From bb675d8d4f198663029c52f365dd32cdc3c944e1 Mon Sep 17 00:00:00 2001 From: Neil McGovern Date: Thu, 15 Jun 2006 08:43:10 +0000 Subject: Finish releaseing blender git-svn-id: svn+ssh://svn.debian.org/svn/secure-testing@4232 e39458fd-73e7-0310-bf30-c45bca0a0e42 --- website/DTSA/DTSA-29-1.html | 94 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 website/DTSA/DTSA-29-1.html (limited to 'website') diff --git a/website/DTSA/DTSA-29-1.html b/website/DTSA/DTSA-29-1.html new file mode 100644 index 0000000000..eb1931a4d6 --- /dev/null +++ b/website/DTSA/DTSA-29-1.html @@ -0,0 +1,94 @@ + + + Debian testing security team - Advisory + + + + +
+ + + + + Debian Project +
+
+ + + + + + + + + + + +
+ Debian testing security team - Advisory +
+ + +
+ + +

DTSA-29-1

+
+
Date Reported:
+
June 15th, 2006
+
Affected Package:
+
Blender
+
Vulnerability:
+
heap-based buffer overflow
+
Problem-Scope:
+
remote
+
Debian-specific:
+
No
+
CVE:
+
+CVE-2005-4470 +
+
More information:
+
A heap-based buffer overflow vulnerability was discovered by Damian Put in 
+Blender BlenLoader 2.0 through 2.40pre which allows remote attackers to cause a 
+denial of service (application crash) and possibly execute arbitrary code via a 
+.blend file with a negative bhead.len value, which causes less memory to be 
+allocated than expected, possibly due to an integer overflow. 
+ 
+Please note, this issue has already been fixed in stable in security 
+announcement DSA-1039-1 
+
+
For the testing distribution (etch) this is fixed in version 2.37a-1.1etch1
+
For the unstable distribution (sid) this is fixed in version 2.40-1
+
This upgrade is recommended if you use Blender.
+
If you have the secure testing lines in your sources.list, you can update by running this command as root:
+ +
apt-get update && apt-get install blender
+
+ +
+
To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list:
+
+
deb http://secure-testing-mirrors.debian.net/debian-secure-testing etch-proposed-updates/security-updates main contrib non-free
+
deb-src http://secure-testing-mirrors.debian.net/debian-secure-testing etch-proposed-updates/security-updates main contrib non-free
+
+
The archive signing key can be downloaded from
+
http://secure-testing.debian.net/ziyi-2005-7.asc
+ +
+ + +
+ + Valid HTML 4.01! + + Valid CSS! + + + + -- cgit v1.2.3