|
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] lftp security update (SSA:2003-346-01) lftp is a file transfer program that connects to other hosts using FTP, HTTP, and other protocols. A security problem with lftp has been corrected with the release of lftp-2.6.10. New packages are available for Slackware 8.1, 9.0, 9.1, and -current. Any sites using lftp should upgrade to the new packages. Here are the details from the Slackware 9.1 ChangeLog: +--------------------------+ Fri Dec 12 11:12:05 PST 2003 patches/packages/lftp-2.6.10-i486-1.tgz: Upgraded to lftp-2.6.10. According to the NEWS file, this includes "security fixes in html parsing code" which could cause a compromise when using lftp to access an untrusted site. (* Security fix *) +--------------------------+ WHERE TO FIND THE NEW PACKAGE: +-----------------------------+ Updated package for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packag es/lftp-2.6.10-i386-1.tgz Updated package for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packag es/lftp-2.6.10-i386-1.tgz Updated package for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packag es/lftp-2.6.10-i486-1.tgz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n /lftp-2.6.10-i486-1.tgz MD5 SIGNATURES: +-------------+ Slackware 8.1 package: 1e7eae2a8279491d439f4494c8733aa2 lftp-2.6.10-i386-1.tgz Slackware 9.0 package: af80878951917a6683bc3076947f2632 lftp-2.6.10-i386-1.tgz Slackware 9.1 package: e053a1641f1f16de8d2659e70ca81c04 lftp-2.6.10-i486-1.tgz Slackware -current package: 07e76203820f54983cbc4591cc830b97 lftp-2.6.10-i486-1.tgz INSTALLATION INSTRUCTIONS: +------------------------+ Upgrade the package as root: # upgradepkg lftp-2.6.10-i486-1.tgz +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | HOW TO REMOVE YOURSELF FROM THIS MAILING LIST: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back. Follow the instructions to | | complete the unsubscription. Do not reply to this message to | | unsubscribe! | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/2hdTakRjwEAQIjMRAmHbAKCQtw9UN4ItGNph3ca4CqtfJDZiyACfV5gc 0uX5KSFnwEb2k0tucmkKWzI= =SQlB -----END PGP SIGNATURE-----