LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: November 21st, 2014
Linux Security Week: November 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Debian: New lcms packages fix arbitrary code execution Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Debian Several security issues have been discovered in lcms, a color management library.
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1745-1                  security@debian.org
http://www.debian.org/security/                      Steffen Joeris
March 20, 2009                   	http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : lcms
Vulnerability  : several vulnerabilities
Problem type   : local (remote)
Debian-specific: no
CVE Ids        : CVE-2009-0581 CVE-2009-0723 CVE-2009-0733


Several security issues have been discovered in lcms, a color management
library. The Common Vulnerabilities and Exposures project identifies
the following problems:


CVE-2009-0581

Chris Evans discovered that lcms is affected by a memory leak, which
could result in a denial of service via specially crafted image files.

CVE-2009-0723

Chris Evans discovered that lcms is prone to several integer overflows
via specially crafted image files, which could lead to the execution of
arbitrary code.

CVE-2009-0733

Chris Evans discovered the lack of upper-gounds check on sizes leading
to a buffer overflow, which could be used to execute arbitrary code.


For the stable distribution (lenny), these problems have been fixed in
version 1.17.dfsg-1+lenny1.

For the oldstable distribution (etch), these problems have been fixed
in version 1.15-1.1+etch2.

For the testing distribution (squeeze) and the unstable distribution
(sid), these problems will be fixed soon.


We recommend that you upgrade your lcms packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15.orig.tar.gz
    Size/MD5 checksum:   791543 95a710dc757504f6b02677c1fab68e73
  http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15-1.1+etch2.diff.gz
    Size/MD5 checksum:     4632 9a790aa45cdeb69aa46f584689a99f98
  http://security.debian.org/pool/updates/main/l/lcms/lcms_1.15-1.1+etch2.dsc
    Size/MD5 checksum:      644 d4cb8388b8c902a533506ec16ca63501

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_alpha.deb
    Size/MD5 checksum:   181050 b27152b25309aa9e6ad1c34bb3c26366
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_alpha.deb
    Size/MD5 checksum:    60202 53d74752d434e3c9ee30aa9129f0a1e8
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_alpha.deb
    Size/MD5 checksum:   154196 d4fa9270d9a8ca7de7129192ef998506

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_amd64.deb
    Size/MD5 checksum:   149428 30c41aaae075c75890eebc1ce4e5a210
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_amd64.deb
    Size/MD5 checksum:   141048 0c6fa8d6f1d39976480ffc5a835a998a
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_amd64.deb
    Size/MD5 checksum:    53166 df6375dd38801b739fbc160e1eb57eaf

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_arm.deb
    Size/MD5 checksum:   136286 d21fb48afe1c612b88a3cc65f6500e44
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_arm.deb
    Size/MD5 checksum:    51050 1c7d4e76aaf8c7ec7d9090ca04a492f5
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_arm.deb
    Size/MD5 checksum:   136060 20069a3b809cef749d92da5b0e04c583

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_hppa.deb
    Size/MD5 checksum:   169382 3ed56562edaa688b42cd108a3ac468c3
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_hppa.deb
    Size/MD5 checksum:   158440 1616cbcfd9e8fcc8f1774b4aabb0bcf9
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_hppa.deb
    Size/MD5 checksum:    59212 602d13389c04ceba66b5a3f73dfc9f1b

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_i386.deb
    Size/MD5 checksum:    50220 c5d54e09d401fa67c09112d1a63095f1
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_i386.deb
    Size/MD5 checksum:   144120 8d61daf63bcd2bc55d865713df0e70f1
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_i386.deb
    Size/MD5 checksum:   138154 6fc69c606a043b5bf111df8054535aa8

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_ia64.deb
    Size/MD5 checksum:   205574 07b6686ad608cec0196b2c9c2498a485
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_ia64.deb
    Size/MD5 checksum:    78526 9d6a2701a89fc4bfa2a56a44f50f11df
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_ia64.deb
    Size/MD5 checksum:   196306 3e160f4f09edeb0c24d3e5fcd0ce09b1

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_mips.deb
    Size/MD5 checksum:   173910 dcbde36d08fc2a2b293026b2eaaa67ab
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_mips.deb
    Size/MD5 checksum:    52050 27ba6a77d1fbb36be26592184b0f6f93
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_mips.deb
    Size/MD5 checksum:   149722 3068317aa4edb7e3cd44f281587ace03

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_mipsel.deb
    Size/MD5 checksum:    52248 94b99a161a4ea3faab08eecbe620385b
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_mipsel.deb
    Size/MD5 checksum:   174898 1d2e9754ac64a7a8a3d1e3e27367643a
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_mipsel.deb
    Size/MD5 checksum:   150970 267828e1f21b737517901c9380141174

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_powerpc.deb
    Size/MD5 checksum:   148314 9ab68867aea970dbcb01992055423ac9
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_powerpc.deb
    Size/MD5 checksum:    57720 5ab4eca4f14608a232a553f0c7adb065
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_powerpc.deb
    Size/MD5 checksum:   148290 8b96012fc7d91c7d5b7deddc75070b58

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_s390.deb
    Size/MD5 checksum:   143134 c6ef35eb3dc84c734d01599e05d961c1
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_s390.deb
    Size/MD5 checksum:    54244 9c263f1f9203d4a6d305c19e06b1230b
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_s390.deb
    Size/MD5 checksum:   145254 143267794dd79c47eb1780c7da7cc0f0

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.15-1.1+etch2_sparc.deb
    Size/MD5 checksum:   138060 428610a45bae30b34b4d601984673996
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.15-1.1+etch2_sparc.deb
    Size/MD5 checksum:    51510 72bd4d4cd0a6d32db0ade110ab856cf5
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.15-1.1+etch2_sparc.deb
    Size/MD5 checksum:   147438 5e81bea7ae78c89cc45981e738e13103


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/l/lcms/lcms_1.17.dfsg-1+lenny1.dsc
    Size/MD5 checksum:     1299 3505bcba39e0a80f26a2f42c5122cc8c
  http://security.debian.org/pool/updates/main/l/lcms/lcms_1.17.dfsg-1+lenny1.diff.gz
    Size/MD5 checksum:    11798 1b985227402f9af971951e467292e9c8
  http://security.debian.org/pool/updates/main/l/lcms/lcms_1.17.dfsg.orig.tar.gz
    Size/MD5 checksum:   883148 efe7467bac4f10d9b354d5733489334d

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_alpha.deb
    Size/MD5 checksum:    66016 22786233868f92faad781c0a92bfb8a0
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_alpha.deb
    Size/MD5 checksum:   153634 3501c774ebaf52f772d7345e8367d39e
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_alpha.deb
    Size/MD5 checksum:   117190 9d58c3be6fbea76127c193b188f7cf01
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_alpha.deb
    Size/MD5 checksum:   227620 7310da52353bbede62272efe75820152

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_amd64.deb
    Size/MD5 checksum:    59294 b4ca82cc8eb4905edf7dc17c9a0d84db
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_amd64.deb
    Size/MD5 checksum:   198504 f87ca23705138281756a32697703375d
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_amd64.deb
    Size/MD5 checksum:   109380 63eda1ea2f42edcfcd85b8843f6ab55d
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_amd64.deb
    Size/MD5 checksum:   156566 079b0a1bb58e667bd8557a0eeef2ae2a

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_arm.deb
    Size/MD5 checksum:    56566 6d3eba08d53781c30601f3cc86576533
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_arm.deb
    Size/MD5 checksum:   100680 7ad59f90f81db1a8378c142eb4a352cf
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_arm.deb
    Size/MD5 checksum:   134774 87a3a2d18457e6b58afdc782b50de560
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_arm.deb
    Size/MD5 checksum:   186138 32faadb5661f8f87c8c4fb89309f41b6

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_armel.deb
    Size/MD5 checksum:    60240 880ffd0256291e1abec31f23fa2da713
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_armel.deb
    Size/MD5 checksum:   195002 65e5825e14762221f87021780663b569
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_armel.deb
    Size/MD5 checksum:   136468 28945f3fc7cb8493f6e9461d328c2dc7
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_armel.deb
    Size/MD5 checksum:   108432 442926873ad8ce0d318dc48ae5c82186

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_hppa.deb
    Size/MD5 checksum:    63604 8e3b039d9b2954d35cd058000941befd
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_hppa.deb
    Size/MD5 checksum:   217168 ab7e3df16d771cd79e621c3a0dcc5fe5
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_hppa.deb
    Size/MD5 checksum:   120752 27153198ab1fa0b05f30f3da607b16c5
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_hppa.deb
    Size/MD5 checksum:   181802 46305917d990a4f259c48478f0888ebe

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_i386.deb
    Size/MD5 checksum:   191656 c117aa038f09460eb7231cf9f8673008
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_i386.deb
    Size/MD5 checksum:   102490 de10b738cea9379067d5275b992b3e42
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_i386.deb
    Size/MD5 checksum:   149270 ac065c443d32dc37dffe85551f444c83
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_i386.deb
    Size/MD5 checksum:    55276 20a559f00def3d6edfaaaeca9347af11

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_ia64.deb
    Size/MD5 checksum:   261214 afd56e4f2a91b840c967a27d24e1870b
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_ia64.deb
    Size/MD5 checksum:   184426 e4d372899dd0ab70aca16e2173fea57b
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_ia64.deb
    Size/MD5 checksum:   168294 104c524b70ad59ff2e171c6daa84d664
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_ia64.deb
    Size/MD5 checksum:    85042 f46c9571e6e16f37fc1bcb9c88335b17

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_mips.deb
    Size/MD5 checksum:    57022 96b6c6932da8dbbf1150bf9c65d735b1
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_mips.deb
    Size/MD5 checksum:   133560 7f5f22ee075eb34cf87c34f4b4c62625
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_mips.deb
    Size/MD5 checksum:   113764 cb4b0927752d34308f473fb2d8600bf3
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_mips.deb
    Size/MD5 checksum:   221324 ee83c4072f154fec48c21c89eade164f

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_mipsel.deb
    Size/MD5 checksum:   224786 c3ff099d42214eacc742ef78d2df8f66
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_mipsel.deb
    Size/MD5 checksum:   116748 23c81abbcb940bdbb0f203392cad317f
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_mipsel.deb
    Size/MD5 checksum:   130008 7083ea0a69711e8fa79a5ed53ee10106
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_mipsel.deb
    Size/MD5 checksum:    57132 083032fb1ce11174f4cc164ea25df2a5

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_powerpc.deb
    Size/MD5 checksum:   197112 4f6be36a225ec79f4cdfa4d57eef670d
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_powerpc.deb
    Size/MD5 checksum:   163150 cb8d38a42d07ef3ad829bd4140882c39
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_powerpc.deb
    Size/MD5 checksum:   115860 436dd885cc57da35bbee6e800bfc0995
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_powerpc.deb
    Size/MD5 checksum:    70888 302ecb2a5f9bc10e478cd62274e9c424

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_s390.deb
    Size/MD5 checksum:   109040 c3955b35a41325290b76a3ca6dc513fb
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_s390.deb
    Size/MD5 checksum:    60982 2add6e3c4a906355f916384f50d7a546
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_s390.deb
    Size/MD5 checksum:   137542 b028e8fdf16563d2717ee6db3af60c6f
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_s390.deb
    Size/MD5 checksum:   191174 26c1a55ade747e3bb348e1bb5525c2a5

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/l/lcms/liblcms1-dev_1.17.dfsg-1+lenny1_sparc.deb
    Size/MD5 checksum:   194758 2c08dd94dec80598094177afb2811b56
  http://security.debian.org/pool/updates/main/l/lcms/liblcms1_1.17.dfsg-1+lenny1_sparc.deb
    Size/MD5 checksum:   102160 9ed81fc4462e796d655f73075246a340
  http://security.debian.org/pool/updates/main/l/lcms/python-liblcms_1.17.dfsg-1+lenny1_sparc.deb
    Size/MD5 checksum:   156756 1ddc8d890038f569ca4ea792fc586131
  http://security.debian.org/pool/updates/main/l/lcms/liblcms-utils_1.17.dfsg-1+lenny1_sparc.deb
    Size/MD5 checksum:    58018 304d1db0563a0fadfb8524e8fd5dc4ea


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.