LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: April 7th, 2014
Linux Advisory Watch: April 4th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Debian: New xpcd packages fix arbitrary code execution as root Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Debian Updated package.
- --------------------------------------------------------------------------
Debian Security Advisory DSA 676-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
February 11th, 2005                     http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : xpcd
Vulnerability  : buffer overflow
Problem-Type   : local
Debian-specific: no
CVE ID         : CAN-2005-0074

Erik Sjölund discovered a buffer overflow in pcdsvgaview, an SVGA
PhotoCD viewer.  xpcd-svga is part of xpcd and uses svgalib to display
graphics on the Linux console for which root permissions are required.
A malicious user could overflow a fixed-size buffer and may cause the
program to execute arbitrary code with elevated privileges.

For the stable distribution (woody) this problem has been fixed in
version 2.08-8woody3.

For the unstable distribution (sid) this problem will be fixed soon.

We recommend that you upgrade your xpcd-svga package immediately.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3.dsc
      Size/MD5 checksum:      706 b1e7b8aeafd929cd31f9403b6534c86b
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3.diff.gz
      Size/MD5 checksum:    14837 e67ca4ae6f6c0cc09033e195ad188825
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08.orig.tar.gz
      Size/MD5 checksum:   103104 59bf5b8d0466ecb3c58ed1fffcdf499e

  Alpha architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_alpha.deb
      Size/MD5 checksum:    81170 17302a158ec404cf6b7961b8434cec33
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_alpha.deb
      Size/MD5 checksum:    13494 a0a1cec324c9c5fb202e18f33ee5fa59

  ARM architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_arm.deb
      Size/MD5 checksum:    68116 7219d4fbdf1602941a2e17bb136ab348
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_arm.deb
      Size/MD5 checksum:    11954 c47772b3c30cfc26be6f7c53450225bc

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_i386.deb
      Size/MD5 checksum:    64336 33d7f7a4ddf29576e4a37b89c3feb8eb
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_i386.deb
      Size/MD5 checksum:    11840 3234d80da9074230309b8ac5e3e5e0c3
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-svga_2.08-8woody3_i386.deb
      Size/MD5 checksum:    20964 9aba7400f6af8a22c90ff3cb69a44431

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_ia64.deb
      Size/MD5 checksum:    97850 88da140c9f83d0f56768e80e08923b82
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_ia64.deb
      Size/MD5 checksum:    15450 9333d80f7e16cf885b5138291969d3fb

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_hppa.deb
      Size/MD5 checksum:    73434 e479d36155807d7b0b19cf62e40ade42
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_hppa.deb
      Size/MD5 checksum:    12944 cb8feab07d3cb23488f3487192d2f82d

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_m68k.deb
      Size/MD5 checksum:    62778 262bc4fa9f4a76c727aa7ae3be63dd02
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_m68k.deb
      Size/MD5 checksum:    11630 0240c6672a38049666b7383e9eb5b193

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_mips.deb
      Size/MD5 checksum:    73636 75f8f7d42cdbfd51e505c89516a7966a
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_mips.deb
      Size/MD5 checksum:    12736 f69a68c9c81edb75524945ee2e80b4d7

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_mipsel.deb
      Size/MD5 checksum:    73338 50c143655e01f6b5f347520ceab3eb52
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_mipsel.deb
      Size/MD5 checksum:    12710 26ef7c3f8c34638695ec779a68112d26

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_powerpc.deb
      Size/MD5 checksum:    68606 93640415d6d425b966399df9a1a9d703
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_powerpc.deb
      Size/MD5 checksum:    12040 19f723b6df1e32dbc5f57affba9ba773

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_s390.deb
      Size/MD5 checksum:    69770 97d7acf4119d481466e656d3889da854
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_s390.deb
      Size/MD5 checksum:    12636 d30e6ca31aa772884d92c245cc88bd35

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/x/xpcd/xpcd_2.08-8woody3_sparc.deb
      Size/MD5 checksum:    72888 3b961c03a13520a27d3d87f45d8bf19f
    http://security.debian.org/pool/updates/main/x/xpcd/xpcd-gimp_2.08-8woody3_sparc.deb
      Size/MD5 checksum:    11918 b5d3f11a60c394b60eee9d42bae4af70


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.