Updated netpbm packages are available for Red Hat Linux 7.3 and 9
-----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated netpbm resolves security vulnerabilities
Advisory ID: FLSA:1257
Issue date: 2004-10-08
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1257
CVE Names: CVE-2003-0924
-----------------------------------------------------------------------
-----------------------------------------------------------------------
1. Topic:
Updated netpbm packages that fix security vulnerabilities are now available.
The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps), and others.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
3. Problem description:
A number of temporary file bugs have been found in versions of NetPBM. These could make it possible for a local user to overwrite or create files as a different user who happens to run one of the the vulnerable utilities. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0924 to this issue.
Users are advised to upgrade to the erratum packages, which contain patches from Debian that correct these bugs.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.
Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs/ for directions on how to configure yum and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1257 - CAN-2003-0924: Temp file vuln in NetPBM
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/netpbm-9.24-9.73.
4.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-9.24-9.73.4
.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-devel-9.24-
9.73.4.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-progs-9.24-
9.73.4.legacy.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/netpbm-9.24-10.90.3
.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-9.24-10.90.3.
legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-devel-9.24-10
.90.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-progs-9.24-10
.90.3.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
---------------------------------------------------------------------------
79c8c3e9e4ef5c60eb0dd243b38775cb24c49e18 7.3/updates/SRPMS/netpbm-9.24-9.7
3.4.legacy.src.rpm
4a0e11ad855172ce86042d0f85991b6f28f4811b 7.3/updates/i386/netpbm-9.24-9.73
.4.legacy.i386.rpm
d69d449139408cf50de7557f38fd9f3a3f86b4c3 7.3/updates/i386/netpbm-devel-9.2
4-9.73.4.legacy.i386.rpm
173fa566ed92e222581817c4326b3dd501f24313 7.3/updates/i386/netpbm-progs-9.2
4-9.73.4.legacy.i386.rpm
729fd0be3b7f6ff031436cd8a563edbc57b76ad6 9/updates/SRPMS/netpbm-9.24-10.90
.3.legacy.src.rpm
ac5ee4489c0632057ef6d9844ad2c935e5754053 9/updates/i386/netpbm-9.24-10.90.
3.legacy.i386.rpm
0d59209ef7e8e4d7630d8f23c372f01adeddeea5 9/updates/i386/netpbm-devel-9.24-
10.90.3.legacy.i386.rpm
8076a88d1c299a80db24e7559d0ea6853e6520b9 9/updates/i386/netpbm-progs-9.24-
10.90.3.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v filename
If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command:
sha1sum filename
8. References:
http://www.kb.cert.org/vuls/id/487102
https://rhn.redhat.com/errata/RHSA-2004-031.html
9. Contact:
The Fedora Legacy security contact is secnotice@fedoralegacy.org. More project details at http://www.fedoralegacy.org
-----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated netpbm resolves security vulnerabilities
Advisory ID: FLSA:1257
Issue date: 2004-10-08
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1257
CVE Names: CVE-2003-0924
-----------------------------------------------------------------------
-----------------------------------------------------------------------
1. Topic:
Updated netpbm packages that fix security vulnerabilities are now available.
The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps), and others.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
3. Problem description:
A number of temporary file bugs have been found in versions of NetPBM. These could make it possible for a local user to overwrite or create files as a different user who happens to run one of the the vulnerable utilities. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0924 to this issue.
Users are advised to upgrade to the erratum packages, which contain patches from Debian that correct these bugs.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.
Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs/ for directions on how to configure yum and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1257 - CAN-2003-0924: Temp file vuln in NetPBM
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/netpbm-9.24-9.73.
4.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-9.24-9.73.4
.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-devel-9.24-
9.73.4.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-progs-9.24-
9.73.4.legacy.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/netpbm-9.24-10.90.3
.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-9.24-10.90.3.
legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-devel-9.24-10
.90.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-progs-9.24-10
.90.3.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
---------------------------------------------------------------------------
79c8c3e9e4ef5c60eb0dd243b38775cb24c49e18 7.3/updates/SRPMS/netpbm-9.24-9.7
3.4.legacy.src.rpm
4a0e11ad855172ce86042d0f85991b6f28f4811b 7.3/updates/i386/netpbm-9.24-9.73
.4.legacy.i386.rpm
d69d449139408cf50de7557f38fd9f3a3f86b4c3 7.3/updates/i386/netpbm-devel-9.2
4-9.73.4.legacy.i386.rpm
173fa566ed92e222581817c4326b3dd501f24313 7.3/updates/i386/netpbm-progs-9.2
4-9.73.4.legacy.i386.rpm
729fd0be3b7f6ff031436cd8a563edbc57b76ad6 9/updates/SRPMS/netpbm-9.24-10.90
.3.legacy.src.rpm
ac5ee4489c0632057ef6d9844ad2c935e5754053 9/updates/i386/netpbm-9.24-10.90.
3.legacy.i386.rpm
0d59209ef7e8e4d7630d8f23c372f01adeddeea5 9/updates/i386/netpbm-devel-9.24-
10.90.3.legacy.i386.rpm
8076a88d1c299a80db24e7559d0ea6853e6520b9 9/updates/i386/netpbm-progs-9.24-
10.90.3.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v filename
If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command:
sha1sum filename
8. References:
http://www.kb.cert.org/vuls/id/487102
https://rhn.redhat.com/errata/RHSA-2004-031.html
9. Contact:
The Fedora Legacy security contact is secnotice@fedoralegacy.org. More project details at http://www.fedoralegacy.org
