Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2008.0377 -- [UNIX/Linux][Debian]
New gnumeric packages fix arbitrary code execution
11 April 2008
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: gnumeric
Publisher: Debian
Operating System: Debian GNU/Linux 4.0
UNIX variants (UNIX, Linux, OSX)
Impact: Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated
CVE Names: CVE-2008-0668
Original Bulletin: http://www.debian.org/security/2008/dsa-1546
Comment: This advisory references vulnerabilties in products which run on
platforms other than Debian. It is recommended that administrators
running gnumeric check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ------------------------------------------------------------------------
Debian Security Advisory DSA-1546-1 security@debian.org
http://www.debian.org/security/ Devin Carraway
April 10, 2008 http://www.debian.org/security/faq
- - ------------------------------------------------------------------------
Package : gnumeric
Vulnerability : integer overflow
Problem type : local (remote)
Debian-specific: no
CVE Id(s) : CVE-2008-0668
Thilo Pfennig and Morten Welinder discovered several integer overflow
weaknesses in Gnumeric, a GNOME spreadsheet application. These
vulnerabilities could result in the execution of arbitrary code
through the opening of a maliciously crafted Excel spreadsheet.
For the stable distribution (etch), these problems have been fixed in
version 1.6.3-5+etch1.
For the unstable (sid) distribution, these problems were fixed in
version 1.8.1-1.
We recommend that you upgrade your gnumeric packages.
Upgrade instructions
- - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian 4.0 (stable)
- - -------------------
Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1.dsc
Size/MD5 checksum: 1332 bf302ccff8f47985439966110044db14
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3.orig.tar.gz
Size/MD5 checksum: 16479052 da792f23bf26a69788736088e69fc7c0
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1.diff.gz
Size/MD5 checksum: 358014 8daad80708cbf16cf362475437304e96
Architecture independent packages:
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-common_1.6.3-5.1+etch1_all.deb
Size/MD5 checksum: 5272974 82f8f43a0c2a8a6d9803e7cdfa0326dd
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-doc_1.6.3-5.1+etch1_all.deb
Size/MD5 checksum: 4171320 f42bd6770c540f759763a849d7dea505
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_alpha.deb
Size/MD5 checksum: 158390 458b52bbf3d015c432da2b889d7c3eca
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_alpha.deb
Size/MD5 checksum: 2351352 7b078d3fcf9a27b75012bec809759981
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_amd64.deb
Size/MD5 checksum: 156908 8860c1fd0ff35c0a1eda83758fa69457
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_amd64.deb
Size/MD5 checksum: 2202134 1d74f4a0c7ede26d7911743793f1c548
arm architecture (ARM)
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_arm.deb
Size/MD5 checksum: 151102 41063103b8246a7bcc39db1b54a6b065
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_arm.deb
Size/MD5 checksum: 2018806 a486eca4fd7b88eb39829eed0743c22d
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_hppa.deb
Size/MD5 checksum: 161850 fc036ed19c3b161c0d8b06b15e47c9d6
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_hppa.deb
Size/MD5 checksum: 2418880 0f41e79ac16f966b9bb481ea414a0662
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_i386.deb
Size/MD5 checksum: 2097038 ce792c3212eb3b912abe060b6438e4fc
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_i386.deb
Size/MD5 checksum: 152302 df7cdbb758709551116b0b7a1af8757b
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_ia64.deb
Size/MD5 checksum: 2977964 b410a9d5a465433dc6963c9fdf6e7954
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_ia64.deb
Size/MD5 checksum: 173702 c34442685a8732e55136152c4da8ac90
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_mips.deb
Size/MD5 checksum: 150700 31f9785f14f2b54963ea6992e201ce6d
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_mips.deb
Size/MD5 checksum: 2141368 62a06754168c251e1c31f4141e584b1b
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_mipsel.deb
Size/MD5 checksum: 2129564 49b647ce4185516cad2dd87f016a6624
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_mipsel.deb
Size/MD5 checksum: 149690 fc516ba96c1b24dd7e12b94cb5a64538
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_powerpc.deb
Size/MD5 checksum: 2209046 c92394d958dbe9a8783cdd4dbab07b14
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_powerpc.deb
Size/MD5 checksum: 157418 56b47e7648eeefa105838e9c2239099a
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_s390.deb
Size/MD5 checksum: 158596 cbb78e0a514eac16f14184936215b3ba
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_s390.deb
Size/MD5 checksum: 2264012 d3e7a47436ebc4e6e272d4dedeffbe90
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric-plugins-extra_1.6.3-5.1+etch1_sparc.deb
Size/MD5 checksum: 152794 d77d8a2e12e862cf1be3d8018eb2fcd7
http://security.debian.org/pool/updates/main/g/gnumeric/gnumeric_1.6.3-5.1+etch1_sparc.deb
Size/MD5 checksum: 2125056 4f1771e3f2f19b45ac862e6ab48d7974
These files will probably be moved into the stable distribution on
its next update.
- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFH/ooKXm3vHE4uyloRAoz8AKCkcSra7966aft7NSagAEs+YSvxiACg4ZEi
xG7Fgnl8LXBOli1s//O/hmw=
=ITdl
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBR/6hSyh9+71yA2DNAQKTbgP+LQMX7+nzu7flFgHhCCyVvhW7fsTfEwT+
gAw/2zHFvvD/sdEUl5WfGeiZ+W47FFysD2KBacvFiESeIeysBPVr2FI1eEDA04K2
4qL6gs6CfsB1zuD8goS1L0p5JSkqQvI5ActqYdxSxl0QPDG18YQW0p58QYZLLY8a
VrYFHiTyP6Q=
=UMIK
-----END PGP SIGNATURE-----