bugtraq - [ MDVSA-2009:106 ] libwmf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1M1Si9-0003v8-0J@titan.mandriva.com>
Date: Wed, 06 May 2009 00:02:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2009:106 ] libwmf


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:106
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libwmf
 Date    : May 5, 2009
 Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0
 _______________________________________________________________________

 Problem Description:

 Use-after-free vulnerability in the embedded GD library in libwmf
 0.2.8.4 allows context-dependent attackers to cause a denial of service
 (application crash) or possibly execute arbitrary code via a crafted
 WMF file (CVE-2009-1364).
 
 The updated packages have been patched to prevent this.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1364
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.1:
 2d342dc40ab150992cf1a8a6621fab7f  2008.1/i586/libwmf0.2_7-0.2.8.4-16.1mdv2008.1.i586.rpm
 7a0521fbdf9a6da2bffbf12aebf1715f  2008.1/i586/libwmf0.2_7-devel-0.2.8.4-16.1mdv2008.1.i586.rpm
 ba695656e60503bda08f70c925b8330e  2008.1/i586/libwmf-0.2.8.4-16.1mdv2008.1.i586.rpm 
 322e036dea7ba8140a18824005d9b92a  2008.1/SRPMS/libwmf-0.2.8.4-16.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 459bad68ba0653eb1bc6780e77751a93  2008.1/x86_64/lib64wmf0.2_7-0.2.8.4-16.1mdv2008.1.x86_64.rpm
 8618459d455aadfd73b92aed90b9cfe5  2008.1/x86_64/lib64wmf0.2_7-devel-0.2.8.4-16.1mdv2008.1.x86_64.rpm
 2cde8c262a9d16e137d138c59cfd9e8b  2008.1/x86_64/libwmf-0.2.8.4-16.1mdv2008.1.x86_64.rpm 
 322e036dea7ba8140a18824005d9b92a  2008.1/SRPMS/libwmf-0.2.8.4-16.1mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 e2b9bedbeb985a3c99006bba788934e9  2009.0/i586/libwmf0.2_7-0.2.8.4-17.1mdv2009.0.i586.rpm
 13d8a396ce0df792b8e4969cb9cde254  2009.0/i586/libwmf0.2_7-devel-0.2.8.4-17.1mdv2009.0.i586.rpm
 e71c42640bb10178a89169c8248dd01b  2009.0/i586/libwmf-0.2.8.4-17.1mdv2009.0.i586.rpm 
 59ff2c3574addc0a81bb6796c81904d3  2009.0/SRPMS/libwmf-0.2.8.4-17.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 f7cff966df6cf93f609cac9a6b3696e5  2009.0/x86_64/lib64wmf0.2_7-0.2.8.4-17.1mdv2009.0.x86_64.rpm
 2da8139058b46db4b2745aaec2ce02a5  2009.0/x86_64/lib64wmf0.2_7-devel-0.2.8.4-17.1mdv2009.0.x86_64.rpm
 518fd614057faf6d0f3e29ad0e7c7fa7  2009.0/x86_64/libwmf-0.2.8.4-17.1mdv2009.0.x86_64.rpm 
 59ff2c3574addc0a81bb6796c81904d3  2009.0/SRPMS/libwmf-0.2.8.4-17.1mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 6d180eab4e408273366ae5f093f1677c  2009.1/i586/libwmf0.2_7-0.2.8.4-17.1mdv2009.1.i586.rpm
 81f66bafa0a33afea19102cfe2706534  2009.1/i586/libwmf0.2_7-devel-0.2.8.4-17.1mdv2009.1.i586.rpm
 5d11c53dd0edd170621fc35ca508a9ce  2009.1/i586/libwmf-0.2.8.4-17.1mdv2009.1.i586.rpm 
 5f3069da8567b287d51b2a8376f2e4bf  2009.1/SRPMS/libwmf-0.2.8.4-17.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 5ccf282d020f5a79c5fda7e2c7d1230e  2009.1/x86_64/lib64wmf0.2_7-0.2.8.4-17.1mdv2009.1.x86_64.rpm
 43c1cc09b1d6aa8a1be1270a92f177e2  2009.1/x86_64/lib64wmf0.2_7-devel-0.2.8.4-17.1mdv2009.1.x86_64.rpm
 e60fb7a8cfc492b48946184d2981b6ef  2009.1/x86_64/libwmf-0.2.8.4-17.1mdv2009.1.x86_64.rpm 
 5f3069da8567b287d51b2a8376f2e4bf  2009.1/SRPMS/libwmf-0.2.8.4-17.1mdv2009.1.src.rpm

 Corporate 3.0:
 56348848bcbdeea3b3392c6e6eb50aa9  corporate/3.0/i586/libwmf0.2_7-0.2.8-6.6.C30mdk.i586.rpm
 b03ca678d92bf48fce95f0afdfdd98b5  corporate/3.0/i586/libwmf0.2_7-devel-0.2.8-6.6.C30mdk.i586.rpm
 a3e45d91ca75b796115b15a1e299e43e  corporate/3.0/i586/libwmf-0.2.8-6.6.C30mdk.i586.rpm 
 fb1a17a5e64ba156b386a94cbbc52355  corporate/3.0/SRPMS/libwmf-0.2.8-6.6.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 54cd23ce8d40499970f26dbd841ab8a6  corporate/3.0/x86_64/lib64wmf0.2_7-0.2.8-6.6.C30mdk.x86_64.rpm
 089cadda8c879d3e4aed68e4b0feccd4  corporate/3.0/x86_64/lib64wmf0.2_7-devel-0.2.8-6.6.C30mdk.x86_64.rpm
 adbfbafa64eeb734f21fc8f8483c2f7b  corporate/3.0/x86_64/libwmf-0.2.8-6.6.C30mdk.x86_64.rpm 
 fb1a17a5e64ba156b386a94cbbc52355  corporate/3.0/SRPMS/libwmf-0.2.8-6.6.C30mdk.src.rpm

 Corporate 4.0:
 48a7c42b8e4bd5465ce3acb4e2f03d19  corporate/4.0/i586/libwmf0.2_7-0.2.8.3-6.6.20060mlcs4.i586.rpm
 ee957f0a4c3fe69d50aa2b8ce9bad619  corporate/4.0/i586/libwmf0.2_7-devel-0.2.8.3-6.6.20060mlcs4.i586.rpm
 d99ed07d9087627101ec3a6bfc8ddf13  corporate/4.0/i586/libwmf-0.2.8.3-6.6.20060mlcs4.i586.rpm 
 a1c9970e6f7317d4776decc4f4b02665  corporate/4.0/SRPMS/libwmf-0.2.8.3-6.6.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 be0efb665fb41259f3e49db45bf86bf7  corporate/4.0/x86_64/lib64wmf0.2_7-0.2.8.3-6.6.20060mlcs4.x86_64.rpm
 9f199425e1d97dd0d7b5c50f40316baa  corporate/4.0/x86_64/lib64wmf0.2_7-devel-0.2.8.3-6.6.20060mlcs4.x86_64.rpm
 576d6e1efd6b83ea226a2ad656a71f04  corporate/4.0/x86_64/libwmf-0.2.8.3-6.6.20060mlcs4.x86_64.rpm 
 a1c9970e6f7317d4776decc4f4b02665  corporate/4.0/SRPMS/libwmf-0.2.8.3-6.6.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKAIpfmqjQ0CJFipgRAl/bAJ0fCNQ4BMjoTrJisl5ISSH/iVfBJACgiCNf
WpHdeUhRY1FcZ+dRrYMBm6o=
=iHYX
-----END PGP SIGNATURE-----