full-disclosure - [ MDVSA-2008:163 ] python

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 07 Aug 2008 19:26:00 -0600
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2008:163 ] python


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2008:163
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : python
 Date    : August 7, 2008
 Affected: 2007.1, 2008.0, 2008.1
 _______________________________________________________________________

 Problem Description:

 Multiple integer overflows in the imageop module in Python prior to
 2.5.3 allowed context-dependent attackers to cause a denial of service
 (crash) or possibly execute arbitrary code via crafted images that
 trigger heap-based buffer overflows (CVE-2008-1679).  This was due
 to an incomplete fix for CVE-2007-4965.
 
 David Remahl of Apple Product Security reported several integer
 overflows in a number of core modules (CVE-2008-2315).  He also
 reported an integer overflow in the hashlib module on Python 2.5 that
 lead to unreliable cryptographic digest results (CVE-2008-2316).
 
 Justin Ferguson reported multiple buffer overflows in unicode string
 processing that affected 32bit systems (CVE-2008-3142).
 
 Multiple integer overflows were reported by the Google Security Team
 that had been fixed in Python 2.5.2 (CVE-2008-3143).
 
 Justin Ferguson reported a number of integer overflows and underflows
 in the PyOS_vsnprintf() function, as well as an off-by-one error
 when passing zero-length strings, that led to memory corruption
 (CVE-2008-3144).
 
 The updated packages have been patched to correct these issues.
 As well, Python packages on Mandriva Linux 2007.1 and 2008.0 have
 been updated to version 2.5.2.  Due to slight packaging changes on
 Mandriva Linux 2007.1, a new package is available (tkinter-apps) that
 contains binary files (such as /usr/bin/idle) that were previously
 in the tkinter package.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1679
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2315
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2316
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3142
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3143
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3144
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2007.1:
 3f7113a6a5d490df6f85e0c0cda33f7d  2007.1/i586/libpython2.5-2.5.2-2.2mdv2007.1.i586.rpm
 e549b7461f58d893ff2551817753b957  2007.1/i586/libpython2.5-devel-2.5.2-2.2mdv2007.1.i586.rpm
 63e6c2850a2dfae83143af927330bead  2007.1/i586/python-2.5.2-2.2mdv2007.1.i586.rpm
 09abd3cca29e9fec2fe100cb9c3b76a0  2007.1/i586/python-base-2.5.2-2.2mdv2007.1.i586.rpm
 7451141640a0dc4addedd0e233de7443  2007.1/i586/python-docs-2.5.2-2.2mdv2007.1.i586.rpm
 eca0b6a144b5ec40371d894fd3f5529e  2007.1/i586/tkinter-2.5.2-2.2mdv2007.1.i586.rpm
 119b4933f27a3b61da1d2c2903c452bb  2007.1/i586/tkinter-apps-2.5.2-2.2mdv2007.1.i586.rpm 
 c89404feb6ef4b19e66a3d3604fe0a60  2007.1/SRPMS/python-2.5.2-2.2mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 fd913909f1168b57905b02bd61de5a61  2007.1/x86_64/lib64python2.5-2.5.2-2.2mdv2007.1.x86_64.rpm
 95f373cdcefb6eda6e04e9be2b88d0a0  2007.1/x86_64/lib64python2.5-devel-2.5.2-2.2mdv2007.1.x86_64.rpm
 f9e30868d33e7599bfe9e28e9eed9640  2007.1/x86_64/python-2.5.2-2.2mdv2007.1.x86_64.rpm
 f4bb24e89d56e2809b9a2eaa5d55492b  2007.1/x86_64/python-base-2.5.2-2.2mdv2007.1.x86_64.rpm
 8a5d0198ef4c70199de88ba6a269017d  2007.1/x86_64/python-docs-2.5.2-2.2mdv2007.1.x86_64.rpm
 c7df1a1050d150998177b238955780d7  2007.1/x86_64/tkinter-2.5.2-2.2mdv2007.1.x86_64.rpm
 07ebd022a054fe3f9635b190745dc9f7  2007.1/x86_64/tkinter-apps-2.5.2-2.2mdv2007.1.x86_64.rpm 
 c89404feb6ef4b19e66a3d3604fe0a60  2007.1/SRPMS/python-2.5.2-2.2mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 99f4eef4f5163f11f9067659c42f811b  2008.0/i586/libpython2.5-2.5.2-2.2mdv2008.0.i586.rpm
 6f8409426cc9ed88bc8785ef4d07ed96  2008.0/i586/libpython2.5-devel-2.5.2-2.2mdv2008.0.i586.rpm
 fcbf1b20aec5de9a5f7f96594976e542  2008.0/i586/python-2.5.2-2.2mdv2008.0.i586.rpm
 e3efa64ed03f11d19785e46d66e623ea  2008.0/i586/python-base-2.5.2-2.2mdv2008.0.i586.rpm
 35e89e01c2c563c4dcfd0744b34f5111  2008.0/i586/python-docs-2.5.2-2.2mdv2008.0.i586.rpm
 54229dcb6cab48f55341b7b40978c67a  2008.0/i586/tkinter-2.5.2-2.2mdv2008.0.i586.rpm
 0d0e64c81294dc857b3bffd20d07670d  2008.0/i586/tkinter-apps-2.5.2-2.2mdv2008.0.i586.rpm 
 185f9596bb1f04d6a5beadc6d2810c47  2008.0/SRPMS/python-2.5.2-2.2mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 9e64bc3895709a9979e627ecba57f5b9  2008.0/x86_64/lib64python2.5-2.5.2-2.2mdv2008.0.x86_64.rpm
 cbe2920e5490565b997906339f4da2ea  2008.0/x86_64/lib64python2.5-devel-2.5.2-2.2mdv2008.0.x86_64.rpm
 648d967823423618d5c6f2c5a65168b9  2008.0/x86_64/python-2.5.2-2.2mdv2008.0.x86_64.rpm
 0f2f499ed3bc343d9ecaa5720f424b49  2008.0/x86_64/python-base-2.5.2-2.2mdv2008.0.x86_64.rpm
 35688339d010308c5913811bcbb34766  2008.0/x86_64/python-docs-2.5.2-2.2mdv2008.0.x86_64.rpm
 d54ab3f45ff8adad3094c215434f2f67  2008.0/x86_64/tkinter-2.5.2-2.2mdv2008.0.x86_64.rpm
 83c24eab63935f9a1a7c5243de0b0561  2008.0/x86_64/tkinter-apps-2.5.2-2.2mdv2008.0.x86_64.rpm 
 185f9596bb1f04d6a5beadc6d2810c47  2008.0/SRPMS/python-2.5.2-2.2mdv2008.0.src.rpm

 Mandriva Linux 2008.1:
 210e4d43dd8f86fad41940826c8d37ca  2008.1/i586/libpython2.5-2.5.2-2.2mdv2008.1.i586.rpm
 555f12cf8dcb4200feac0faf0a75eb43  2008.1/i586/libpython2.5-devel-2.5.2-2.2mdv2008.1.i586.rpm
 2ba6a7df13618057bcc8a9af3e67f102  2008.1/i586/python-2.5.2-2.2mdv2008.1.i586.rpm
 2ab608650d4f4209442a573c77e3dc22  2008.1/i586/python-base-2.5.2-2.2mdv2008.1.i586.rpm
 5ce8d1853d7a0cb460b9fc999eb2d39c  2008.1/i586/python-docs-2.5.2-2.2mdv2008.1.i586.rpm
 b90c8279714770b6d8c1f2fbb64cc02b  2008.1/i586/tkinter-2.5.2-2.2mdv2008.1.i586.rpm
 dee30de58133025857e3234c7b127488  2008.1/i586/tkinter-apps-2.5.2-2.2mdv2008.1.i586.rpm 
 201dd1a84310d932a9af8f71adecba52  2008.1/SRPMS/python-2.5.2-2.2mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 1ee0a473977bbbbadb468aff7b687f98  2008.1/x86_64/lib64python2.5-2.5.2-2.2mdv2008.1.x86_64.rpm
 3239b7f40e43014dd4ab804ffd6bd41b  2008.1/x86_64/lib64python2.5-devel-2.5.2-2.2mdv2008.1.x86_64.rpm
 15dd487627ed7aec1c865a168e231dac  2008.1/x86_64/python-2.5.2-2.2mdv2008.1.x86_64.rpm
 a967cd7ef1a7359702bde99e6fb3ad62  2008.1/x86_64/python-base-2.5.2-2.2mdv2008.1.x86_64.rpm
 0738899657e59356e83dedbd5af7057d  2008.1/x86_64/python-docs-2.5.2-2.2mdv2008.1.x86_64.rpm
 cc5fa54fcc28a977ee5172ede0059e47  2008.1/x86_64/tkinter-2.5.2-2.2mdv2008.1.x86_64.rpm
 3fbb51d424beb86daaa3c55907069c86  2008.1/x86_64/tkinter-apps-2.5.2-2.2mdv2008.1.x86_64.rpm 
 201dd1a84310d932a9af8f71adecba52  2008.1/SRPMS/python-2.5.2-2.2mdv2008.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFIm3M8mqjQ0CJFipgRAuzeAKD0+Cp/pPYbpmZ7LDOp4lwbrbR1oACgtVRI
kzgNPYafPfQCZMGkyqFN8b4=
=lFBZ
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/