Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2007.0106 -- [Debian] New imagemagick package fix arbitrary code execution 15 February 2007 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: imagemagick Publisher: Debian Operating System: Debian GNU/Linux 3.1 Impact: Execute Arbitrary Code/Commands Access: Remote/Unauthenticated CVE Names: CVE-2007-0770 CVE-2006-5456 Ref: ESB-2006.0854 Original Bulletin: http://www.debian.org/security/2007/dsa-1260 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - -------------------------------------------------------------------------- Debian Security Advisory DSA 1260-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff February 14th, 2007 http://www.debian.org/security/faq - - -------------------------------------------------------------------------- Package : imagemagick Vulnerability : buffer overflow Problem-Type : local(remote) Debian-specific: no CVE ID : CVE-2007-0770 Vladimir Nadvornik discovered that the fix for a vulnerability in the PALM decoder of Imagemagick, a collection of image manipulation programs, was ineffective. To avoid confusion a new CVE ID has been assigned; tha original issue was tracked as CVE-2006-5456. For the stable distribution (sarge) this problem has been fixed in version 6:6.0.6.2-2.9. For the upcoming stable distribution (etch) this problem has been fixed in version 7:6.2.4.5.dfsg1-0.14. For the unstable distribution (sid) this problems has been fixed in version 7:6.2.4.5.dfsg1-0.14. We recommend that you upgrade your imagemagick packages. Upgrade Instructions - - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9.dsc Size/MD5 checksum: 881 7a9c72b09064a000b21fb7f1c188f58b http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9.diff.gz Size/MD5 checksum: 142091 882c6b166d02a3afcf7b65b935053141 http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2.orig.tar.gz Size/MD5 checksum: 6824001 477a361ba0154cc2423726fab4a3f57c Alpha architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_alpha.deb Size/MD5 checksum: 1473132 a64722b75a6727372eab8c5a8e9d3460 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_alpha.deb Size/MD5 checksum: 173936 73ad6aba77ddd80a1fa1bf9cb6838a6a http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_alpha.deb Size/MD5 checksum: 288822 6a29717cdc16bc5f7dc3527b3c04a32e http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_alpha.deb Size/MD5 checksum: 1284370 7fe43e1953d01bfd1f40e743b43828e5 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_alpha.deb Size/MD5 checksum: 2200348 183f4d885fb0f0aa298f80ae689eb068 http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_alpha.deb Size/MD5 checksum: 234798 1e536b98cce30203535a21a110effc66 AMD64 architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_amd64.deb Size/MD5 checksum: 1466442 cce61a586a2c5456e5cd9998f503dff1 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_amd64.deb Size/MD5 checksum: 163710 f0c6e48b31063d20aad8d6801f7b01dd http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_amd64.deb Size/MD5 checksum: 228834 c0e8f73804537f75df7260ff692e0cb6 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_amd64.deb Size/MD5 checksum: 1195150 0162e13544100058faee672fd672bcfd http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_amd64.deb Size/MD5 checksum: 1550468 07ae791a2fbccd31ea48bb425552308f http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_amd64.deb Size/MD5 checksum: 231912 ffe6aa0bc71cb5b1f367864fd94c9c0c ARM architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_arm.deb Size/MD5 checksum: 1466166 7a8b57092ad8fcb15ff9ac69e94f79a6 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_arm.deb Size/MD5 checksum: 149436 f60d0449d25c294c8a9e5b111ee0dd73 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_arm.deb Size/MD5 checksum: 234946 fc0b7d343929740700a12af92014f7b7 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_arm.deb Size/MD5 checksum: 1204686 888ae3ff5955c8d4ba9635d2b0333357 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_arm.deb Size/MD5 checksum: 1647748 b0ebfaba0393ad3d17cc08417e16f4f6 http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_arm.deb Size/MD5 checksum: 230598 febfdf6b1e489ce6e9c5c195eea4d099 HP Precision architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_hppa.deb Size/MD5 checksum: 1468434 91af04f67f24aa210f9751b23b44f1a0 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_hppa.deb Size/MD5 checksum: 182294 22ff85bb71aa67ec2dfd07c08698a95e http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_hppa.deb Size/MD5 checksum: 274036 2832f545f069276518a6cd91658ab495 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_hppa.deb Size/MD5 checksum: 1404890 80a6f5944d0be3209f1fdeed9de3c1ae http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_hppa.deb Size/MD5 checksum: 1827916 94b36feb9f8fcb3b9262d9725652e5cf http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_hppa.deb Size/MD5 checksum: 243918 8bbc8f0b106e7fc8160801f5e9ed4c6f Intel IA-32 architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_i386.deb Size/MD5 checksum: 1466158 b12fb2db8d713c7d09609ce761ce511f http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_i386.deb Size/MD5 checksum: 164504 12ffd60f5fc6c51a85016a1ebdc75d53 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_i386.deb Size/MD5 checksum: 209010 9aeebaf3983a8bdaad0bb762609054ed http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_i386.deb Size/MD5 checksum: 1172338 58922d27e7184a30fcdf5de44ddf9e7c http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_i386.deb Size/MD5 checksum: 1507592 8b8d72379bacb85839b4bbf7f2d4a1b4 http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_i386.deb Size/MD5 checksum: 234080 7ef93e742172c9a342acc2a913b65520 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_ia64.deb Size/MD5 checksum: 1468502 0a7887202d57741c8c3be4b2dce958e2 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_ia64.deb Size/MD5 checksum: 188402 3ade807b07759f05c264885efb99419e http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_ia64.deb Size/MD5 checksum: 296008 82f76c8876488eca4f4818abb3d5edb4 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_ia64.deb Size/MD5 checksum: 1605664 ebf2610607abc6410b09dc239c382c90 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_ia64.deb Size/MD5 checksum: 2132678 5fd5d6101764eb020ae46945e52a11ed http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_ia64.deb Size/MD5 checksum: 273596 a13f4b344a84d94fa360162225b93c10 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_m68k.deb Size/MD5 checksum: 1466216 6b3c7f12eb188ac46fc20fd1ffa9dfa8 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_m68k.deb Size/MD5 checksum: 160146 b466183701680d1216ca13823170430d http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_m68k.deb Size/MD5 checksum: 210812 dc5096668fe53c84e1675f7ae361f94b http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_m68k.deb Size/MD5 checksum: 1073380 f5a339d2de04dc2f7de490de29ca2f4c http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_m68k.deb Size/MD5 checksum: 1288946 33ca416bee60fa710c8efe906ad58a60 http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_m68k.deb Size/MD5 checksum: 227038 017265076e92de6c95130780e7ca9dcd Big endian MIPS architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_mips.deb Size/MD5 checksum: 1490302 79e518fceb087b30d2a1c14bd60b8691 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_mips.deb Size/MD5 checksum: 155602 f77792a9077082ff893900446d286be4 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_mips.deb Size/MD5 checksum: 254920 8fb4d82e2f40d41c7eb7418b0f43a3d1 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_mips.deb Size/MD5 checksum: 1119298 0458271acc8b9925db07ad48e184f058 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_mips.deb Size/MD5 checksum: 1704528 30f1e7b3b9fa83719e9b3952c6c502a7 http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_mips.deb Size/MD5 checksum: 131418 3e77636bb19daed6ed119a627b0ce504 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_mipsel.deb Size/MD5 checksum: 1490274 8baafda5b96b876517b06eafacbf895b http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_mipsel.deb Size/MD5 checksum: 151714 09ef6d0f126ca139d69289799d7fb895 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_mipsel.deb Size/MD5 checksum: 250164 b65ca0ed3b5f040f5d78a5fbdb1d5563 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_mipsel.deb Size/MD5 checksum: 1114890 6c47dc9a27e98b670e31e5a6aa8e6daf http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_mipsel.deb Size/MD5 checksum: 1668004 469c0f05098b4a8ec6a265632ba950bd http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_mipsel.deb Size/MD5 checksum: 131020 4fb92c9bb3f4d4f5caaa039b646aa9af PowerPC architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_powerpc.deb Size/MD5 checksum: 1471882 8d3e9a8bf55a29112ef3cdf6bf9e12e9 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_powerpc.deb Size/MD5 checksum: 156866 d1ee7717bade0bf2cfd1286ec8f9dae8 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_powerpc.deb Size/MD5 checksum: 227822 43e65023fad784aca3c2061703f4dbb8 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_powerpc.deb Size/MD5 checksum: 1169594 e428dda6c063b60ed3f90ba25aaf5194 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_powerpc.deb Size/MD5 checksum: 1684924 03e88e7f8158add8558bb4cfc0b413eb http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_powerpc.deb Size/MD5 checksum: 270638 27a8eaacfee84ee0103bd58f817f8cbb IBM S/390 architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_s390.deb Size/MD5 checksum: 1467688 e30f5f259bbfb5855468c4ca165eb311 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_s390.deb Size/MD5 checksum: 180574 bd3a78a00b618c09182631011cca8455 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_s390.deb Size/MD5 checksum: 230292 0e052ebfd74856a77ec7815567b581bd http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_s390.deb Size/MD5 checksum: 1194348 558ea25312ff8ec8a39001f87f4c2f2d http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_s390.deb Size/MD5 checksum: 1531000 a11c3e26b1d6cb2110a1eb454874b990 http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_s390.deb Size/MD5 checksum: 242192 7180ca4868abbead48a65de84d74caf9 Sun Sparc architecture: http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_6.0.6.2-2.9_sparc.deb Size/MD5 checksum: 1465752 1b7a5126b7ab981ba3cb2ba840405ecb http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6_6.0.6.2-2.9_sparc.deb Size/MD5 checksum: 161160 fe14a3bf7df9231eef3931dffa190882 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++6-dev_6.0.6.2-2.9_sparc.deb Size/MD5 checksum: 224424 b12e563f9c3f33fe4599cb3343387477 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6_6.0.6.2-2.9_sparc.deb Size/MD5 checksum: 1249364 9fc7b5dbfd4a964443cead1d34bf1649 http://security.debian.org/pool/updates/main/i/imagemagick/libmagick6-dev_6.0.6.2-2.9_sparc.deb Size/MD5 checksum: 1684558 4ca62128d73a9bf8a1b8c680195da801 http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_6.0.6.2-2.9_sparc.deb Size/MD5 checksum: 231044 3a630dd561970f121708553c6262e1d9 These files will probably be moved into the stable distribution on its next update. - - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFF03kSXm3vHE4uyloRAu5qAKCjS8ZrdUaOQdrbGlMXIVxrJheBZACeOhkc W+Ah8dUvx+7B1cNPQa6dyNQ= =e+ks - -----END PGP SIGNATURE----- - -- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRdPAJCh9+71yA2DNAQK85AQAnnMFwhPg1v07VpqPpne6qs4Pxzyn4bBF Nus9g2PEizrvd0cmlbqIubqR0qQTp0lQOepb14Y/e3P4l9LalZHKLI5TcT4J0Hga N6c3m9/nmusPNzpR/tIoiWDRhIEm7S8GoqwTyFm5/c1tzKbVrQ8I2Jl84OsHl5zO Ncp2ECUCw6w= =EOMn -----END PGP SIGNATURE-----