[Slackit.org] [slackware-security] security issues in pine (SSA:2003-253-01)

[Andrea Guarnaccia]

> [slackware-security]  security issues in pine (SSA:2003-253-01)
>
> Upgraded pine packages are available for Slackware 8.1, 9.0 and
> - -current.  These fix two security problems found by iDEFENSE Labs
> which could lead to arbitrary code execution when a specially
> crafted email is processed by Pine.
>
> This problem is fixed in Pine 4.58.  Sites which use the Pine
> mail reader should upgrade.
>
>
> Here are the details from the Slackware 9.0 ChangeLog:
> +--------------------------+
> Wed Sep 10 20:47:53 PDT 2003
> patches/packages/pine-4.58-i386-1.tgz:  Upgraded to pine4.58.
>   This fixes two vulnerabilities in earlier PINE versions found
>   by iDEFENSE Labs
>   (see http://www.idefense.com/advisory/09.10.03.txt).
>   (* Security fix *)
> +--------------------------+
>
>
> WHERE TO FIND THE NEW PACKAGES:
> +-----------------------------+
>
> Updated package for Slackware 8.1:
> ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/pine-4.58-i386-1.tgz
>
> Updated package for Slackware 9.0:
> ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/pine-4.58-i386-1.tgz
>
> Updated package for Slackware -current:
> ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/pine-4.58-i486-1.tgz
>
>
> MD5 SIGNATURES:
> +-------------+
>
> Slackware 8.1 package:
> 1d47105029acd69e42c9ed0740c44a6a  pine-4.58-i386-1.tgz
>
> Slackware 9.0 package:
> eed870ae357057b8077035f50c5139d2  pine-4.58-i386-1.tgz
>
> Slackware -current package:
> 3a81b024bea2c36386cde8a9e1c241f7  pine-4.58-i486-1.tgz
>
>
> INSTALLATION INSTRUCTIONS:
> +------------------------+
>
> Upgrade using upgradepkg (as root):
> # upgradepkg pine-4.58-i386-1.tgz
>
>
> +-----+
>
> Slackware Linux Security Team
> http://slackware.com/gpg-key
> address@hidden