-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1333 security@xxxxxxxxxx http://www.debian.org/security/ Steve Kemp July 18th, 2007 - ------------------------------------------------------------------------ Package : libcurl3-gnutls Vulnerability : input validation Problem type : local and remote Debian-specific: no CVE Id(s) : CVE-2007-3564 It has been discovered that the GnuTLS certificate verification methods implemented in libcurl-gnutls, a solid, usable, and portable multi-protocol file transfer library, did not check for expired or invalid dates. For the stable distribution (etch), this problem has been fixed in version 7.15.5-1etch1. We recommend that you upgrade your libcurl3-gnutls package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - -------------------------------- Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1.dsc Size/MD5 checksum: 948 1eacdb0c127ad12b860033f743563df8 http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5.orig.tar.gz Size/MD5 checksum: 1897973 61997c0d852d38c3a85b445f4fc02892 http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1.diff.gz Size/MD5 checksum: 19029 cbd30d40f3026e020182e665a7f5d5be Architecture independent packages: http://security.debian.org/pool/updates/main/c/curl/libcurl3-dev_7.15.5-1etch1_all.deb Size/MD5 checksum: 22198 b6b9a429b9ae513c5e0c8472c6509907 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_alpha.deb Size/MD5 checksum: 811542 dbc6cd819cff1b717c46e11caa1dd331 http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_alpha.deb Size/MD5 checksum: 815608 03e1eb1961a7e58e82e4ac2380aa8c8a http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_alpha.deb Size/MD5 checksum: 181660 30c703c8b17a42b63d2fbe575bafe562 http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_alpha.deb Size/MD5 checksum: 823850 23eb2600b1da596a04bfd5043effc13d http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_alpha.deb Size/MD5 checksum: 166814 7a9f90444bd58d38c9452a44ff71ea98 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_alpha.deb Size/MD5 checksum: 175316 0167fc5805b8f8c363165dff64dafe98 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_amd64.deb Size/MD5 checksum: 772978 675235b32ac91f3b91f86ee28e70d1e2 http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_amd64.deb Size/MD5 checksum: 824246 a0547976a45ee4d4be2c43b179459404 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_amd64.deb Size/MD5 checksum: 767648 4852d415582c564eb50cb9f8cbc677f7 http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_amd64.deb Size/MD5 checksum: 170008 ff8b0b14022f291265324243579abf2d http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_amd64.deb Size/MD5 checksum: 164638 ae44174a768af4786637cb6292800b21 http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_amd64.deb Size/MD5 checksum: 163440 c7410d7b8efc16abf1e138c1bb7a5712 arm architecture (ARM) http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_arm.deb Size/MD5 checksum: 162094 001980ca743312ca37513877ad7d19f6 http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_arm.deb Size/MD5 checksum: 164634 436490a717543532135cfaafb4fb4a99 http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_arm.deb Size/MD5 checksum: 757356 3a74f9c27504a758b95dfb6ba5fb96a3 http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_arm.deb Size/MD5 checksum: 782328 40e1890d559f3efb927af1d0bc0c8c6e http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_arm.deb Size/MD5 checksum: 750218 82456f7c8a985993fd50eb482f715a70 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_arm.deb Size/MD5 checksum: 159216 183adf1413dc30aab0e80c96e8b07d69 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_hppa.deb Size/MD5 checksum: 164460 cb4b604568f5f67d219f42423a3871e5 http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_hppa.deb Size/MD5 checksum: 183728 04b0a53a277f70ca365662ea80956012 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_hppa.deb Size/MD5 checksum: 177964 4e5610dee599cff8118ee190db9a632d http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_hppa.deb Size/MD5 checksum: 792842 1bdbcbc1a90f533c7a4937c61eb07097 http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_hppa.deb Size/MD5 checksum: 811428 5028f1eb54b2eae003f97f38b06ee31e http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_hppa.deb Size/MD5 checksum: 786392 41a0d16e111efa9b7693b2ff4b49aae2 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_i386.deb Size/MD5 checksum: 759318 e028af09b03561cf80fba28e667619cc http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_i386.deb Size/MD5 checksum: 797370 61890674b4ca3d63025aec44330d018a http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_i386.deb Size/MD5 checksum: 163196 c4826f28c035963ba7c78bbf02e598fc http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_i386.deb Size/MD5 checksum: 765284 dbb49ba6646ccf3b0545246d221727f6 http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_i386.deb Size/MD5 checksum: 162952 13ee79189c41390d6123d9f2eceb43d6 http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_i386.deb Size/MD5 checksum: 168268 abfd5346cf785ff3c3575e0ff5f45fd3 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_ia64.deb Size/MD5 checksum: 217322 60b9e2ed439e2d25efd0a938fed85631 http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_ia64.deb Size/MD5 checksum: 174406 3b2820551a8f73b6d0d2fd618611aa8d http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_ia64.deb Size/MD5 checksum: 847688 3067d35de833b8fc16bcbac066105fab http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_ia64.deb Size/MD5 checksum: 225286 33446e0073372cbf66d2478d931b4c20 http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_ia64.deb Size/MD5 checksum: 811428 29c7c73f506b810299b99ec4aa546d23 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_ia64.deb Size/MD5 checksum: 837622 0539dc6328d28d866c60aabcc9a54c77 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_mipsel.deb Size/MD5 checksum: 809808 74fb469f9dede8bc34e48a4a539e4358 http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_mipsel.deb Size/MD5 checksum: 163986 df1acd593c0eeed9a18c3ed8a8a0549e http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_mipsel.deb Size/MD5 checksum: 791042 3608d4164968ecf0eb5761ccfa981efb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_mipsel.deb Size/MD5 checksum: 783344 5f6956f17a95ffa849c83847ca68125a http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_mipsel.deb Size/MD5 checksum: 165370 2ff41d7e7856497bb33aaf1c42d0cc20 http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_mipsel.deb Size/MD5 checksum: 170278 8d0e09a0bdaf30cd225e59d381c6966a powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_powerpc.deb Size/MD5 checksum: 165070 a2a95f8b931dd24659e6c17ae6de57e0 http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_powerpc.deb Size/MD5 checksum: 840286 670575e9107d1665d0123d5b034b09c3 http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_powerpc.deb Size/MD5 checksum: 780710 f63c169d7ac0a594415ce06fc554d03a http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_powerpc.deb Size/MD5 checksum: 173628 2ef64672347d6ec0f710bfc3c68fb188 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_powerpc.deb Size/MD5 checksum: 168912 2b05b6937b6c6bb567e9d77dc1d13ea2 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_powerpc.deb Size/MD5 checksum: 773612 4292b8d1c968c17817ccd36149ddbc20 s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_s390.deb Size/MD5 checksum: 835496 199f0660bb88bf2b5f8572209c4bbcaa http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_s390.deb Size/MD5 checksum: 163122 4c84c66f773accf9da6e6585edcedcc7 http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_s390.deb Size/MD5 checksum: 773100 10a17910d3a30b7de38a138fd6c3e299 http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_s390.deb Size/MD5 checksum: 179504 e83ac479b8e9c5011e28db1f4d58fa14 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_s390.deb Size/MD5 checksum: 768068 67cbdd360ed1dbb80824bb6738787c95 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_s390.deb Size/MD5 checksum: 172214 c187f5108f5a977f08abf0b4e37471e0 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_sparc.deb Size/MD5 checksum: 165032 18e35286ceb1129fbbe7fa1be094c59d http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_sparc.deb Size/MD5 checksum: 758474 e5f75c8f4491dd628fa9005e4dfc5cbb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_sparc.deb Size/MD5 checksum: 159890 69c90d7c3aaa79021cfa2ee5ca0c8ca7 http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_sparc.deb Size/MD5 checksum: 162360 de5df99405d29124dcd4b70e3aa60bf7 http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_sparc.deb Size/MD5 checksum: 765156 963dd337e581b69c4663ade85a44755d http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_sparc.deb Size/MD5 checksum: 787450 2ed6fb01f7babf43d9bf04aac8ed79d5 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFGnnLYwM/Gs81MDZ0RAqEMAJ9SVwtkRq4InvjE1WxoZhNuNuBBMwCfTYFF UsgKwdu++50iJM4A+60bNxs= =ncFi -----END PGP SIGNATURE-----
