16 Mai
2015
16 Mai
'15
18:44
apticron report [Sat, 16 May 2015 18:44:12 +0200]
========================================================================
apticron has detected that some packages need upgrading on:
baldrick.crans.org
[ 138.231.142.239 2a01:240:fe3d:4:62:61ff:fe6c:6401 138.231.142.239 ]
[ 2a01:240:fe3d:4:62:61ff:fe6c:6401 ]
The following packages are currently pending an upgrade:
libmodule-signature-perl 0.73-1+deb8u1
========================================================================
Package Details:
Lecture des fichiers de modifications (« changelog »)...
--- Modifications pour libmodule-signature-perl ---
libmodule-signature-perl (0.73-1+deb8u1) jessie-security; urgency=high
* Team upload.
* Add CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch patch.
CVE-2015-3406: Module::Signature parses the unsigned portion of the
SIGNATURE file as the signed portion due to incorrect handling of PGP
signature boundaries.
CVE-2015-3407: Module::Signature incorrectly handles files that are not
listed in the SIGNATURE file. This includes some files in the t/
directory that would execute when tests are run.
CVE-2015-3408: Module::Signature uses two argument open() calls to read
the files when generating checksums from the signed manifest, allowing
to embed arbitrary shell commands into the SIGNATURE file that would
execute during the signature verification process. (Closes: #783451)
* Add CVE-2015-3409.patch patch.
CVE-2015-3409: Module::Signature incorrectly handles module loading
allowing to load modules from relative paths in @INC. A remote attacker
providing a malicious module could use this issue to execute arbitrary
code during signature verification. (Closes: #783451)
* Add Fix-signature-tests.patch patch.
Fix signature tests by defaulting to verify(skip=>1) when
$ENV{TEST_SIGNATURE} is true.
-- Salvatore Bonaccorso <carnil(a)debian.org> Thu, 14 May 2015 12:58:30 +0200
========================================================================
You can perform the upgrade by issuing the command:
apt-get dist-upgrade
as root on baldrick.crans.org
--
apticron