bugtraq - MDKSA-2005:198 - Updated uim packages fix suid linking vulnerabilities.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <E1EUsxf-00025r-9i@mercury.mandriva.com>
Date: Wed, 26 Oct 2005 15:37:31 -0600
From: Mandriva Security Team <security@...driva.com>
To: bugtraq@...urityfocus.com
Subject: MDKSA-2005:198 - Updated uim packages fix suid linking vulnerabilities.


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2005:198
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : uim
 Date    : October 26, 2005
 Affected: 10.2, 2006.0
 _______________________________________________________________________
 
 Problem Description:
 
 Masanari Yamamoto discovered that Uim uses environment variables 
 incorrectly. This bug causes a privilege escalation if setuid/setgid 
 applications are linked to libuim. 
 
 The updated packages have been patched to address this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3149
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 10.2:
 0b40b2bf269eebdb578b7ccad6376ee7  10.2/RPMS/libuim0-0.4.6-6.1.102mdk.i586.rpm
 0fa0b1b530cbe088168575f93e27af16  10.2/RPMS/libuim0-devel-0.4.6-6.1.102mdk.i586.rpm
 ff9d291ec6260b7b8dbcb7ffff44723c  10.2/RPMS/uim-0.4.6-6.1.102mdk.i586.rpm
 58748280b6409a8ad303d373af08f095  10.2/RPMS/uim-anthy-0.4.6-6.1.102mdk.i586.rpm
 de4817e89863e467f60f0bdfc8e367ee  10.2/RPMS/uim-gtk-0.4.6-6.1.102mdk.i586.rpm
 9f604d7675aac699f2415a251ecea3c8  10.2/RPMS/uim-m17nlib-0.4.6-6.1.102mdk.i586.rpm
 39ecbe0eba6a0e577fb4964eb056f1be  10.2/RPMS/uim-prime-0.4.6-6.1.102mdk.i586.rpm
 ba70ceeadff24ddf3116ca7ca896bc29  10.2/RPMS/uim-qt-0.4.6-6.1.102mdk.i586.rpm
 a4724afdb7fd954d0a5e4cbfe76da9ea  10.2/RPMS/uim-skk-0.4.6-6.1.102mdk.i586.rpm
 1aaae40c2eb11aeb27894f0adad90c78  10.2/SRPMS/uim-0.4.6-6.1.102mdk.src.rpm

 Mandriva Linux 10.2/X86_64:
 a4577bc46ee837064e90d76de15dc0d8  x86_64/10.2/RPMS/lib64uim0-0.4.6-6.1.102mdk.x86_64.rpm
 4f5481e87619492b66b872189b64a746  x86_64/10.2/RPMS/lib64uim0-devel-0.4.6-6.1.102mdk.x86_64.rpm
 b0136005ec97560c3b69f1afe866858c  x86_64/10.2/RPMS/uim-0.4.6-6.1.102mdk.x86_64.rpm
 ec86c03dbc8931b1fafd3afa0ab1076c  x86_64/10.2/RPMS/uim-anthy-0.4.6-6.1.102mdk.x86_64.rpm
 16eafc984239f9cca8ac8b11ca6add5c  x86_64/10.2/RPMS/uim-gtk-0.4.6-6.1.102mdk.x86_64.rpm
 ff44a9d79f64c4ddf016808c82676248  x86_64/10.2/RPMS/uim-m17nlib-0.4.6-6.1.102mdk.x86_64.rpm
 cc12102858c03a110123750217e4fe98  x86_64/10.2/RPMS/uim-prime-0.4.6-6.1.102mdk.x86_64.rpm
 61e11d3562720bb2899e0847786c61c0  x86_64/10.2/RPMS/uim-qt-0.4.6-6.1.102mdk.x86_64.rpm
 72b234c251423aaa12958b726af54e9c  x86_64/10.2/RPMS/uim-skk-0.4.6-6.1.102mdk.x86_64.rpm
 1aaae40c2eb11aeb27894f0adad90c78  x86_64/10.2/SRPMS/uim-0.4.6-6.1.102mdk.src.rpm

 Mandriva Linux 2006.0:
 13f254622cce2b61e252b85f2b3b89df  2006.0/RPMS/libuim0-0.4.8-4.1.20060mdk.i586.rpm
 093f761ec0406e72463d0318cc58484a  2006.0/RPMS/libuim0-devel-0.4.8-4.1.20060mdk.i586.rpm
 97bb193739679b4b20312c26e63f750f  2006.0/RPMS/uim-0.4.8-4.1.20060mdk.i586.rpm
 eef6b766c1283e770d872d440f1ab8dc  2006.0/RPMS/uim-gtk-0.4.8-4.1.20060mdk.i586.rpm
 1c2a7bb3cb25ba173289098c3ce80b07  2006.0/RPMS/uim-qt-0.4.8-4.1.20060mdk.i586.rpm
 ad441f9127511a1e5b0d83472ae54862  2006.0/RPMS/uim-qtimmodule-0.4.8-4.1.20060mdk.i586.rpm
 58946cffcb345bbaaae8a3b2e5192a8f  2006.0/SRPMS/uim-0.4.8-4.1.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 6ccb325145baeed7ea30b78a367941dd  x86_64/2006.0/RPMS/lib64uim0-0.4.8-4.1.20060mdk.x86_64.rpm
 21465e1d5bb3a169053e5930ef03074d  x86_64/2006.0/RPMS/lib64uim0-devel-0.4.8-4.1.20060mdk.x86_64.rpm
 f0e752e8177553041fefa013ce4598df  x86_64/2006.0/RPMS/uim-0.4.8-4.1.20060mdk.x86_64.rpm
 3056648cfdbcfdb715106531dda70700  x86_64/2006.0/RPMS/uim-gtk-0.4.8-4.1.20060mdk.x86_64.rpm
 3f5264d09059fadc77229b696cbea267  x86_64/2006.0/RPMS/uim-qt-0.4.8-4.1.20060mdk.x86_64.rpm
 9d586985de4c10e879bcd699af023cae  x86_64/2006.0/RPMS/uim-qtimmodule-0.4.8-4.1.20060mdk.x86_64.rpm
 58946cffcb345bbaaae8a3b2e5192a8f  x86_64/2006.0/SRPMS/uim-0.4.8-4.1.20060mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFDX/cbmqjQ0CJFipgRAmtUAJ9uoYAcWo7lpfRjWo2Ak+rTEMx+EACfdO5R
ejHcUW3I/0IxlAoZNN+4qzo=
=YxAm
-----END PGP SIGNATURE-----