bugtraq - [ MDVSA-2008:038 ] - Updated gd packages fix buffer overflow vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 07 Feb 2008 19:39:55 -0700
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2008:038 ] - Updated gd packages fix buffer overflow
 vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:038
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : gd
 Date    : February 7, 2008
 Affected: 2007.0, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 Buffer overflow in the LWZReadByte() function in gd_gif_in.c in GD
 prior to 2.0.34 allows remote attackers to have an unknown impact
 via a GIF file with input_code_size greater than MAX_LWZ_BITS, which
 triggers an overflow when initializing the table array.
 
 This was originally fixed in PHP's embedded GD with MDKSA-2006:162;
 patches had not been applied to the system libgd at that time.
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4484
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 5d27c4f586379090e4931a21d33fd7b4  2007.0/i586/gd-utils-2.0.33-5.4mdv2007.0.i586.rpm
 9224f8e7e3592e7002bf7e52ab11c03f  2007.0/i586/libgd2-2.0.33-5.4mdv2007.0.i586.rpm
 1d703d7be910a24975b4ebe18aeb7dd3  2007.0/i586/libgd2-devel-2.0.33-5.4mdv2007.0.i586.rpm
 9f2a55d0b08203ea04d1a7ef9350f193  2007.0/i586/libgd2-static-devel-2.0.33-5.4mdv2007.0.i586.rpm 
 c3d0c5fcdd6c91952dc9c26941806b4f  2007.0/SRPMS/gd-2.0.33-5.4mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 4415599217e596438138f1d38d569b2e  2007.0/x86_64/gd-utils-2.0.33-5.4mdv2007.0.x86_64.rpm
 b80f2b86c307a423f4c5da9db8740498  2007.0/x86_64/lib64gd2-2.0.33-5.4mdv2007.0.x86_64.rpm
 b25700d218143ab19630a273859ca8cf  2007.0/x86_64/lib64gd2-devel-2.0.33-5.4mdv2007.0.x86_64.rpm
 edc68e77faefc49c3f003fe16f7456a1  2007.0/x86_64/lib64gd2-static-devel-2.0.33-5.4mdv2007.0.x86_64.rpm 
 c3d0c5fcdd6c91952dc9c26941806b4f  2007.0/SRPMS/gd-2.0.33-5.4mdv2007.0.src.rpm

 Corporate 4.0:
 dd213d40ce5d217db62bba839f38228b  corporate/4.0/i586/gd-utils-2.0.33-3.5.20060mlcs4.i586.rpm
 e3ce9ac16ccebcd9e974191766851d73  corporate/4.0/i586/libgd2-2.0.33-3.5.20060mlcs4.i586.rpm
 974858ee8531fa339fd54f7ad435bbd1  corporate/4.0/i586/libgd2-devel-2.0.33-3.5.20060mlcs4.i586.rpm
 4651b8752a4631e9d4139d59c6f423f5  corporate/4.0/i586/libgd2-static-devel-2.0.33-3.5.20060mlcs4.i586.rpm 
 638e3d6d0cad46ec00cd8005356fe96f  corporate/4.0/SRPMS/gd-2.0.33-3.5.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 26e334153150600c8e21426b6c89fc0d  corporate/4.0/x86_64/gd-utils-2.0.33-3.5.20060mlcs4.x86_64.rpm
 85d6fb1d0e366fc02eea92d87f002775  corporate/4.0/x86_64/lib64gd2-2.0.33-3.5.20060mlcs4.x86_64.rpm
 0f3986d317e0e6e4923bee69763d4d2a  corporate/4.0/x86_64/lib64gd2-devel-2.0.33-3.5.20060mlcs4.x86_64.rpm
 551c1c5d3bf54340241cbfa1a7f0d5e2  corporate/4.0/x86_64/lib64gd2-static-devel-2.0.33-3.5.20060mlcs4.x86_64.rpm 
 638e3d6d0cad46ec00cd8005356fe96f  corporate/4.0/SRPMS/gd-2.0.33-3.5.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHq5bHmqjQ0CJFipgRAtUlAJ0XPYaI/6J+BG2/zYlj0QMl25NZqwCeNlSV
6+ntATv4327X6t0lYFkIyws=
=uc2j
-----END PGP SIGNATURE-----