lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Wed Oct 26 22:31:06 2005
From: security at (Mandriva Security Team)
Subject: MDKSA-2005:193-1 - Updated ethereal packages fix
	multiple vulnerabilities

Hash: SHA1

 Mandriva Linux Security Advisory                       MDKSA-2005:193-1
 Package : ethereal
 Date    : October 26, 2005
 Affected: 10.2, 2006.0
 Problem Description:
 Ethereal 0.10.13 is now available fixing a number of security
 vulnerabilities in various dissectors:
 - the ISAKMP dissector could exhaust system memory
 - the FC-FCS dissector could exhaust system memory
 - the RSVP dissector could exhaust system memory
 - the ISIS LSP dissector could exhaust system memory
 - the IrDA dissector could crash
 - the SLIMP3 dissector could overflow a buffer
 - the BER dissector was susceptible to an infinite loop
 - the SCSI dissector could dereference a null pointer and crash
 - the sFlow dissector could dereference a null pointer and crash
 - the RTnet dissector could dereference a null pointer and crash
 - the SigComp UDVM could go into an infinite loop or crash
 - the X11 dissector could attempt to divide by zero
 - if SMB transaction payload reassembly is enabled the SMB dissector
   could crash (by default this is disabled)
 - if the "Dissect unknown RPC program numbers" option was enabled, the
   ONC RPC dissector might be able to exhaust system memory (by default
   this is disabled)
 - the AgentX dissector could overflow a buffer
 - the WSP dissector could free an invalid pointer
 - iDEFENSE discovered a buffer overflow in the SRVLOC dissector
 The new version of Ethereal is provided and corrects all of these


 An infinite loop in the IRC dissector was also discovered and fixed
 after the 0.10.13 release.  The updated packages include the fix.

 Updated Packages:
 Mandriva Linux 10.2:
 30d68fb7d3dd3e10f99ce0e4067e29e3  10.2/RPMS/ethereal-0.10.13-0.2.102mdk.i586.rpm
 ee195abe7f3fd9abe3db39cd3b497a8c  10.2/RPMS/ethereal-tools-0.10.13-0.2.102mdk.i586.rpm
 8930ea673040d37f41ad955412ba3623  10.2/RPMS/libethereal0-0.10.13-0.2.102mdk.i586.rpm
 3bc4bd7208feaf92f77f3a83b0f3281b  10.2/RPMS/tethereal-0.10.13-0.2.102mdk.i586.rpm
 7fe65f07557a9dcb662eb1b6967ce31f  10.2/SRPMS/ethereal-0.10.13-0.2.102mdk.src.rpm

 Mandriva Linux 10.2/X86_64:
 cb69d27d896a19a03fe1c05effffe98d  x86_64/10.2/RPMS/ethereal-0.10.13-0.2.102mdk.x86_64.rpm
 28dca424f2fdef25ab9b5f2115c7b577  x86_64/10.2/RPMS/ethereal-tools-0.10.13-0.2.102mdk.x86_64.rpm
 b47935d8d59d817e69b54d2487e12445  x86_64/10.2/RPMS/lib64ethereal0-0.10.13-0.2.102mdk.x86_64.rpm
 e717805302885ba4af36a16768f93668  x86_64/10.2/RPMS/tethereal-0.10.13-0.2.102mdk.x86_64.rpm
 7fe65f07557a9dcb662eb1b6967ce31f  x86_64/10.2/SRPMS/ethereal-0.10.13-0.2.102mdk.src.rpm

 Mandriva Linux 2006.0:
 993d95642384bf74c9ed2f7279caa3b2  2006.0/RPMS/ethereal-0.10.13-0.2.20060mdk.i586.rpm
 a8cb961f3fee116724f8af4ce64f8244  2006.0/RPMS/ethereal-tools-0.10.13-0.2.20060mdk.i586.rpm
 ef572149f1c053ddcf47afa4c704ca58  2006.0/RPMS/libethereal0-0.10.13-0.2.20060mdk.i586.rpm
 21d6112631fa025e0b01b2fe7698aada  2006.0/RPMS/tethereal-0.10.13-0.2.20060mdk.i586.rpm
 04595febee4cf49a9e851563ef8975c9  2006.0/SRPMS/ethereal-0.10.13-0.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 a1af50cf48c2d44c44b0068ee265609f  x86_64/2006.0/RPMS/ethereal-0.10.13-0.2.20060mdk.x86_64.rpm
 c4c26c4bcd136c8a8d540c62e51ba8f5  x86_64/2006.0/RPMS/ethereal-tools-0.10.13-0.2.20060mdk.x86_64.rpm
 fc393647ae421ef0e9b60967bc22b65e  x86_64/2006.0/RPMS/lib64ethereal0-0.10.13-0.2.20060mdk.x86_64.rpm
 ca89deabfae41880a7e37e6e70451caf  x86_64/2006.0/RPMS/tethereal-0.10.13-0.2.20060mdk.x86_64.rpm
 04595febee4cf49a9e851563ef8975c9  x86_64/2006.0/SRPMS/ethereal-0.10.13-0.2.20060mdk.src.rpm

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver 0x22458A98

 You can view other update advisories for Mandriva Linux at:

 If you want to report vulnerabilities, please contact


 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.2.4 (GNU/Linux)


Powered by blists - more mailing lists