Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2005.0531 -- Debian Security Advisory DSA 753-1
New gedit packages fix denial of service
13 July 2005
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: gedit
Publisher: Debian
Operating System: Debian GNU/Linux 3.1
Linux variants
Impact: Denial of Service
Access: Remote/Unauthenticated
CVE Names: CAN-2005-1686
Original Bulletin: http://www.debian.org/security/2005/dsa-753
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - --------------------------------------------------------------------------
Debian Security Advisory DSA 753-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
July 12th, 2005 http://www.debian.org/security/faq
- - --------------------------------------------------------------------------
Package : gedit
Vulnerability : format string
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2005-1686
A format string vulnerability has been discovered in gedit, a
light-weight text editor for GNOME, that may allow attackers to cause
a denial of service (application crash) via a binary file with format
string specifiers in the filename. Since gedit supports opening files
via "http://" URLs (through GNOME vfs) and other schemes, this might
be a remotely exploitable vulnerability.
The old stable distribution (woody) is not vulnerable to this problem.
For the stable distribution (sarge) this problem has been fixed in
version 2.8.3-4sarge1.
For the unstable distribution (sid) this problem has been fixed in
version 2.10.3-1.
We recommend that you upgrade your gedit package.
Upgrade Instructions
- - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
- - --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1.dsc
Size/MD5 checksum: 1848 99c4beadcf902ee5857c7a3150f4d0ad
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1.diff.gz
Size/MD5 checksum: 54443 96de2c7d0d757d867f46d36490e0ee92
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3.orig.tar.gz
Size/MD5 checksum: 4051445 cbbd5999141d6de932a0afdd55f1aa35
Architecture independent components:
http://security.debian.org/pool/updates/main/g/gedit/gedit-common_2.8.3-4sarge1_all.deb
Size/MD5 checksum: 1826070 d8519b91f1a8aeba351b1eca19c17712
http://security.debian.org/pool/updates/main/g/gedit/gedit-dev_2.8.3-4sarge1_all.deb
Size/MD5 checksum: 44346 01d42b323e7ffdd2a6aba454996a5a48
Alpha architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_alpha.deb
Size/MD5 checksum: 523608 1f183dc0960c8e9405953fb0946a1f8b
ARM architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_arm.deb
Size/MD5 checksum: 457332 476fc39b828ffcd2224f4ce65e71afcc
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_i386.deb
Size/MD5 checksum: 470122 7162c0ac1f1a7ccd2a315d5b4f01f5d2
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_ia64.deb
Size/MD5 checksum: 578896 85c408b6b41585ddb5d366a3d8ea8aea
HP Precision architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_hppa.deb
Size/MD5 checksum: 505246 2436f36b3b10b36e3af1688e420de02f
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_m68k.deb
Size/MD5 checksum: 459142 d475046c385f0ebd06912d89671f89ef
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_mips.deb
Size/MD5 checksum: 456504 4e3dbf6cf317c281cd5ddfd379bfa6c1
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_mipsel.deb
Size/MD5 checksum: 455104 c466bd51b370e0bfe4a0133e9f31e87c
PowerPC architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_powerpc.deb
Size/MD5 checksum: 473552 7f15b8f11abb2cb017bdc8a9069f1940
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_s390.deb
Size/MD5 checksum: 492994 d86d79670ebad24391213d3449db0dee
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/g/gedit/gedit_2.8.3-4sarge1_sparc.deb
Size/MD5 checksum: 462362 f24856c85dd4f7782a7377423392db70
These files will probably be moved into the stable distribution on
its next update.
- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFC05RBW5ql+IAeqTIRAlWRAJ9uZ9xRFlN27LTe09glLjeJ+TAP7gCfUCB1
UFrawfGF7chblAgr9K+0bsQ=
=IJZV
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBQtRyXyh9+71yA2DNAQIHrgP/YkE25bab+mKtlxuQ8/Hrj/BMWXcH+k9j
MzSOIIEQ+QAq7xHXwGorkjehU+hN5/VQ0yXKwrE/tigDk9RHSWphmWBO44+HMKQ5
U17NCFdYlWh7I4uAKsVyMcOImm7lspImD2Lri2Ha6f0CDp1nrhRhRlA1Ecv4aE4D
mKOpy3XTCpQ=
=ivvs
-----END PGP SIGNATURE-----