ekg - several

Several vulnerabilities have been discovered in ekg, a console Gadu
Gadu client, an instant messaging program. The Common Vulnerabilities
and Exposures project identifies the following vulnerabilities:

• CAN-2005-1850
  Marcin Owsiany and Wojtek Kaniewski discovered insecure temporary
  file creation in contributed scripts.

• CAN-2005-1851
  Marcin Owsiany and Wojtek Kaniewski discovered potential shell
  command injection in a contributed script.

• CAN-2005-1916
  Eric Romang discovered insecure temporary file creation and
  arbitrary command execution in a contributed script that can be
  exploited by a local attacker.

The old stable distribution (woody) does not contain an ekg package.

For the stable distribution (sarge) these problems have been fixed in
version 1.5+20050411-4.

For the unstable distribution (sid) these problems have been fixed in
version 1.5+20050712+1.6rc2-1.

We recommend that you upgrade your ekg package.