-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 680-1 security@xxxxxxxxxx http://www.debian.org/security/ Martin Schulze February 14th, 2005 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : htdig Vulnerability : unsanitised input Problem-Type : remote Debian-specific: no CVE ID : CAN-2005-0085 Michael Krax discovered a cross site scripting vulnerability in ht://dig, a web search system for an intranet or small internet. For the stable distribution (woody) this problem has been fixed in version 3.1.6-3woody1. For the unstable distribution (sid) this problem has been fixed in version 3.1.6-11. We recommend that you upgrade your htdig package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1.dsc Size/MD5 checksum: 591 e5fd50b03893bda0bb43aa6a54beacc4 http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1.diff.gz Size/MD5 checksum: 19822 294cfc471ac36e7cc3ade8e8ab2a968c http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6.orig.tar.gz Size/MD5 checksum: 2068675 7a2f20d8d6149efd8d119bb2ebf55f23 Architecture independent components: http://security.debian.org/pool/updates/main/h/htdig/htdig-doc_3.1.6-3woody1_all.deb Size/MD5 checksum: 316892 3c2f6462e01ace0097a9351c1a98ca39 Alpha architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_alpha.deb Size/MD5 checksum: 1103690 e5a883a1619d22da9598f66c53ab28ee ARM architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_arm.deb Size/MD5 checksum: 1009600 98ccc3af2d25970b7cff9a5451b045e5 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_i386.deb Size/MD5 checksum: 950526 3557095a60b11ef24bff9634778107fc Intel IA-64 architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_ia64.deb Size/MD5 checksum: 1216768 840c06cf1b6c405ab24bc20a7d41bdd4 HP Precision architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_hppa.deb Size/MD5 checksum: 1155976 345dc883031bc10c10b7ac4743d2a679 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_m68k.deb Size/MD5 checksum: 921906 82f8f0dd287a78856179f29ea1161489 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_mips.deb Size/MD5 checksum: 992524 e5b1c3054332a4f92cecae9c888bff8b Little endian MIPS architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_mipsel.deb Size/MD5 checksum: 989954 d4e2b19ad21431118fbb4a1ccdc46a24 PowerPC architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_powerpc.deb Size/MD5 checksum: 937060 7841f5423965ce1f2afbff9c0054182a IBM S/390 architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_s390.deb Size/MD5 checksum: 910122 939faa17e33b38585ab518c21751a171 Sun Sparc architecture: http://security.debian.org/pool/updates/main/h/htdig/htdig_3.1.6-3woody1_sparc.deb Size/MD5 checksum: 914470 85ceb822a4e3b1906c9e97ea01192c9c These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) iD8DBQFCELPiW5ql+IAeqTIRAmxqAJ9Ds1+DQqfsJQsKjokt7Z29tuDROACfWi1V KIQOaXHbWBAWiQLsBPJxd2g= =BSJ4 -----END PGP SIGNATURE-----
