Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0424
xdelta3 security update
22 February 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: xdelta3
Publisher: Debian
Operating System: Debian GNU/Linux 7
Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2014-9765
Original Bulletin:
http://www.debian.org/security/2016/dsa-3484
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running xdelta3 check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3484-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
February 19, 2016 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : xdelta3
CVE ID : CVE-2014-9765
Debian Bug : 814067
Stepan Golosunov discovered that xdelta3, a diff utility which works
with binary files, is affected by a buffer overflow vulnerability within
the main_get_appheader function, which may lead to the execution of
arbitrary code.
For the oldstable distribution (wheezy), this problem has been fixed
in version 3.0.0.dfsg-1+deb7u1.
For the stable distribution (jessie), this problem has been fixed in
version 3.0.8-dfsg-1+deb8u1.
For the testing distribution (stretch), this problem has been fixed
in version 3.0.8-dfsg-1.1.
For the unstable distribution (sid), this problem has been fixed in
version 3.0.8-dfsg-1.1.
We recommend that you upgrade your xdelta3 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJWxzifAAoJEAVMuPMTQ89E5BkP/R75kZvWctuo7+D+S+sqPkFc
/n3w5o2FXUFIkp8GWj7WA+nECKEf95vNaBDukNdRv3c+WsDJ74wiAkKei9TGKwsa
lt0lTvMOZDwyz6ZzKyCeJC64RhYduVwzYFYlzi96cv7whK67OgyTR1sdK6KS7rqs
qHoVGs6f2mahy8LYTE57KszUz9im5ZRzC5Gzr0aYCi5q1Xwq1FJkZ3KoNUWrLWBm
XB8e5GUTD0dJnjf2JmfB/cUhLuSnomHFBT3Dz8QuJRoTKCBIZv9aoly4tjVFIZpd
cxAdt8E9gGe9jc86xk2c098LsI2ta9MfGUMaLhEIYqJF9NGnYAHCeatyj7yZnVIq
4NPdj7lXL1XmC/rtRWWYiI46wTfs1j60B95tEY3H9z9c83x67P3X1z5pEpv1Yq29
qjVvH3vkKA2YFjSo/DSs5Na3vJUE33o3aKPJ4fCmVAxJj8RQD8ktgd4JsomMu3i5
nUhuMl2VPU1JCyX9ckniqXo9Rtb5yDLvyA0lgxAk826fNboS4bFolcNC7Gx0BG3E
hMXV2JSiS1SP559ct5nw8zMkggyX3vsYNScrahA3Y7SA7wnAbLTR9V2z/eFVRZfP
NCxjVmrHDhx/r0K4bapLOsrLiICBld8dQVxzB+Qe7zRTjbh6Prc7UeCB+ahOjoar
Zn0EbyC0roOV1QsHDIp5
=FAR5
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVspjcH6ZAP0PgtI9AQISuw/+PHtTTJ/LdbgwqPNPwo4E1sgPJf4IzU3N
C5rARAwQw1MHrC21JXw0IuDEt1/PO5JJSm1fy0LYKdh5XaUPiU+UH0T76mc0xi6x
4pTjW6BBMrl01+ilWeuBWbCbBygn4kz3/+uIcTSfj28iiR4yVNsYFJuMxBY+Jvjb
E89tZNMdFmVkA2K9OVhTuPVy/9BaF3SpQrn9KK1Me9v7tyyjlEQinSRqb2zlJhN3
nyTqYtL5fu3wR0GOtCoPEOUPownECaeFjQ4NfuYrrPrk2aDpoKZR1MVNVlxV6JCU
VgM5P0Fw+/fIrVMjlTH8l6sd6NgzWfT4qoKM2av/HxZMntE0RHVaw9D/CQOU52LC
3WMo1s94RoQ1zh/J62PrWWAN/p6uFibSjrlHNoIVfEI5za28LIU3xpwZ6YpnQqZE
wmcpK7XTpTzeXfyrwdjg6qwcKKUL2qZHShH+PFrFl0S7HdgeiLA90W60Ny2IyoT5
0dYM0X25jbBIlDLbqiss4HGka/msUKpAuNCZtJfqwy7Gk+VwbeHXzez4q9MHU0Lt
SPrr0m4tBZzVcdBPX3ADwnGqb0iYgoT9ypQRyQ9wIEaBwAlZfP1uzRWA+kb6jPaL
i6mWRuf9AQ9LiYjEEX3a8WqsKTrbvWRCF1xrKDR3grVQs/EY5k2cQ5KXT/fLajt1
gOXHB7iV7eU=
=bbzu
-----END PGP SIGNATURE-----