The following updates has been released for Debian 6 LTS:
[DLA 366-1] arts security update
[DLA 367-1] kdelibs security update
[DLA 366-1] arts security update
[DLA 367-1] kdelibs security update
[DLA 366-1] arts security update
Package : arts
Version : 1.5.9-3+deb6u1
CVE ID : CVE-2015-7543
It has been reported that arts uses the insecure mktemp() function
to create the temporary directory it uses to host user-specific sockets.
It is thus possible for another user to hijack this temporary directory
and gain IPC access it should not have.
In Debian 6 “Squeeze”, this issue has been addressed in arts
1.5.9-3+deb6u1 with the use of the safer mkdtemp() function.
We recommend that you upgrade your arts packages.
Other Debian releases do not have the arts package.
[DLA 367-1] kdelibs security update
Package : kdelibs
Version : 3.5.10.dfsg.1-5+deb6u1
CVE ID : CVE-2015-7543
It has been reported that kdelibs uses the insecure mktemp() function
to create the temporary directory it uses to host user-specific sockets.
It is thus possible for another user to hijack this temporary directory
and gain socket accesses it should not have.
In Debian 6 “Squeeze”, this issue has been addressed in kdelibs
3.5.10.dfsg.1-5+deb6u1 with the use of the safer mkdtemp() function.
We recommend that you upgrade your kdelibs packages.
Other Debian releases have newer versions of the libraries (kdelibs4) that
are not affected by this problem.
