Nabble - Debian Security

Please test gnutls13 update for etch

2009-11-09T10:03:05Z

Hi,

I've prepared updated packages for gnutls13 in etch fixing CVE-2009-2730 and
CVE-2009-2409.
It would be helpful, if people could install these packages and check whether
they notice any regressions.

Packages are available at http://people.debian.org/~iuculano/gnutls13/
Please send feedback to iuculano@...

Cheers,
Giuseppe.

signature.asc (205 bytes) Download Attachment

Re: problem with security mirror?

2009-11-09T05:30:04Z

Thijs Kinkhorst a écrit :

> On Sun, November 8, 2009 13:34, Yves-Alexis Perez wrote:
>> Hey,
>>
>> apt-get update on my lenny box gives the following warning:
>>
>> W: GPG error: http://security.debian.org lenny/updates Release: The
>> following signatures were invalid: BADSIG 9AA38DCD55BE302B Debian
>> Archive Automatic Signing Key (5.0/lenny) <ftpmaster@...>
>>
>> Do we have some info about that?
>
> I don't have that problem here. Which specific mirror (IP-address) is this?
>

Hmhm, sorry for not updating, the problems has been fixed yesterday
after asking on irc (not exactly sure what was the problem but Ganneff
said it was ok and the problem indeed disappeared :) )

Cheers,

--
Yves-Alexis

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: [DSA-1929-1] linux-2.6 -- privilege escalation/denial of service Error while Upgrading Kernel

2009-11-09T01:57:00Z

Hi,

Problem solved - somebody just deleted /usr/share/initramfs-tools *doh*

:-)

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: problem with security mirror?

2009-11-09T01:39:56Z

On Sun, November 8, 2009 13:34, Yves-Alexis Perez wrote:
> Hey,
>
> apt-get update on my lenny box gives the following warning:
>
> W: GPG error: http://security.debian.org lenny/updates Release: The
> following signatures were invalid: BADSIG 9AA38DCD55BE302B Debian
> Archive Automatic Signing Key (5.0/lenny) <ftpmaster@...>
>
> Do we have some info about that?

I don't have that problem here. Which specific mirror (IP-address) is this?

Thijs

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[DSA-1929-1] linux-2.6 -- privilege escalation/denial of service Error while Upgrading Kernel

2009-11-09T01:04:13Z

Hi everybody,

did anybody run into the same problems on AMD-architecture?

<- *snip* ->
server:/usr/local/apache2/conf/extra# apt-get upgrade
Reading package lists... Done
Building dependency tree... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
Need to get 0B of archives.
After unpacking 0B of additional disk space will be used.
Do you want to continue [Y/n]? y
Setting up linux-image-2.6.18-6-amd64 (2.6.18.dfsg.1-26etch1) ...

VERSION 2.0

CAPB backup

Running depmod.

Finding valid ramdisk creators.
Using mkinitramfs-kpkg to build the ramdisk.
/usr/sbin/mkinitramfs: line 80: /usr/share/initramfs-tools/scripts/functions: No such file or directory
mkinitramfs-kpkg failed to create initrd image.
Failed to create initrd image.
dpkg: error processing linux-image-2.6.18-6-amd64 (--configure):
subprocess post-installation script returned error exit status 9
Errors were encountered while processing:
linux-image-2.6.18-6-amd64
E: Sub-process /usr/bin/dpkg returned an error code (1)

<- *snap* ->

Thanks,
Werner

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

problem with security mirror?

2009-11-08T04:34:34Z

Hey,

apt-get update on my lenny box gives the following warning:

W: GPG error: http://security.debian.org lenny/updates Release: The
following signatures were invalid: BADSIG 9AA38DCD55BE302B Debian
Archive Automatic Signing Key (5.0/lenny) <ftpmaster@...>

Do we have some info about that?

Cheers,
--
Yves-Alexis

signature.asc (205 bytes) Download Attachment

Re: [DSA 1916-1] New kdelibs packages

2009-11-06T11:06:18Z

Steffen Joeris wrote the following on 06.11.2009 05:23

<- *snip* ->

> I have installed them into the archive just now, the security mirrors are
> still syncing, so it should be available within the day.
>
> Cheers
> Steffen

<- *snip* ->
The following packages will be upgraded:
kdelibs (3.5.10.dfsg.1-0lenny2 => 3.5.10.dfsg.1-0lenny3)
.
.

<- *snip* ->

Thanks a lot.

--
bye Thilo

4096R/0xC70B1A8F
721B 1BA0 095C 1ABA 3FC6 7C18 89A4 A2A0 C70B 1A8F

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Please test pidgin update

2009-11-06T10:47:19Z

On Fri, Nov 06, 2009 at 03:58:55PM +0100, Julien Cristau wrote:

> On Mon, Nov 2, 2009 at 20:08:15 +0100, Moritz Muehlenhoff wrote:
>
> > I've prepared updated packages for pidgin fixing CVE-2009-3615.
> > However, I need testers who actually use ICQ. Packages are available
> > at http://people.debian.org/~jmm/ for amd64 and i386. Please send
> > feedback directly to jmm@...
> >
> Hi Moritz,
>
> libpurple0 seems to be missing, and the pidgin package depends on it, so
> these packages are not installable. Forgot to copy it?

Doh, fixed.

Cheers,
Moritz

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Please test pidgin update

2009-11-06T06:58:55Z

On Mon, Nov 2, 2009 at 20:08:15 +0100, Moritz Muehlenhoff wrote:

> I've prepared updated packages for pidgin fixing CVE-2009-3615.
> However, I need testers who actually use ICQ. Packages are available
> at http://people.debian.org/~jmm/ for amd64 and i386. Please send
> feedback directly to jmm@...
>
Hi Moritz,

libpurple0 seems to be missing, and the pidgin package depends on it, so
these packages are not installable. Forgot to copy it?

Cheers,
Julien

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: [DSA 1916-1] New kdelibs packages

2009-11-05T20:23:46Z

On Thu, 5 Nov 2009 08:25:23 am Thilo Six wrote:

> Hello security members
>
> DSA 1916-1 has been announced on 23rd of october but still there are no
> packages available on the mirrors.
>
> The DSA said:
>
> <- *snip* ->
> Due to a bug in the archive system, the fix for the stable distribution
> (lenny), will be released as version 4:3.5.10.dfsg.1-0lenny3 once it is
> available.
> <- *snip* ->
>
> Is there a possibility for a user to know the progress of this?
> Should i post to debian-devel-kde instead?

I have installed them into the archive just now, the security mirrors are

still syncing, so it should be available within the day.

Cheers
Steffen

signature.asc (205 bytes) Download Attachment

Re: [SECURITY] [DSA 1927-1] New Linux 2.6.26 packages fix several vulnerabilities

2009-11-05T13:32:46Z

Hi all,

>> Additional information about this change, including instructions for
>> making this change locally in advance of 5.0.4 (recommended), can be
>> found at:
>> http://wiki.debian.org/mmap_min_addr
>>

The wiki entry only shows mitigations for 5.x versions of Debian. It
would be helpful if it also mentioned that
the mitigation steps for etch (e.g. none so far as I know) and etchnhalf.

Thanks for considering this.

John

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: [SECURITY] [DSA 1927-1] New Linux 2.6.26 packages fix several vulnerabilities

2009-11-05T10:31:03Z

Atualizar kernel seja qual for tua distribuição. Da uma olhadela no null pointer dereference acima. Mes retrasado houve um problema similar em drivers de protocolo de rede.

2009/11/5 dann frazier <dannf@...>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ----------------------------------------------------------------------
Debian Security Advisory DSA-1927-1 security@...
http://www.debian.org/security/ dann frazier
November 5, 2009 http://www.debian.org/security/faq
- ----------------------------------------------------------------------

Package : linux-2.6
Vulnerability : privilege escalation/denial of service/sensitive memory leak
Problem type : local
Debian-specific: no
CVE Id(s) : CVE-2009-3228 CVE-2009-3238 CVE-2009-3547 CVE-2009-3612
CVE-2009-3620 CVE-2009-3621 CVE-2009-3638

Notice: Debian 5.0.4, the next point release of Debian 'lenny', will
include a new default value for the mmap_min_addr tunable. This
change will add an additional safeguard against a class of security
vulnerabilities known as "NULL pointer dereference" vulnerabilities,
but it will need to be overridden when using certain applications.
Additional information about this change, including instructions for
making this change locally in advance of 5.0.4 (recommended), can be
found at:
http://wiki.debian.org/mmap_min_addr

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a denial of service, sensitive memory leak or privilege
escalation. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2009-3228

Eric Dumazet reported an instance of uninitialized kernel memory
in the network packet scheduler. Local users may be able to
exploit this issue to read the contents of sensitive kernel
memory.

CVE-2009-3238

Linus Torvalds provided a change to the get_random_int() function
to increase its randomness.

CVE-2009-3547

Earl Chew discovered a NULL pointer dereference issue in the
pipe_rdwr_open function which can be used by local users to gain
elevated privileges.

CVE-2009-3612

Jiri Pirko discovered a typo in the initialization of a structure
in the netlink subsystem that may allow local users to gain access
to sensitive kernel memory.

CVE-2009-3620

Ben Hutchings discovered an issue in the DRM manager for ATI Rage
128 graphics adapters. Local users may be able to exploit this
vulnerability to cause a denial of service (NULL pointer
dereference).

CVE-2009-3621

Tomoki Sekiyama discovered a deadlock condition in the UNIX domain
socket implementation. Local users can exploit this vulnerability
to cause a denial of service (system hang).

CVE-2009-3638

David Wagner reported an overflow in the KVM subsystem on i386
systems. This issue is exploitable by local users with access to
the /dev/kvm device file.

For the stable distribution (lenny), this problem has been fixed in
version 2.6.26-19lenny2.

For the oldstable distribution (etch), these problems, where
applicable, will be fixed in updates to linux-2.6 and linux-2.6.24.

We recommend that you upgrade your linux-2.6 and user-mode-linux
packages.

Note: Debian carefully tracks all known security issues across every
linux kernel package in all releases under active security support.
However, given the high frequency at which low-severity security
issues are discovered in the kernel and the resource requirements of
doing an update, updates for lower priority issues will normally not
be released for all kernels at the same time. Rather, they will be
released in a staggered or "leap-frog" fashion.

The following matrix lists additional source packages that were
rebuilt for compatibility with or to take advantage of this update:

Debian 5.0 (lenny)
user-mode-linux 2.6.26-1um-2+19lenny2

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Stable updates are available for alpha, amd64, armel, hppa, i386,
ia64, and powerpc. Updates for other architectures will be released
as they become available.

Source archives:

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-2.6_2.6.26-19lenny2.dsc
Size/MD5 checksum: 5778 8ea6c47c6f227f855a41deea57d988d8
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-2.6_2.6.26-19lenny2.diff.gz
Size/MD5 checksum: 7651053 5cf749f9817436c544df97bc0217f125
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-2.6_2.6.26.orig.tar.gz
Size/MD5 checksum: 61818969 85e039c2588d5bf3cb781d1c9218bbcb

Architecture independent packages:

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-tree-2.6.26_2.6.26-19lenny2_all.deb
Size/MD5 checksum: 106866 d25eeb65132ec68406d8fdf7ea340274
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-doc-2.6.26_2.6.26-19lenny2_all.deb
Size/MD5 checksum: 4627374 196ffe954d4e906638c7eb2bd22e310d
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-patch-debian-2.6.26_2.6.26-19lenny2_all.deb
Size/MD5 checksum: 2565284 0682418bd83f755a17a71435e535f91a
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-source-2.6.26_2.6.26-19lenny2_all.deb
Size/MD5 checksum: 48672074 5aa4d0110919b100a772509455b22757
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-manual-2.6.26_2.6.26-19lenny2_all.deb
Size/MD5 checksum: 1768032 cb95ea5101339c35d425ac1ba2f0ff02
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-support-2.6.26-2_2.6.26-19lenny2_all.deb
Size/MD5 checksum: 122160 0d3dd77a86989aa6e6bdfbbf548d22a6

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all-alpha_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 106376 891beea699175e77b6f4cdb1dbbd2377
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-alpha-generic_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 363880 278fefb639e7029af6d5017dedefb500
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-alpha-generic_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 28487296 beb21f0f222b507898406b051d161c25
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 106358 b4c10db49252b22e7019746743624712
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-libc-dev_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 741234 b08b288693ab9d0d3fa1e8141ba4f038
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-alpha-legacy_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 28471478 f412fb78f0dfac51f6e39a035538fe91
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-alpha-smp_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 365312 9147bf190b4dce64fb4783b0c0aba8be
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-alpha-legacy_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 364408 66cd6736f72c0eedabbad596baac8888
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-alpha-smp_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 29177668 abb9bcc21a5fcb0a7352a30fb7209ca1
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common_2.6.26-19lenny2_alpha.deb
Size/MD5 checksum: 3543732 d84be29426f1d706617a6ad91d3b6109

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 389134 2ac60b6aaece8351c023cecbb4bd41ee
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-libc-dev_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 749556 c994eeb54dd967b5255448e80fa4911c
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-vserver-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 389740 8b6b5b10fe023670ca8cf9326d46ccd0
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-openvz-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 394262 8398b2d9ce752ffa39ac55b8f55fa1b7
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 3719144 1fa20cc556fbfecdf0c2335a3c9edeee
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 106352 edb758613531f5c655c8451f1136b62a
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 106378 dd749481c75a66f517551c6b21b3bbbb
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-modules-2.6.26-2-xen-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 19274410 21621e01b880d1f222007e3101d255c6
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-openvz-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 21053742 015990eedbce234dfa4facdf02f6ad60
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common-xen_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 3851500 355a9cc7757195196006160929313e78
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-vserver-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 20902812 3af1d1431ff5674b7aeaf41c784d3ba6
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common-vserver_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 3751848 f5289bf2c22a6112d13a9af6d4291226
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-xen-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 1804900 8ea5afa2f5e29175e92975ef93144b9a
http://security.debian.org/pool/updates/main/l/linux-2.6/xen-linux-system-2.6.26-2-xen-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 106334 2620974dbbc17bbab4aefe183584a6da
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common-openvz_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 3774804 8fa1254acec879820c17dd8e2e4eee56
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 20886016 71a1f29b66ee30cf7a63b77cddc71ec7
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-xen-amd64_2.6.26-19lenny2_amd64.deb
Size/MD5 checksum: 383280 0d0cad637c14a594b3ae424abf824608

armel architecture (ARM EABI)

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-iop32x_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 365550 f97d5bcae3c5c5957781e6507d730780
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-iop32x_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 12396344 04df2ffe832cba3ea1e299701069ca96
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-versatile_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 335184 ff1387cae5afb9c7b2d8b20ab546293f
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 4136850 e7e7742e3ead70e194f540432bf93ba6
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-libc-dev_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 747792 89242eec0e6f453f37b228ddb49e4e26
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-ixp4xx_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 11680082 d9133e003cd603924930f1db870c6d46
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 106354 fce271c39eaa874f6a570b9298a13836
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-versatile_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 9575158 d8c6ec6842339c8d8391916c7b4a25c2
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-orion5x_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 11371016 edc9b10b99e73302ef1853db546ed6bb
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-ixp4xx_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 363118 ca61af313ac3687b042c82e4c56bd078
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all-armel_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 106390 d14317d669c70ea8458b0138105be3e0
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-orion5x_2.6.26-19lenny2_armel.deb
Size/MD5 checksum: 360844 1c7437e1e4de9358f7975feae74501f0

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-parisc64_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 17070158 92d872205303ea622d1419d074b54737
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-parisc_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 296434 df3ddd0a0dbfa712201ff031bfc109c0
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-parisc-smp_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 16323830 9998a4deead3033e07f28a1cd0816136
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-parisc64_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 297894 8cace7fc519c562d4b8657c75d230815
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 3594236 8d621635c43fb9540d4a68ef6d891a57
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 106356 f967499d62622f5f0833539c9eaf2359
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all-hppa_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 106380 f518c1de9ce8dd272db1afa30e38999a
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-parisc_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 15731364 d50829b0556bc7fef6e8c505db959ee2
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-libc-dev_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 759840 faab7849f3cef86fbebc037cbd00fd76
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-parisc64-smp_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 17614856 6311929870350217721f7f194b6ff585
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-parisc64-smp_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 299160 57fd97b01842bbe74e37f443e346d695
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-parisc-smp_2.6.26-19lenny2_hppa.deb
Size/MD5 checksum: 298110 631076db8957d15ab8b0161a60e31734

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-486_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 398182 6f93bf37534bcfb9162b9985b83ee38f
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-openvz-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 20502134 d39255c90c67fddda4c3cb49ce6c93e1
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-vserver-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 20235868 99b3ed110df3b6b2bb6b06feb9d30b72
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 106354 835280ec5ad990b0bcebb988953bd5d9
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-686-bigmem_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 20326344 9192cd01f84e7192159aefec2c4f8fb9
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 20208578 c118b5d6fc4f5007728d1ab804624cd8
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 398052 88be8c6ce0726c87f3127e1ea8b1a382
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-486_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 20175038 ee7bf2ce4d4557f9fdfb53790627ebac
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 3719206 0d8393bd6245aa3d23ef8938477d5f63
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-vserver-686-bigmem_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 20353680 67f48fcd0835fd230e8583cf2676cf09
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-686-bigmem_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 398494 bf4ef1c3e9f35ec4dc0bfaeda1ee5516
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common-xen_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 3851592 94a16944e91f5594a6fa02115b680434
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-vserver-686-bigmem_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 400332 d734fb2f035f0a6a041d13f5a3d95c6c
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-libc-dev_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 749582 26580da1f40ffeeb17146765bbe241f8
http://security.debian.org/pool/updates/main/l/linux-2.6/xen-linux-system-2.6.26-2-xen-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 106348 b76709d63441fcc3e285d2a6dc999890
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-amd64_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 20864938 cc5255ece9764242c63b522abfd8a517
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-vserver-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 399328 c929aa19b40e7eea5ea885148c645a17
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common-vserver_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 3751908 3b936dbeaf13b730ab8dd56e5ab726f9
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-amd64_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 387338 03fd54819fb7176a176eeb4c2ff0209c
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-openvz-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 403790 efa7179643f2f709cace01bb3f4a5580
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common-openvz_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 3774936 088f38a8e9c79bb4ddc67e200ebee754
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-xen-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 1591850 93ad5d17c9e8ac22c3544c8a9ad9eabd
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-xen-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 384698 5cc9137a10772a48628b0014e0dbbc15
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all-i386_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 106404 04d07f928e22a2150a2bb9188c6f1257
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-modules-2.6.26-2-xen-686_2.6.26-19lenny2_i386.deb
Size/MD5 checksum: 18035618 641b34424aad0e9291713bd9e2bf96e5

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-vserver-itanium_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 355640 2bce0c1faefc019460e3eebca333a5fc
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 3654768 d8fb31f9660b7c0ab42c77e89bf82f1f
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-itanium_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 355064 cfb3eee78e3860b2e650716d5032bf5d
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common-vserver_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 3687386 2980814479dbd08d39bd9f92d3005838
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-mckinley_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 355046 62fc734ea7fe9bc4bef1f8d8b65cc027
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-vserver-mckinley_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 34349456 5cfb3ccf034f0ce13a5861507c4cb758
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-itanium_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 34103026 3cee486177d22e2fcd816b536d7ac3d3
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 106350 6265837dd3c0105bcba9d40c5b6966f9
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-vserver-mckinley_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 355698 27152c116ad66c7862f3890d36ac80ab
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-mckinley_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 34288678 1540b7be96fbb68e4cc01d858c5ef5a4
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all-ia64_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 106384 bfb7eeaec3d89587561c56afec1816e9
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-vserver-itanium_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 34165098 7a4fbe457d07807a74e9950a47975d49
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-libc-dev_2.6.26-19lenny2_ia64.deb
Size/MD5 checksum: 748220 03f583157c7eef60269042b9a5a6d0bc

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 106358 5431bb9d2abe49fc1b186f44bf440cba
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-libc-dev_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 756032 fb287119a4cf07ef9d6d633ad30f7236
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-powerpc64_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 372504 9c0501a81bf32b1d0b8c939830d9789b
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-vserver-powerpc_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 23650232 ece0b68e6c9baa2e0f964d2bc7da21a2
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 3856256 5a6eb8c2fe7930456cf5f3a1c257fed1
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-vserver-powerpc64_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 23514630 0aa445df9e479dc6e266a97658c5c675
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-powerpc64_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 23453120 7fdf0e57cb3324433e8f5d3e71c5cb7c
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-powerpc-smp_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 23619598 7eb565a76c6ab3318d32c134f7da26b0
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-powerpc-smp_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 366586 3e8f8e0d8d9dc83a3e009bbdcca04d21
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-common-vserver_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 3890668 a75da89a00e2b5118869888ea03580ae
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-vserver-powerpc64_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 373766 78d152d9edb14f5d179dde50a0131ea7
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-vserver-powerpc_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 366686 4b13a456e727a9259685b74132c5b730
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-all-powerpc_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 106396 33f493756428189d3acc36bde21631ed
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-headers-2.6.26-2-powerpc_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 365950 4149c4f9e6f3e0dc0fbb639a2f962cf8
http://security.debian.org/pool/updates/main/l/linux-2.6/linux-image-2.6.26-2-powerpc_2.6.26-19lenny2_powerpc.deb
Size/MD5 checksum: 23216978 b0034a3be5877f2edebf6ec71c70a83e

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iD8DBQFK8vsShuANDBmkLRkRAuztAKCAAmojb32U5ekaEbI3lWTPLYayHQCfQwhe
vHrSbR3EZNHJzNEAXPK0XqY=
=Synp
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

--
_
(0- Leonardo Couto Chueri : http://lcchueri.esperanto.eti.br/
//\
V_/_ http://www.esperanto.net/ http://www.esperanto.org.br/
_______________________________________________________________________________
Mi apogas la uzadon de Libera Softvaro, Linux-o kaj Esperanto.
Esperanto, criado para o propósito de ser a segunda língua de cada povo.

Re: to: Henri Salvo

2009-11-05T00:29:58Z

On Wednesday 04 of November 2009, Bernie Dolan wrote:
> Hi,
>
> I tried to send a copy of the file to you but got the following error:
>
> henri@...
> SMTP error from remote mail server after RCPT TO:<henri@...>:
> host kiwai.nerv.fi [213.157.65.70]: 554 5.7.1 Service unavailable;
> Client host [64.222.186.12] blocked using dnsbl.dronebl.org

It seems that the bot already got you on blacklist. You should clean up your
computer, and make sure that bruteforece bot does not run any more.

Regards
Vladislav Kurz

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[DSA 1916-1] New kdelibs packages

2009-11-04T13:25:23Z

Hello security members

DSA 1916-1 has been announced on 23rd of october but still there are no
packages available on the mirrors.

The DSA said:

<- *snip* ->
Due to a bug in the archive system, the fix for the stable distribution
(lenny), will be released as version 4:3.5.10.dfsg.1-0lenny3 once it is
available.
<- *snip* ->

Is there a possibility for a user to know the progress of this?
Should i post to debian-devel-kde instead?

Thanks for your patience.

--
bye Thilo

4096R/0xC70B1A8F
721B 1BA0 095C 1ABA 3FC6 7C18 89A4 A2A0 C70B 1A8F

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Debian 4.0 and mmap_min_addr null pointer dereference flaw

2009-11-04T09:47:58Z

>
> presumably you mean
>
> vm.mmap_min_addr = 4096
>
> not
>
> echvm.mmap_min_addr = 4096
>
> ?
>
> micah
>

Hi Micah,

Yes sorry about that. I meant to write vm.mmap_min_addr
but I quoted from the Debian wiki which showed
how to change the value for echvm.mmap_min_addr

I am a noob and haven't had experience with sysctl tuning so my head is sort of
spinning here.

Thanks!

John

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Debian 4.0 and mmap_min_addr null pointer dereference flaw

2009-11-04T09:38:01Z

On Wed, Nov 04, 2009 at 09:24:55AM -0800, john wrote:
> On Wed, Nov 4, 2009 at 9:15 AM, Dominic Hargreaves <dom@...> wrote:

> > The mmap_min_addr tuneabout was not introduced until after 2.6.18,
> > which is the default etch kernel. I am using the 'etchnhalf' kernel
> > (linux-image-2.6.24-etchnhalf*) on an etch machine, partly since it
> > offers this protection.

> So would
>
> sudo apt-get install linux-image-2.6.24-etchnhalf.1-686
>
> be the right approach here?

Assuming you would normally run a 686 flavour kernel, yes.

Note that you would have to check that your hardware was compatible
with 2.6.24.

See http://www.debian.org/releases/etch/etchnhalf

for more details and limitations of this approach.

Note also that as with any security-related advice, don't just trust
what I say; do some independent research to validate my claims. I
take no responsibilty for the security of your system by offering this
advice.

Cheers,
Dominic.

--
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Debian 4.0 and mmap_min_addr null pointer dereference flaw

2009-11-04T09:36:19Z

On Wed, Nov 04, 2009 at 09:24:55AM -0800, john wrote:

> On Wed, Nov 4, 2009 at 9:15 AM, Dominic Hargreaves <dom@...> wrote:
> > On Wed, Nov 04, 2009 at 09:05:20AM -0800, john wrote:
> >> I see that there is another null pointer dereference flaw being talked about.
> >> http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
> >>
> >> It looks like we can take step in Debian 5.0 to mitigate this threat by setting
> >> echvm.mmap_min_addr = 4096
> >>
> >> per http://wiki.debian.org/mmap_min_addr
> >>
> >> I am running some servers running Debian 4.0. I doesn't look like
> >> there is a /etc/sysctl.d/mmap_min_addr.conf to edit. Where are these
> >> values stored
> >> under Debian 4.0.
> >>
> >> What is the right way to proceed? Should I be looking at upgrading my servers?
> >
> > The mmap_min_addr tuneabout was not introduced until after 2.6.18,
> > which is the default etch kernel. I am using the 'etchnhalf' kernel
> > (linux-image-2.6.24-etchnhalf*) on an etch machine, partly since it
> > offers this protection.
> >
> Thanks Dominic,
>
> So would
>
> sudo apt-get install linux-image-2.6.24-etchnhalf.1-686
>
> be the right approach here?

A combination of that and the mmap_min_addr.conf file would do the trick.

--
dann frazier

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Debian 4.0 and mmap_min_addr null pointer dereference flaw

2009-11-04T09:31:36Z

Quoting john (lists.john@...):

> I see that there is another null pointer dereference flaw being talked about.
> http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
>
> It looks like we can take step in Debian 5.0 to mitigate this threat by setting
> echvm.mmap_min_addr = 4096
>
> per http://wiki.debian.org/mmap_min_addr
>
> I am running some servers running Debian 4.0. I doesn't look like
> there is a /etc/sysctl.d/mmap_min_addr.conf to edit. Where are these
> values stored
> under Debian 4.0.

John, I believe you can/should just put

vm.mmap_min_addr = 4096

at the bottom of /etc/sysctl.conf, and then re-run (as root) "sysctl -p"
to load values from that file. You can verify that the appropriate
/proc value has been set by doing

cat /proc/sys/vm/mmap_min_addr

Should now be "4096", rather than the distro default of "0".

As you know, BitBake, dosemu (run by non-root users), WINE (if running
Win16 apps), and qemu are the applications thus far identified that need
to be able to mmap to low memory addresses, necessitating low
vm.mmap_min_addr AKA /proc/sys/vm/mmap_min_addr values.

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Debian 4.0 and mmap_min_addr null pointer dereference flaw

2009-11-04T09:24:55Z

On Wed, Nov 4, 2009 at 9:15 AM, Dominic Hargreaves <dom@...> wrote:

> On Wed, Nov 04, 2009 at 09:05:20AM -0800, john wrote:
>> I see that there is another null pointer dereference flaw being talked about.
>> http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
>>
>> It looks like we can take step in Debian 5.0 to mitigate this threat by setting
>> echvm.mmap_min_addr = 4096
>>
>> per http://wiki.debian.org/mmap_min_addr
>>
>> I am running some servers running Debian 4.0. I doesn't look like
>> there is a /etc/sysctl.d/mmap_min_addr.conf to edit. Where are these
>> values stored
>> under Debian 4.0.
>>
>> What is the right way to proceed? Should I be looking at upgrading my servers?
>
> The mmap_min_addr tuneabout was not introduced until after 2.6.18,
> which is the default etch kernel. I am using the 'etchnhalf' kernel
> (linux-image-2.6.24-etchnhalf*) on an etch machine, partly since it
> offers this protection.
>

Thanks Dominic,

So would

sudo apt-get install linux-image-2.6.24-etchnhalf.1-686

be the right approach here?

John
> --
> Dominic Hargreaves | http://www.larted.org.uk/~dom/
> PGP key 5178E2A5 from the.earth.li (keyserver,web,email)
>

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Debian 4.0 and mmap_min_addr null pointer dereference flaw

2009-11-04T09:23:23Z

On Wed, Nov 04, 2009 at 09:05:20AM -0800, john wrote:

> Hello all,
>
> I see that there is another null pointer dereference flaw being talked about.
> http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/
>
> It looks like we can take step in Debian 5.0 to mitigate this threat by setting
> echvm.mmap_min_addr = 4096
>
> per http://wiki.debian.org/mmap_min_addr
>
> I am running some servers running Debian 4.0. I doesn't look like
> there is a /etc/sysctl.d/mmap_min_addr.conf to edit. Where are these
> values stored
> under Debian 4.0.

There isn't a pre-existing mmap_min_addr.conf, you need to create it.
You can view the current value in /proc:

# cat /proc/sys/vm/mmap_min_addr

> What is the right way to proceed? Should I be looking at upgrading my servers?
>
> Thanks!
>
> John
>
>

--
dann frazier

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: Debian 4.0 and mmap_min_addr null pointer dereference flaw

2009-11-04T09:15:35Z

On Wed, Nov 04, 2009 at 09:05:20AM -0800, john wrote:

The mmap_min_addr tuneabout was not introduced until after 2.6.18,
which is the default etch kernel. I am using the 'etchnhalf' kernel
(linux-image-2.6.24-etchnhalf*) on an etch machine, partly since it
offers this protection.

--
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Debian 4.0 and mmap_min_addr null pointer dereference flaw

2009-11-04T09:05:20Z

Hello all,

I see that there is another null pointer dereference flaw being talked about.
http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability/

It looks like we can take step in Debian 5.0 to mitigate this threat by setting
echvm.mmap_min_addr = 4096

per http://wiki.debian.org/mmap_min_addr

I am running some servers running Debian 4.0. I doesn't look like
there is a /etc/sysctl.d/mmap_min_addr.conf to edit. Where are these
values stored
under Debian 4.0.

What is the right way to proceed? Should I be looking at upgrading my servers?

Thanks!

John

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

to: Henri Salvo

2009-11-04T08:34:11Z

Hi,

I tried to send a copy of the file to you but got the following error:

henri@...
SMTP error from remote mail server after RCPT TO:<henri@...>:
host kiwai.nerv.fi [213.157.65.70]: 554 5.7.1 Service unavailable; Client host [64.222.186.12] blocked using dnsbl.dronebl.org

-  
When a machine begins to run without human aid, it is time to scrap it -
whether it be a factory or a government.  ~Alexander Chase

Re: dt_ssh5

2009-11-04T07:24:43Z

On Wed, 04 Nov 2009 09:30:35 -0500
Bernie Dolan <bd3@...> wrote:

> Hi,
> I recently became aware of the executable:
> dt_ssh5
> in my /tmp subdirectory.
>
> Seems this is a botnet that is trying brute force attacks from my
> server. Has anybody else seen this?
>
> Thanks for the prompt response.
>
>
> -
> When a machine begins to run without human aid, it is time to scrap
> it - whether it be a factory or a government. ~Alexander Chase

Yes, for example grumpy bsd guy as you can see from:
<http://bsdly.blogspot.com/2009/10/third-time-uncharmed.html>. Could
you email me the file, thanks?

---
Henri Salo

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

dt_ssh5

2009-11-04T06:30:35Z

Hi,
I recently became aware of the executable:
dt_ssh5
in my /tmp subdirectory.

Seems this is a botnet that is trying brute force attacks from my server. Has anybody else seen this?

Thanks for the prompt response.

-  
When a machine begins to run without human aid, it is time to scrap it -
whether it be a factory or a government.  ~Alexander Chase

Please test pidgin update

2009-11-02T11:08:15Z

I've prepared updated packages for pidgin fixing CVE-2009-3615.
However, I need testers who actually use ICQ. Packages are available
at http://people.debian.org/~jmm/ for amd64 and i386. Please send
feedback directly to jmm@...

Cheers,
Moritz

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Venha participar de Pequenos Empreendedores & Grandes Negócios!

2009-10-31T15:50:06Z

Network Email

Entre em Pequenos Empreendedores & Grandes Negócios

Aqui o pequeno empreendedor tem vez! Acesse www.aprumar.webs.com e conheça!

paulo zambroza tem:

12 amigos
14 fotos
1 evento
11 videos
3 tópicos
1 postagem no blog

Entre e conheça essa oportunidade!

Clique para Entrar

Membros em Pequenos Empreendedores & Grandes Negócios:

MARA MACIEL

Antonio Carlos Arruda Oliveira

Zeka Albuquerque

CESAR COSTA

Eliana

Sobre Pequenos Empreendedores & Grandes Negócios

Não lemos pequenas empresas & grandes negocios mas fazemos bons negocios! Acesse www.aprumar.webs.com e saiba mais!

16 membros
15 fotos

11 videos

Para controlar os emails que você receberá em Pequenos Empreendedores & Grandes Negócios, clique aqui

RE: [SECURITY] [DSA 1923-1] New libhtml-parser-perl packages fix denial of service

2009-10-29T23:37:11Z

-----Original Message-----
From: Nico Golde <nion@...>
Sent: vrijdag 30 oktober 2009 2:17
To: debian-security-announce@... <debian-security-announce@...>
Subject: [SECURITY] [DSA 1923-1] New libhtml-parser-perl packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA-1923-1 security@...
http://www.debian.org/security/ Nico Golde
October 27th, 2009 http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package : libhtml-parser-perl
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
Debian bug : #552531
CVE ID : CVE-2009-3627

A denial of service vulnerability has been found in libhtml-parser-perl,
a collection of modules to parse HTML in text documents which is used by
several other projects like e.g. SpamAssassin.

Mark Martinec discovered that the decode_entities() function will get stuck
in an infinite loop when parsing certain HTML entities with invalid UTF-8
characters. An attacker can use this to perform denial of service attacks
by submitting crafted HTML to an application using this functionality.

For the oldstable distribution (etch), this problem has been fixed in
version 3.55-1+etch1.

For the stable distribution (lenny), this problem has been fixed in
version 3.56-1+lenny1.

For the testing (squeeze) and unstable (sid) distribution, this problem
will be fixed soon.

We recommend that you upgrade your libhtml-parser-perl packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55.orig.tar.gz
Size/MD5 checksum: 84746 75eb683f1fb7aa7c0ffa46ded4564b54
http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.diff.gz
Size/MD5 checksum: 6136 8c713a84e3df953ae77d83d9f2cff5bc
http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.dsc
Size/MD5 checksum: 882 0f38d699bda26190ea4764aa74eac2c8

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_alpha.deb
Size/MD5 checksum: 108540 a6d69a440e25b3d3b4e9c5057f6b6908

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_amd64.deb
Size/MD5 checksum: 108168 ddafcee82387004c4d55a39a8ca54eb6

arm architecture (ARM)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_arm.deb
Size/MD5 checksum: 106962 9842d5bc00c6b308d01fae6d20676e9e

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_hppa.deb
Size/MD5 checksum: 109602 2d4a2d3ff134cfdd70135e71caf9043a

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_i386.deb
Size/MD5 checksum: 108032 b542502d5b1d4fff66c2d730e8c02790

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_ia64.deb
Size/MD5 checksum: 117524 ce065d8d05996cdc4c436104b578ed0a

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mips.deb
Size/MD5 checksum: 106518 25feabc68e1aa4aff02b6aff00a2a9df

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mipsel.deb
Size/MD5 checksum: 105742 17a4f0fafa183a3794fad636e4e26ce4

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_powerpc.deb
Size/MD5 checksum: 106504 beb784e9d723ba717d207c6e9c58414b

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_s390.deb
Size/MD5 checksum: 106630 1de105f77b55dd920dbfccb7712e3dc1

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_sparc.deb
Size/MD5 checksum: 106222 bd1cd736644c4f2dceb76cc5192f18d0

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.diff.gz
Size/MD5 checksum: 6147 18b2407d8b26d6225b82a880b16a0e05
http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.dsc
Size/MD5 checksum: 1316 5a923d6089e2ffddf050ea5b017a7956
http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56.orig.tar.gz
Size/MD5 checksum: 86040 bddc432e5ed9df4d4153a62234f04fc2

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_alpha.deb
Size/MD5 checksum: 111160 928145a65d633d76bf3db6a42bcf9173

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_amd64.deb
Size/MD5 checksum: 111614 9152d47982c212aa1ee9ec8d6293c97e

arm architecture (ARM)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_arm.deb
Size/MD5 checksum: 109442 e559abada6a045e2a8d51b1c54a89655

armel architecture (ARM EABI)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_armel.deb
Size/MD5 checksum: 109388 47e0480a189e752018d27ffb4b19d9e1

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_hppa.deb
Size/MD5 checksum: 112026 52d258a94e332f7f1c527ae0c47d77d6

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_i386.deb
Size/MD5 checksum: 109680 da9426f29d77127b954a77263a5b7665

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_ia64.deb
Size/MD5 checksum: 121744 90933c7e204254b4c308424af76917b2

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_mips.deb
Size/MD5 checksum: 109378 f46f9971f7d22fe40a1d15cc224cdc70

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_mipsel.deb
Size/MD5 checksum: 109870 af19cea178841be6c1fc658cac4c468d

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_powerpc.deb
Size/MD5 checksum: 112450 1a2d490c6120185ec0cbddc2bb73e792

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_s390.deb
Size/MD5 checksum: 110958 2f21853d729b141554b39132ecf21f5c

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_sparc.deb
Size/MD5 checksum: 108682 a1831a4919f5c7b30eab0def292928b5

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkrqO5QACgkQHYflSXNkfP8jYACgkATgE0BJ4ndT4SUaOhI8Qg0w
gpkAnAzu0Jnb9nHUe/46Ggi7CdwAoApn
=q4EB
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: [#17089802] [SECURITY] [DSA 1923-1] New libhtml-parser-perl packages fix denial of service

2009-10-29T18:20:54Z

Hei!

Olen parhaillaan syyslomalla ja luen seuraavan kerran sähköpostejani 9.11.2009. Kiireellisissä asioissa voit olla yhteydessä Juha-Pekka Järvenpäähän, juha-pekka.jarvenpaa@... / 09-6829 3012.

--

Ystävällisin terveisin,
Joel Pihlajamaa

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: [SECURITY] [DSA 1921-1] New expat packages fix denial of service

2009-10-29T12:36:34Z

Steffen Joeris napsal(a):
> On Thu, 29 Oct 2009 04:21:43 am Zdenek Kaspar wrote:
>> Hi, why is this update missing on amd64/lenny ?
>>
> Because it was not yet available by the time of the release and will be made
> available as soon as possible.
>
> Cheers
> Steffen

OK, just noticed it's there now.

Get package files.
[ 47%] Getting:
pool/updates/main/e/expat/expat_2.0.1-4+lenny1_amd64.deb... ok
[ 50%] Getting:
pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny1_amd64.deb... ok
[ 81%] Getting:
pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny1_amd64.deb... ok
Downloaded 708 kiB in 7s at 101.21 kiB/s.

Thanks Z.

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

To run several daemons under normal users.

2009-10-29T04:29:34Z

Good day.

I want to run the following list of daemons under normal user - for security
reasons:

saslauthd, couriertcpd, courierpop3login, authdaemond, spamd, logger

could You please share Your opinion on how I can do that - as it is not clear
from its running scripts where to specify it?

Thank You for Your time.

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: [SECURITY] [DSA 1919-1] New smarty packages fix several vulnerabilities

2009-10-29T00:00:27Z

SHIT

Am 25.10.2009 um 17:24 schrieb Thijs Kinkhorst:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> -
> ------------------------------------------------------------------------
> Debian Security Advisory DSA-1919-1 security@...
> http://www.debian.org/security/ Thijs
> Kinkhorst
> October 25, 2009 http://www.debian.org/security/faq
> -
> ------------------------------------------------------------------------
>
> Package : smarty
> Vulnerability : several
> Problem type : remote
> Debian-specific: no
> CVE Id(s) : CVE-2008-4810 CVE-2009-1669
> Debian Bug : 504328 529810
>
> Several remote vulnerabilities have been discovered in Smarty, a PHP
> templating engine. The Common Vulnerabilities and Exposures project
> identifies the following problems:
>
> CVE-2008-4810
>
> The _expand_quoted_text function allows for certain restrictions in
> templates, like function calling and PHP execution, to be bypassed.
>
> CVE-2009-1669
>
> The smarty_function_math function allows context-dependent attackers
> to execute arbitrary commands via shell metacharacters in the
> equation
> attribute of the math function.
>
> For the old stable distribution (etch), these problems have been fixed
> in version 2.6.14-1etch2.
>
> For the stable distribution (lenny), these problems have been fixed in
> version 2.6.20-1.2.
>
> For the unstable distribution (sid), these problems will be fixed
> soon.
>
> We recommend that you upgrade your smarty package.
>
> Upgrade instructions
> - --------------------
>
> wget url
> will fetch the file for you
> dpkg -i file.deb
> will install the referenced file.
>
> If you are using the apt-get package manager, use the line for
> sources.list as given below:
>
> apt-get update
> will update the internal database
> apt-get upgrade
> will install corrected packages
>
> You may use an automated update by adding the resources from the
> footer to the proper configuration.
>
> Debian GNU/Linux 4.0 alias etch
> - -------------------------------
>
> Source archives:
>
> http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1etch2.dsc
> Size/MD5 checksum: 958 f061c466cef93df89e677aeb72101910
> http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14.orig.tar.gz
> Size/MD5 checksum: 144986 9186796ddbc29191306338dea9d632a0
> http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1etch2.diff.gz
> Size/MD5 checksum: 4290 0ef9a669c127818f5ff084e2829738e9
>
> Architecture independent packages:
>
> http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1etch2_all.deb
> Size/MD5 checksum: 183300 d0ac954aad344f20b5933b09593b2968
>
> Debian GNU/Linux 5.0 alias lenny
> - --------------------------------
>
> Source archives:
>
> http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1.2.dsc
> Size/MD5 checksum: 1409 f280e2733ef52ff621891f99b26386f3
> http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1.2.diff.gz
> Size/MD5 checksum: 4876 4d729d18d7efe68e1ce3023149436c01
> http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20.orig.tar.gz
> Size/MD5 checksum: 158091 35f405b2418a26a895302a2ce5bf89d2
>
> Architecture independent packages:
>
> http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1.2_all.deb
> Size/MD5 checksum: 204412 1e8e85b298b97176359dd15731e0dc88
>
>
> These files will probably be moved into the stable distribution on
> its next update.
>
> -
> ---------------------------------------------------------------------------------
> For apt-get: deb http://security.debian.org/ stable/updates main
> For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/
> updates/main
> Mailing list: debian-security-announce@...
> Package info: `apt-cache show <pkg>' and http://packages.debian.org/
> <pkg>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
>
> iQEcBAEBAgAGBQJK5HuJAAoJECIIoQCMVaAc41oH/iXgblL5cfzH4wujl26DrEmd
> 8ivwmMDdRzd6zio60VtRgbLFfDa1nvByavfJYbJSgjkphbf4qXMxNVVRxp0z9laT
> fg7gkytG9KXXiqvhxz8NrzCGg7v0jmOorATYCamFEUgKg9d+sXy2/bIpO3xN1txU
> Wvub7/q3n8DUg3go7kPMCC5euzaB0Fs0fq6zzWuRcKW640bMiOyNq6n/kvTICv3x
> 4Yv+PIj1KbXgz/R45+QtyQGibJzj3XWTL5DpRNe1fH8uUQ4sqKCyKDsaayrOXa0w
> Y0wkZ3IEmbOpe1UmUB57kAVSzfRAicFOGRJmXunni/tBs2ivBL27P7F/dMKYAQg=
> =EBks
> -----END PGP SIGNATURE-----
>
>
> --
> To UNSUBSCRIBE, email to debian-security-announce-REQUEST@...
> with a subject of "unsubscribe". Trouble? Contact listmaster@...
>

--
<e>werk, Gesellschaft für neue Medien mbH
Langenstr. 75, D-28195 Bremen
Registergericht Bremen - HRB 18561
Geschäftsführung: Dipl.-Ing. Jens Zippel
Phone: +49 (0)421 33513-60
Fax: +49 (0)421 33513-65
e-mail: office@...
http://www.ewerk.de

Axel Ahrens, e-mail: ahrens@...
Phone: +49 (0)421 33513-82

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: [SECURITY] [DSA 1921-1] New expat packages fix denial of service

2009-10-28T14:35:41Z

On Thu, 29 Oct 2009 04:21:43 am Zdenek Kaspar wrote:
> Hi, why is this update missing on amd64/lenny ?
>
Because it was not yet available by the time of the release and will be made
available as soon as possible.

Cheers
Steffen

signature.asc (205 bytes) Download Attachment

Re: [SECURITY] [DSA 1921-1] New expat packages fix denial of service

2009-10-28T10:21:43Z

Hi, why is this update missing on amd64/lenny ?

--
To UNSUBSCRIBE, email to debian-security-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

Re: [#54324561] [SECURITY] [DSA 1921-1] New expat packages fix denial of service

2009-10-28T02:52:26Z