-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



--------------------------------------------------------------------------

Debian Security Advisory DSA 118-1                     security@debian.org

http://www.debian.org/security/                             Martin Schulze

March 5th, 2002  

--------------------------------------------------------------------------



Package        : xsane

Vulnerability  : insecure temporary files

Problem-Type   : local

Debian-specific: no



Tim Waugh found several insecure uses of temporary files in the xsane

program, which is used for scanning.  This was fixed for Debian/stable

by moving those files into a securely created directory within the

/tmp directory.



This problem has been fixed in version 0.50-5.1 for the stable Debian

distribution and in version 0.84-0.1 for the testing and unstable

distribution of Debian.



We recommend that you upgrade your xsane package.



wget url

	will fetch the file for you

dpkg -i file.deb

        will install the referenced file.



If you are using the apt-get package manager, use the line for

sources.list as given below:



apt-get update

        will update the internal database

apt-get upgrade

        will install corrected packages



You may use an automated update by adding the resources from the

footer to the proper configuration.





Debian GNU/Linux 2.2 alias potato

------------------------------------



  Source archives:



    xsane_0.50-5.1.diff.gz
      MD5 checksum: 95deb77d4120c18c8d6c52b694e30d63

    xsane_0.50-5.1.dsc
      MD5 checksum: c4601eb08536a8deeb8b49630f948cc6

    xsane_0.50.orig.tar.gz
      MD5 checksum: 768fbd482f15ca0b081f19f7bc15d76f



  Alpha architecture:



    xsane_0.50-5.1_alpha.deb
      MD5 checksum: baf8ef6879863e43d49aec409c515da9



  ARM architecture:



    xsane_0.50-5.1_arm.deb
      MD5 checksum: 994e6eaa747f04b85a0f953b14de1445



  Intel ia32 architecture:



    xsane_0.50-5.1_i386.deb
      MD5 checksum: 069983f5340d5524a78b4bd896c6edb5



  Motorola 680x0 architecture:



    xsane_0.50-5.1_m68k.deb
      MD5 checksum: 4057804c6ccc359567e25bbecdbe4e22



  PowerPC architecture:



    xsane_0.50-5.1_powerpc.deb
      MD5 checksum: bab3f792a4abac83ea921539a79d324f



  Sun Sparc architecture:



    xsane_0.50-5.1_sparc.deb
      MD5 checksum: f8cf97b74dfff2113e695ed4595cbe9e





  These files will probably be moved into the stable distribution on

  its next revision.



---------------------------------------------------------------------------------


For apt-get: deb http://security.debian.org/ stable/updates main

For dpkg-ftp: ftp://security.debian.org/debian-securitydists/stable/updates/main

Mailing list: debian-security-announce@lists.debian.org

Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.0.6 (GNU/Linux)

Comment: For info see http://www.gnupg.org



iD8DBQE8hRDpW5ql+IAeqTIRApgXAJkBs3BzGrRfh4VU/+nChje4Be2IfwCfUR1A

A9I2mQANsH7at3U1uNSYVI4=

=v3yN

-----END PGP SIGNATURE-----





-- 

To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org

with a subject of "unsubscribe". Trouble? Contact
 listmaster@lists.debian.org