Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

                       ESB-2008.0373 -- [UNIX/Linux]
                       New m4 packages are available
                               10 April 2008


        AusCERT Security Bulletin Summary

Product:              m4
Publisher:            Slackware
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact:               Execute Arbitrary Code/Commands
Access:               Existing Account
CVE Names:            CVE-2008-1688 CVE-2008-1687

Original Bulletin:

Comment: This advisory references vulnerabilties in products which run on
         platforms other than Slackware. It is recommended that
         administrators running m4 check for an updated version of the
         software for their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

[slackware-security]  m4 (SSA:2008-098-01)

New m4 packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2,
11.0, 12.0, and -current to fix security issues.

More details about the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:


Here are the details from the Slackware 12.0 ChangeLog:
patches/packages/m4-1.4.11-i486-1_slack12.0.tgz:  Upgraded to m4-1.4.11.
  In addition to bugfixes and enhancements, this version of m4 also fixes two
  issues with possible security implications.  A minor security fix with the
  use of "maketemp" and "mkstemp" -- these are now quoted to prevent the
  (rather unlikely) possibility that an unquoted string could match an
  existing macro causing operations to be done on the wrong file.  Also,
  a problem with the '-F' option (introduced with version 1.4) could cause a
  core dump or possibly (with certain file names) the execution of arbitrary
  code.  For more information on these issues, see:
  (* Security fix *)

Where to find the new packages:

HINT:  Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try.  This is another primary FTP site
for Slackware that can be considerably faster than downloading
directly from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 8.1:

Updated package for Slackware 9.0:

Updated package for Slackware 9.1:

Updated package for Slackware 10.0:

Updated package for Slackware 10.1:

Updated package for Slackware 10.2:

Updated package for Slackware 11.0:

Updated package for Slackware 12.0:

Updated package for Slackware -current:

MD5 signatures:

Slackware 8.1 package:
1179fae2c4429945c3e6441fed82709d  m4-1.4.11-i386-1_slack8.1.tgz

Slackware 9.0 package:
d9e5769918dc1741db6bb2619f060995  m4-1.4.11-i386-1_slack9.0.tgz

Slackware 9.1 package:
796f62a0d275b1e9bc4bad8d40595a4e  m4-1.4.11-i486-1_slack9.1.tgz

Slackware 10.0 package:
032835fa9f150839ca0dfac4c73a5498  m4-1.4.11-i486-1_slack10.0.tgz

Slackware 10.1 package:
e0dd3949d996a8fa12bc480fe2d4eda5  m4-1.4.11-i486-1_slack10.1.tgz

Slackware 10.2 package:
690aa0ae07fcb68096b7122f304a9ea1  m4-1.4.11-i486-1_slack10.2.tgz

Slackware 11.0 package:
c48865785be7e2ea5357a43bd625a17f  m4-1.4.11-i486-1_slack11.0.tgz

Slackware 12.0 package:
6655deb1e644f356b2ccf74edd3c9d4e  m4-1.4.11-i486-1_slack12.0.tgz

Slackware -current package:
b56a401503f4285ff0f660bc6da769b8  m4-1.4.11-i486-1.tgz

Installation instructions:

Upgrade the package as root:
# upgradepkg m4-1.4.11-i486-1_slack12.0.tgz


Slackware Linux Security Team

| To leave the slackware-security mailing list:                          |
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
Version: GnuPG v1.4.9 (GNU/Linux)

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.

Comment: http://www.auscert.org.au/render.html?it=1967