-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1220-1 security@xxxxxxxxxx http://www.debian.org/security/ Moritz Muehlenhoff November 26th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : pstotext Vulnerability : insecure file name quoting Problem-Type : local(remote) Debian-specific: no CVE ID : CVE-2006-5869 Debian Bug : 356988 Brian May discovered that pstotext, a utility to extract plain text from Postscript and PDF files, performs insufficient quoting of file names, which allows execution of arbitrary shell commands. For the stable distribution (sarge) this problem has been fixed in version 1.9-1sarge2. The build for the mipsel architecture is not yet available due to technical problems with the build host. For the upcoming stable distribution (etch) this problem has been fixed in version 1.9-4. For the unstable distribution (sid) this problem has been fixed in version 1.9-4. We recommend that you upgrade your pstotext package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2.dsc Size/MD5 checksum: 566 56e79abcf02e841e78267bda1faff734 http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2.diff.gz Size/MD5 checksum: 8857 4efb7277f17fca5ebd20573d93b11a83 http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9.orig.tar.gz Size/MD5 checksum: 37461 64576e8a10ff5514e285d98b3898ae78 Alpha architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_alpha.deb Size/MD5 checksum: 34218 57b121ba1a0f5d53412ab5587c611d68 AMD64 architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_amd64.deb Size/MD5 checksum: 33872 cc72441f0565d8225ae1e97a7df34a82 ARM architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_arm.deb Size/MD5 checksum: 32532 9a3cf4674a2632ac1742551cb27cbe39 HP Precision architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_hppa.deb Size/MD5 checksum: 34492 f8a9db92d0ad4d81d58fcc6e763faf47 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_i386.deb Size/MD5 checksum: 32864 13c32d5164243e60e2ef00878c973c2f Intel IA-64 architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_ia64.deb Size/MD5 checksum: 38038 dcfae670ad3dd9911d5085bcc177a8eb Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_m68k.deb Size/MD5 checksum: 31552 9dcd158543df00f1a13012647ec842bb Big endian MIPS architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_mips.deb Size/MD5 checksum: 34404 32922b44fef79abce8ca78587eb55453 PowerPC architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_powerpc.deb Size/MD5 checksum: 33636 75f0beb7494479f926c19a1f7e2b8297 IBM S/390 architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_s390.deb Size/MD5 checksum: 33218 096e0022136b767152d2da4a1563edc5 Sun Sparc architecture: http://security.debian.org/pool/updates/main/p/pstotext/pstotext_1.9-1sarge2_sparc.deb Size/MD5 checksum: 33246 5e47a79b9092cae3878294f49bf211c2 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFadZqXm3vHE4uyloRArdeAJ9kBR2UvMXUp4vvECEwsgx7/hKedgCgsjN9 7bAER5TTywq24RN50Z9BSfY= =92S1 -----END PGP SIGNATURE-----
