Alerta de Segurança Debian

DSA-331-1 imagemagick -- arquivo temporário inseguro

Data do Alerta:
27 Jun 2003
Pacotes Afetados:
imagemagick
Vulnerável:
Sim
Referência à base de dados de segurança:
Na base de dados do BugTraq (na SecurityFocus): ID BugTraq 8057.
No dicionário CVE do Mitre: CVE-2003-0455.
Informações adicionais:

A biblioteca libmagick do imagemagick, sob certas circunstâncias, cria arquivos temporários sem tomar as devidas precauções de segurança. Esta vulnerabilidade pode ser explorada por um usuário local para criar ou sobreescrever arquivos com o privilégio de outro usuário que está invocando um programa que use esta biblioteca.

Na atual distribuição estável (woody), este problema foi corrigido na versão 4:5.4.4.5-1woody1.

Na distribuição instável (sid), este problema foi corrigido na versão 4:5.5.7-1.

Nós recomendamos que você atualize seus pacotes imagemagick.

Corrigido em:

Debian GNU/Linux 3.0 (woody)

Fonte:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1.dsc
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1.diff.gz
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_alpha.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_arm.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_i386.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_ia64.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_hppa.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_m68k.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_mips.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_mipsel.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_powerpc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_s390.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/i/imagemagick/imagemagick_5.4.4.5-1woody1_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5_5.4.4.5-1woody1_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick++5-dev_5.4.4.5-1woody1_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5_5.4.4.5-1woody1_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/libmagick5-dev_5.4.4.5-1woody1_sparc.deb
http://security.debian.org/pool/updates/main/i/imagemagick/perlmagick_5.4.4.5-1woody1_sparc.deb

Checksums MD5 dos arquivos listados estão disponíveis no alerta original.