-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : gtkhtml SUMMARY : Buffer overflow vulnerability DATE : 2003-09-12 10:13:00 ID : CLA-2003:737 RELEVANT RELEASES : 7.0, 8, 9 - ------------------------------------------------------------------------- DESCRIPTION The gtkhtml library is used by Evolution and other Gnome programs to render basic HTML. Evolution is a Gnome-based personal information manager (PIM) which includes e-mail, address book, calendar and other integrated features. Alan Cox discovered two vulnerabilities (CAN-2003-0541[1] and CAN-2003-0133[2]) in the gtkhtml library. These vulnerabilities can be exploited to at least crash programs linked to gtkhtml by using malformed HTML. In the case of Evolution, a remote attacker can use an HTML mail as an attack vector. This update includes fixes for both vulnerabilities. Please note that the second one (CAN-2003-0133) affects only the gtkhtml version distributed with Conectiva Linux 9. SOLUTION All users should upgrade. Please note that in order to load the fixed library, it is necessary to restart all applications linked to it after the upgrade. REFERENCES: 1.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0541 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0133 UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/7.0/RPMS/gtkhtml-1.0.1-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/gtkhtml-devel-1.0.1-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/gtkhtml-devel-static-1.0.1-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/gtkhtml-1.0.1-1U70_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/gtkhtml-1.0.1-4U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/gtkhtml-devel-1.0.1-4U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/gtkhtml-devel-static-1.0.1-4U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/libgtkhtml20-1.0.1-4U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/libgtkhtml-i18n-1.0.1-4U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/SRPMS/gtkhtml20-1.0.1-4U80_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/gtkhtml-1.1.9-20744U90_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/gtkhtml-devel-1.1.9-20744U90_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/gtkhtml-devel-static-1.1.9-20744U90_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libgtkhtml20-1.1.9-20744U90_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libgtkhtml-i18n-1.1.9-20744U90_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/SRPMS/gtkhtml20-1.1.9-20744U90_2cl.src.rpm ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades: - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- Copyright (c) 2003 Conectiva Inc. http://www.conectiva.com - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE/Ycac42jd0JmAcZARAkZ6AKDqA0iGRhbOTQfeTOOW6Wznb/3BTwCfd5/R 5ELIWnhywh2AITpzYVaDxDI= =/U3Y -----END PGP SIGNATURE-----
