Russ Allbery uploaded new packages for xml-security-c which fixed the
following security problems:


    It has been discovered that xml-security-c, an implementation of the
    XML Digital Signature and Encryption specifications, is not properly
    handling RSA keys of sizes on the order of 8192 or more bits.  This
    allows an attacker to crash applications using this functionality or
    potentially execute arbitrary code by tricking an application into
    verifying a signature created with a sufficiently long RSA key.

For the lenny-backports distribution, this problem has been fixed in

We recommend that you upgrade your xml-security-c packages.

If you don't use pinning (see [1]) you have to update the package
manually via "apt-get -t lenny-backports install <packagelist>" with
the packagelist of your installed packages affected by this update.
[1] <>

We recommend to pin (in /etc/apt/preferences) the backports repository
to 200 so that new versions of installed  backports will be installed

  Package: *
  Pin: release a=lenny-backports
  Pin-Priority: 200