel.deb
Debian6ia64libdjvulibre-text< 3.5.23-3+squeeze1libdjvulibre-text_3.5.23-3+squeeze1_ia64.deb
Debian6i386djvulibre-desktop< 3.5.23-3+squeeze1djvulibre-desktop_3.5.23-3+squeeze1_i386.deb
Debian6kfreebsd-i386djview< 3.5.23-3+squeeze1djview_3.5.23-3+squeeze1_kfreebsd-i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	ia64	djvulibre-plugin	< 3.5.23-3+squeeze1	djvulibre-plugin_3.5.23-3+squeeze1_ia64.deb
Debian	6	mips	djview	< 3.5.23-3+squeeze1	djview_3.5.23-3+squeeze1_mips.deb
Debian	6	i386	libdjvulibre-text	< 3.5.23-3+squeeze1	libdjvulibre-text_3.5.23-3+squeeze1_i386.deb
Debian	6	amd64	libdjvulibre-dev	< 3.5.23-3+squeeze1	libdjvulibre-dev_3.5.23-3+squeeze1_amd64.deb
Debian	6	kfreebsd-i386	djvuserve	< 3.5.23-3+squeeze1	djvuserve_3.5.23-3+squeeze1_kfreebsd-i386.deb
Debian	6	kfreebsd-amd64	libdjvulibre-dev	< 3.5.23-3+squeeze1	libdjvulibre-dev_3.5.23-3+squeeze1_kfreebsd-amd64.deb
Debian	6	armel	djvulibre-bin	< 3.5.23-3+squeeze1	djvulibre-bin_3.5.23-3+squeeze1_armel.deb
Debian	6	ia64	libdjvulibre-text	< 3.5.23-3+squeeze1	libdjvulibre-text_3.5.23-3+squeeze1_ia64.deb
Debian	6	i386	djvulibre-desktop	< 3.5.23-3+squeeze1	djvulibre-desktop_3.5.23-3+squeeze1_i386.deb
Debian	6	kfreebsd-i386	djview	< 3.5.23-3+squeeze1	djview_3.5.23-3+squeeze1_kfreebsd-i386.deb