From: [email protected]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------- Debian Security Advisory DSA-1923-1 [email protected] http://www.debian.org/security/ Nico Golde October 27th, 2009 http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package : libhtml-parser-perl
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
Debian bug : #552531
CVE ID : CVE-2009-3627

A denial of service vulnerability has been found in libhtml-parser-perl,
a collection of modules to parse HTML in text documents which is used by several other projects like e.g. SpamAssassin.

Mark Martinec discovered that the decode_entities() function will get stuck
in an infinite loop when parsing certain HTML entities with invalid UTF-8 characters. An attacker can use this to perform denial of service attacks
by submitting crafted HTML to an application using this functionality.


For the oldstable distribution (etch), this problem has been fixed in
version 3.55-1+etch1.

For the stable distribution (lenny), this problem has been fixed in
version 3.56-1+lenny1.

For the testing (squeeze) and unstable (sid) distribution, this problem
will be fixed soon.


We recommend that you upgrade your libhtml-parser-perl packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55.orig.tar.gz
Size/MD5 checksum: 84746 75eb683f1fb7aa7c0ffa46ded4564b54
http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.diff.gz
Size/MD5 checksum: 6136 8c713a84e3df953ae77d83d9f2cff5bc
http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1.dsc
Size/MD5 checksum: 882 0f38d699bda26190ea4764aa74eac2c8

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_alpha.deb
Size/MD5 checksum: 108540 a6d69a440e25b3d3b4e9c5057f6b6908

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_amd64.deb
Size/MD5 checksum: 108168 ddafcee82387004c4d55a39a8ca54eb6

arm architecture (ARM)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_arm.deb
Size/MD5 checksum: 106962 9842d5bc00c6b308d01fae6d20676e9e

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_hppa.deb
Size/MD5 checksum: 109602 2d4a2d3ff134cfdd70135e71caf9043a

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_i386.deb
Size/MD5 checksum: 108032 b542502d5b1d4fff66c2d730e8c02790

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_ia64.deb
Size/MD5 checksum: 117524 ce065d8d05996cdc4c436104b578ed0a

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mips.deb
Size/MD5 checksum: 106518 25feabc68e1aa4aff02b6aff00a2a9df

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_mipsel.deb
Size/MD5 checksum: 105742 17a4f0fafa183a3794fad636e4e26ce4

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_powerpc.deb
Size/MD5 checksum: 106504 beb784e9d723ba717d207c6e9c58414b

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_s390.deb
Size/MD5 checksum: 106630 1de105f77b55dd920dbfccb7712e3dc1

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.55-1+etch1_sparc.deb
Size/MD5 checksum: 106222 bd1cd736644c4f2dceb76cc5192f18d0


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.diff.gz
Size/MD5 checksum: 6147 18b2407d8b26d6225b82a880b16a0e05
http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1.dsc
Size/MD5 checksum: 1316 5a923d6089e2ffddf050ea5b017a7956
http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56.orig.tar.gz
Size/MD5 checksum: 86040 bddc432e5ed9df4d4153a62234f04fc2

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/libh/libhtml-parser-perl/libhtml-parser-perl_3.56-1+lenny1_alpha.deb
Size/MD5 checksum: 111160 928145a65d633d76bf3db6a42bcf9173

amd64 architecture (AMD x86_64 (AMD64))


[continued in next message]

--- SoupGate-Win32 v1.05
* Origin: you cannot sedate... all the things you hate (1:229/2)