bugtraq - MDKSA-2005:187 - Updated dia packages fix python SVG import vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E1ESqFA-00056V-A1@mercury.mandriva.com>
Date: Fri, 21 Oct 2005 00:19:08 -0600
From: Mandriva Security Team <security@...driva.com>
To: bugtraq@...urityfocus.com
Subject: MDKSA-2005:187 - Updated dia packages fix python SVG import vulnerability.


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                Mandriva Linux Security Update Advisory
 _______________________________________________________________________

 Package name:           dia
 Advisory ID:            MDKSA-2005:187
 Date:                   October 20th, 2005

 Affected versions:	 10.2, 2006.0
 ______________________________________________________________________

 Problem Description:

 Joxean Koret discovered that the Python SVG import plugin in dia, 
 a vector-oriented diagram editor, does not properly sanitise data 
 read from an SVG file and is hence vulnerable to execute arbitrary 
 Python code.
 
 The updated packages have been patched to address this issue.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2966
 ______________________________________________________________________

 Updated Packages:
  
 Mandrivalinux 10.2:
 0c8a73f7bd63bad23baaec2241b4423c  10.2/RPMS/dia-0.94-4.1.102mdk.i586.rpm
 8e8d94c15c4eab00428ae0094f5512a5  10.2/SRPMS/dia-0.94-6.1.20060mdk.src.rpm

 Mandrivalinux 10.2/X86_64:
 ac4d0bc7654a02cd150693c89d47654b  x86_64/10.2/RPMS/dia-0.94-4.1.102mdk.x86_64.rpm
 8e8d94c15c4eab00428ae0094f5512a5  x86_64/10.2/SRPMS/dia-0.94-6.1.20060mdk.src.rpm

 Mandrivalinux 2006.0:
 f15f857ac65e4071d2a54a8037fce302  2006.0/RPMS/dia-0.94-6.1.20060mdk.i586.rpm
 8e8d94c15c4eab00428ae0094f5512a5  2006.0/SRPMS/dia-0.94-6.1.20060mdk.src.rpm

 Mandrivalinux 2006.0/X86_64:
 394b409242bd4271c4cd0e22e86cdf5b  x86_64/2006.0/RPMS/dia-0.94-6.1.20060mdk.x86_64.rpm
 8e8d94c15c4eab00428ae0094f5512a5  x86_64/2006.0/SRPMS/dia-0.94-6.1.20060mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFDWIhcmqjQ0CJFipgRAvQBAKCQQt7dZx/PrY/PLcb0QpbPl4jwpwCg5Lwz
jnuh6gRJU745VJdTZhL3Zrk=
=xkc6
-----END PGP SIGNATURE-----