Debian alert DSA-1729-1 (gst-plugins-bad0.10)
| From: | Steffen Joeris <steffen.joeris@skolelinux.de> | |
| To: | bugtraq@securityfocus.com | |
| Subject: | [SECURITY] [DSA 1729-1] New gst-plugins-bad0.10 packages fix multiple vulnerabilities | |
| Date: | Mon, 02 Mar 2009 20:38:00 +0000 | |
| Message-ID: | <E1LeEtk-0000aG-8y@klecker.debian.org> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1729-1 security@debian.org http://www.debian.org/security/ Noah Meyerhans March 02, 2009 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : gst-plugins-bad0.10 Vulnerability : several vulnerabilities Problem type : local (remote) Debian-specific: no CVE Id : CVE-2009-0386 CVE-2009-0387 CVE-2009-0397 Several vulnerabilities have been found in gst-plugins-bad0.10, a collection of various GStreamer plugins. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0386 Tobias Klein discovered a buffer overflow in the quicktime stream demuxer (qtdemux), which could potentially lead to the execution of arbitrary code via crafted .mov files. CVE-2009-0387 Tobias Klein discovered an array index error in the quicktime stream demuxer (qtdemux), which could potentially lead to the execution of arbitrary code via crafted .mov files. CVE-2009-0397 Tobias Klein discovered a buffer overflow in the quicktime stream demuxer (qtdemux) similar to the issue reported in CVE-2009-0386, which could also lead to the execution of arbitrary code via crafted .mov files. For the stable distribution (lenny), these problems have been fixed in version 0.10.8-4.1~lenny1 of gst-plugins-good0.10, since the affected plugin has been moved there. The fix was already included in the lenny release. For the oldstable distribution (etch), these problems have been fixed in version 0.10.3-3.1+etch1. For the unstable distribution (sid) and the testing distribution (squeeze), these problems have been fixed in version 0.10.8-4.1 of gst-plugins-good0.10. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 819 3a44313023fb5a930247b5b981e700ae http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 1377759 6d09962ac9ae6218932578ccc623407f http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 9477 74cfd15f0e32f3b56509e648953fdec8 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 733630 5a57a10505b41e4c28bc4e0642f8650a amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 549878 cd0413ebf02e178ea27c5c8d16ad95fa arm architecture (ARM) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 561194 a0724a6cab918a8da823d7bf46443ef1 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 552386 5925c3bdbbb3d1f498653ca201112ca0 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 832140 365297044bf80b32378e97fa3657f201 mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 619356 053cceaa42b6c38dc1cc1d64a8d3e7bd mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 600068 09cf53d117f6c449664d96bba3e3fc9a powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 600966 6a0e5ed57d4da5875040be8cc96345f5 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 580644 1bdfe57a99a1b2398fe163421d97cc9d sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/g/gst-plugin... Size/MD5 checksum: 576270 cbe44fa23352da55f24506ee60262bfd These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFJrELUYrVLjBFATsMRAs/rAJ4u0ozLEF8iFBt+NiFnDso2uyhZiACfTiIR hLpLh3he1Zg+z0gNSTR7Y+k= =FhiP -----END PGP SIGNATURE-----