bugtraq - [ MDKSA-2007:013 ] - Updated libneon0.26 packages fix vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 12 Jan 2007 15:38:30 -0700
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2007:013 ] - Updated libneon0.26 packages fix vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:013
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : libneon0.26
 Date    : January 12, 2007
 Affected: 2007.0
 _______________________________________________________________________
 
 Problem Description:
 
 An array index error in the URI parser in neon 0.26.0 to 0.26.2 could
 possibly allow remote malicious servers to cause a crash via a URI with
 non-ASCII characters.  This vulnerability may only exist on 64bit
 systems.

 Updated packages are patched to address this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0157
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 1421f85cd23952a83277e289fb45cfaa  2007.0/i586/libneon0.26-0.26.1-2.1mdv2007.0.i586.rpm
 07660fed4e901cec7f221662b84c0065  2007.0/i586/libneon0.26-devel-0.26.1-2.1mdv2007.0.i586.rpm
 9ea39f058c170f92e3b64456a016bc2c  2007.0/i586/libneon0.26-static-devel-0.26.1-2.1mdv2007.0.i586.rpm 
 16dfa5adfcf08105e6a95ee6cc3a3c24  2007.0/SRPMS/libneon0.26-0.26.1-2.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 a1f3cf9e84b0c51c88751064a365b511  2007.0/x86_64/lib64neon0.26-0.26.1-2.1mdv2007.0.x86_64.rpm
 add591ef02ed13504a839a9c8b6030dc  2007.0/x86_64/lib64neon0.26-devel-0.26.1-2.1mdv2007.0.x86_64.rpm
 559f542e49f886a14176312679c6517d  2007.0/x86_64/lib64neon0.26-static-devel-0.26.1-2.1mdv2007.0.x86_64.rpm 
 16dfa5adfcf08105e6a95ee6cc3a3c24  2007.0/SRPMS/libneon0.26-0.26.1-2.1mdv2007.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFp+OgmqjQ0CJFipgRAuORAJ0df/3cfYqpFXGYH2dlsU8NeWpq8gCgtmQ3
zTjoxmOiONm2IQPijex6EVA=
=CWgi
-----END PGP SIGNATURE-----