SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
Search :
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

New xzgv packages fix arbitrary code execution


Arrow  SecurityAlert : 756
Arrow  CVE : CVE-2006-1060
Arrow  SecurityRisk : High  Security Risk High  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Given : No
Arrow  Credit : joey infodrom org (Martin Schulze)
Arrow  Published : 22.04.2006

Arrow  Affected Software : xzgv



Arrow  Advisory Text :  

Debian Security Advisory DSA 1038-1 security (at) debian
(dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
April 22nd, 2006 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
--

Package : xzgv
Vulnerability : programming error
Problem type : remote
Debian-specific: no
CVE ID : CVE-2006-1060

Andrea Barisani discovered that xzgv, a picture viewer for X with a
thumbnail-based selector, attempts to decode JPEG images within the
CMYK/YCCK colour space incorrectly, which could lead to the execution
of arbitrary code.

For the old stable distribution (woody) this problem has been fixed in
version 0.7-6woody3.

For the stable distribution (sarge) this problem has been fixed in
version 0.8-3sarge1.

For the unstable distribution (sid) this problem will be fixed soon.

We recommend that you upgrade your xzgv package.

Upgrade Instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

Source archives:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3.dsc

Size/MD5 checksum: 581 1a95ff78280e98e448b19807e6dacd14

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3.dif
f.gz
Size/MD5 checksum: 7188 3af533cd6791a61c35cac448cdf7bd86

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7.orig.tar.gz

Size/MD5 checksum: 296814 9a376cc01cf486a2a8901fbc8b040d29

Alpha architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_alp
ha.deb
Size/MD5 checksum: 199802 8d2c31ecea7c0821a463930a795e4363

ARM architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_arm
.deb
Size/MD5 checksum: 187280 3e9a89fcb5bca1c3b0cd5afa88b0a628

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_i38
6.deb
Size/MD5 checksum: 185464 60cc2843ea8611650074c3b6247c9a68

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_ia6
4.deb
Size/MD5 checksum: 220106 81b23a2fef7ea3c0d1e45d531494acce

HP Precision architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_hpp
a.deb
Size/MD5 checksum: 195672 de3c3a653cee6c8a810554179e07dc22

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_m68
k.deb
Size/MD5 checksum: 181774 8a51dbe9d11e85c1a50831c2035c1a0d

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_mip
s.deb
Size/MD5 checksum: 188680 10ff84344193db70d24e438f48554fc6

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_mip
sel.deb
Size/MD5 checksum: 187718 5ba8e5fa9b7e2b54cb1f11f867431ee5

PowerPC architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_pow
erpc.deb
Size/MD5 checksum: 189770 909d2af6f68d5d7c49ecbacd2b187293

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_s39
0.deb
Size/MD5 checksum: 189282 22d9c8dad8cf2a577fca2a208e9ed745

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.7-6woody3_spa
rc.deb
Size/MD5 checksum: 189208 5daa878f409a61f2ea519ac8d1ca5730

Debian GNU/Linux 3.1 alias sarge
- --------------------------------

Source archives:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1.dsc

Size/MD5 checksum: 642 ae7ee0519ba25087b0dbd809a5a1db43

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1.dif
f.gz
Size/MD5 checksum: 8762 2f40bca80610715c3a48c7cd68733cc4

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8.orig.tar.gz

Size/MD5 checksum: 302801 e392277f1447076402df2e3d9e782cb2

Alpha architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_alp
ha.deb
Size/MD5 checksum: 210012 6938839b55f3a36a3732a9743ae1a7df

AMD64 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_amd
64.deb
Size/MD5 checksum: 201782 6b4d5abca89ec0dd92e2f34dd21a51e8

ARM architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_arm
.deb
Size/MD5 checksum: 194364 a80549d3f3f2e05ad37b45ff087d19c6

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_i38
6.deb
Size/MD5 checksum: 195816 69b8d384068d9fc7061997c63bd3075e

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_ia6
4.deb
Size/MD5 checksum: 223934 eb187eba5a5aa8bada015cab8d50bde1

HP Precision architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_hpp
a.deb
Size/MD5 checksum: 202856 931a992b298cc192afcd164f2c379148

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_m68
k.deb
Size/MD5 checksum: 189288 61005b854fabb24ee582d66644e39e73

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_mip
s.deb
Size/MD5 checksum: 196818 a3ccaeb5207c03483ab2073134afff84

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_mip
sel.deb
Size/MD5 checksum: 195800 7d63b90f48fda8dc6004ebd65f2b280c

PowerPC architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_pow
erpc.deb
Size/MD5 checksum: 198764 ad327072b62b9901450585abd7d687a0

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_s39
0.deb
Size/MD5 checksum: 200516 4a1a716179571f70adb1fa1685b374a6

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/x/xzgv/xzgv_0.8-3sarge1_spa
rc.deb
Size/MD5 checksum: 195544 cc23e85b70d38954c3d0e92cc209e2dc

These files will probably be moved into the stable distribution on
its next update.

- ------------------------------------------------------------------------
---------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce (at) lists.debian (dot) org [email
concealed]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFESengW5ql+IAeqTIRAvQoAJ4zsax+2KVU1gLhcgWanTI3P7/qBgCaA5x0
JI7zwCVH/xWBKS4iJZICtT8=
=utK/
-----END PGP SIGNATURE-----



Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

Multiple Vendors libc/gdtoa printf(3) Array Overrun

Security Risk High- 2009-05-30

SecurityReason realised new advisory about vulnerabilities libc/gdtoa...
Apache RSS Apache Alert

» Apache Tomcat
   RequestDispatcher
   directory traversal
   vulnerability

» Apache mod_dav / svn
   Remote Denial of Service
   Exploit

» Apache Tomcat Information
   disclosure

» Apache Tomcat User
   enumeration vulnerability
   with FORM authentication
PHP RSS PHP Alert

» PHP 5.2.9 curl safe_mode
   & open_basedir bypass

» PHP 5.2.6 SAPI
   php_getuid() overload

» PHP
   ZipArchive::extractTo()
   Directory Traversal
   Vulnerability

» PHP 5.2.6 dba_replace()
   destroying file
Copyright © SecurityReason.com. All Rights Reserved.