[SECURITY] [DSA 645-1] New CUPS packages fix arbitrary code execution

2005-01-19 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 645-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze January 19th, 2005

[SECURITY] [DSA 647-1] New mysql packages fix insecure temporary files

2005-01-19 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 647-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze January 19th, 2005

[SECURITY] [DSA 648-1] New xpdf packages fix arbitrary code execution

2005-01-19 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 648-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze January 19th, 2005

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Rick Moen
Quoting s. keeling ([EMAIL PROTECTED]): The problem here is the nitwit factor. Yes, well, a bunch of us have been keeping an eye on Linux MUAs and default mailcap behaviour for 10+ years, to make sure zeal for simplicity doesn't lead coders or distro assemblers to do something dumb. Thus my

Re: [meta] Set reply-to to something else?

2005-01-19 Thread Vassilii Khachaturov
On Tue, 2005-01-18 at 12:40 +0100, Adrian von Bidder wrote: Hi, With web-board passwords and two or three auto-acks being posted to this list every week: could we think about setting the Reply-To of I hope that I am not the only one who writes to the auto-ackers and their postmasters that

Re: [meta] Set reply-to to something else?

2005-01-19 Thread Adrian von Bidder
On Wednesday 19 January 2005 10.15, Adam Lydick wrote: Better to bounce or moderate entries from non-subscribers, IMOHO. That would cut down on the spam quite a lot better than probabilistic filters as well. Problem: moderating needs manpower. Problem: closing the list to non-subscribers would

Re: .desktop arbitrary program execution

2005-01-19 Thread David Mandelberg
Rick Moen wrote: Quoting David Mandelberg ([EMAIL PROTECTED]): Attached. Save to your GNOME/KDE desktop (like many newbies do) and double click the new icon. .desktop files (currently) don't need the x bit set to work, so no chmod'ing is necessary. I'm sorry, but the question was:

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread David Mandelberg
s. keeling wrote: No, I assume people have half a brain in their heads, look at the attachment type, maybe save it to a file and inspect it, then maybe look at it or delete it. Too much work? Whether it's too much work or not, most non-geeks I know don't bother. Okay, slap a lot of autoload

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Florian Weimer
* s. keeling: People who don't use stupid Windows email clients have no trouble with attachments at all. Attachments are a very useful tool; for instance, for code listings, they arrive unmangled by line wrap. Get a better email client, running on a better OS. You mean the OS whose users

Re: .desktop arbitrary program execution

2005-01-19 Thread Florian Weimer
* Rick Moen: Please advise this mailing list of which specific Linux or BSD MUA (or specific configuration thereof) is willing to execute a received binary or script attachment. mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries.

unsuscribe

2005-01-19 Thread Aurelien Roux
Le Tue, Jan 18, 2005 at 10:41:00AM +0100, Martin Schulze a écrit : -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 644-1 [EMAIL PROTECTED]

Re: .desktop arbitrary program execution

2005-01-19 Thread Vincent Hanquez
On Wed, Jan 19, 2005 at 12:49:57PM +0100, Florian Weimer wrote: * Rick Moen: Please advise this mailing list of which specific Linux or BSD MUA (or specific configuration thereof) is willing to execute a received binary or script attachment. mutt and Gnus are, in typical

Re: [SECURITY] [DSA 636-1] New libc6 packages fix insecure temporary files

2005-01-19 Thread Don Hayward
Don Hayward at pomobuli.net On Wed, 12 Jan 2005, Martin Schulze wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 636-1 [EMAIL PROTECTED]

Re: .desktop arbitrary program execution

2005-01-19 Thread Florent Rougon
Florian Weimer [EMAIL PROTECTED] wrote: mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries. Could you point out a mailcap entry that causes the file to be *executed*? Because running gqview $file.jpg is very different from running

Re: .desktop arbitrary program execution

2005-01-19 Thread Florian Weimer
* Florent Rougon: Florian Weimer [EMAIL PROTECTED] wrote: mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries. Could you point out a mailcap entry that causes the file to be *executed*? For complex file formats, there is no clear

Re: .desktop arbitrary program execution

2005-01-19 Thread Michael Stone
On Wed, Jan 19, 2005 at 04:29:46PM +0100, Florian Weimer wrote: For complex file formats, there is no clear distinction between opening a file and executing it. Sure there is. For some filetypes execution is an intended effect; that is, you expect arbitrary code to run. For other filetypes there's

Re: .desktop arbitrary program execution

2005-01-19 Thread Rick Moen
Quoting Florian Weimer ([EMAIL PROTECTED]): mutt and Gnus are, in typical configurations. Most distributions kindly add all these helpful mailcap entries. Perhaps you need assistance comprehending the word specific (used twice in my question)? I await with interest your achieving that

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread s. keeling
Incoming from Florian Weimer: * s. keeling: People who don't use stupid Windows email clients have no trouble with attachments at all. Attachments are a very useful tool; for instance, for code listings, they arrive unmangled by line wrap. Get a better email client, running on a

unsubscribe

2005-01-19 Thread michael . english

Re: .desktop arbitrary program execution

2005-01-19 Thread David Mandelberg
Rick Moen wrote: Quoting David Mandelberg ([EMAIL PROTECTED]): You also asked a question about something I didn't say (I said that the person had to open it). Actually, no, you didn't. (Presumably you intended to, though.) Your question spoke of opening a particularly-named

Re: [SECURITY] [DSA 643-1] New queue packages fix buffer overflows

2005-01-19 Thread Joey Hess
Martin Schulze wrote: For the unstable distribution (sid) these problems have been fixed in version 1.30.1-5. A day later and unstable still has 1.30.1-4.2 and I see no 1.30.1-5 in incoming. Did the upload go missing? -- see shy jo signature.asc Description: Digital signature

Re: [meta] Set reply-to to something else?

2005-01-19 Thread Robert Brockway
On Wed, 19 Jan 2005, Vassilii Khachaturov wrote: I hope that I am not the only one who writes to the auto-ackers and their postmasters that they're using stupid MUAs not honoring Precedence: bulk or Precedence: junk as well as the other list-control fields as a flags to not auto-respond. I

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Sam Watkins
On Wed, Jan 19, 2005 at 06:52:17AM -0500, David Mandelberg wrote: I'm just suggesting that it should be harder for them to shoot themselves in the foot i.e. by making .desktop's have the x bit before they can be launched. I strongly agree. No, I STRONGLY agree! If they are to be marked

Sie suchen Geschäftskontakte in Europa? Wir stellen diese Kontakte für Sie her!

2005-01-19 Thread Agentur España
Title: Sie suchen Geschäftskontakte in Europa? Wir stellen diese Kontakte für Sie her! Guten Tag, debian-security@lists.debian.orgDonnerstag, 20. Januar 2005 Unsere Werbeagentur möchte Sie informieren das Sie jetzt die Möglichkeit haben. Kostenloses anmelden in Suchmaschinen,