full-disclosure - MDKSA-2005:194 - Updated php-imap packages fix buffer overflow vulnerabilities.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E1EUssI-0001e3-NW@mercury.mandriva.com>
Date: Wed Oct 26 22:32:21 2005
From: security at mandriva.com (Mandriva Security Team)
Subject: MDKSA-2005:194 - Updated php-imap packages fix
	buffer overflow vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2005:194
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : php-imap
 Date    : October 26, 2005
 Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0
 _______________________________________________________________________
 
 Problem Description:
 
 "infamous41md" discovered a buffer overflow in uw-imap, the
 University of Washington's IMAP Server that allows attackers to
 execute arbitrary code.
 
 php-imap is compiled against the static c-client libs from imap.
 These packages have been recompiled against the updated imap
 development packages.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2933
 _______________________________________________________________________
 
 Updated Packages:
 
 Corporate Server 2.1:
 9be9a883ded639585446c6d5de663421  corporate/2.1/RPMS/php-imap-4.2.3-1.1.C21mdk.i586.rpm
 4ac16712b0354cd3a3a900a531d18f75  corporate/2.1/SRPMS/php-imap-4.2.3-1.1.C21mdk.src.rpm

 Corporate Server 2.1/X86_64:
 03a4ef56e03fc2ca25a3234af2f3da17  x86_64/corporate/2.1/RPMS/php-imap-4.2.3-1.1.C21mdk.x86_64.rpm
 4ac16712b0354cd3a3a900a531d18f75  x86_64/corporate/2.1/SRPMS/php-imap-4.2.3-1.1.C21mdk.src.rpm

 Mandriva Linux 10.1:
 959a1497572aa4f2871b6d2650795883  10.1/RPMS/php-imap-4.3.8-1.1.101mdk.i586.rpm
 b41e8d05335694fa522c403c96ca3987  10.1/SRPMS/php-imap-4.3.8-1.1.101mdk.src.rpm

 Mandriva Linux 10.1/X86_64:
 ebe83f9574925da13ddd1f4b75688fa8  x86_64/10.1/RPMS/php-imap-4.3.8-1.1.101mdk.x86_64.rpm
 b41e8d05335694fa522c403c96ca3987  x86_64/10.1/SRPMS/php-imap-4.3.8-1.1.101mdk.src.rpm

 Corporate 3.0:
 fdd36f4022e376a0df36260ae27d76f1  corporate/3.0/RPMS/php-imap-4.3.4-1.1.C30mdk.i586.rpm
 8321651ffc58801ca272b98e64a385d0  corporate/3.0/SRPMS/php-imap-4.3.4-1.1.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 44c3cdadf20366f41536cbdc2c1e1748  x86_64/corporate/3.0/RPMS/php-imap-4.3.4-1.1.C30mdk.x86_64.rpm
 8321651ffc58801ca272b98e64a385d0  x86_64/corporate/3.0/SRPMS/php-imap-4.3.4-1.1.C30mdk.src.rpm

 Mandriva Linux 10.2:
 7ea50a18385970beb115e262c35bc2fa  10.2/RPMS/php-imap-4.3.10-6.1.102mdk.i586.rpm
 78fa0456168d2156594aac90a196cd2b  10.2/SRPMS/php-imap-4.3.10-6.1.102mdk.src.rpm

 Mandriva Linux 10.2/X86_64:
 fe794754ac58a7f91bffb071175d2176  x86_64/10.2/RPMS/php-imap-4.3.10-6.1.102mdk.x86_64.rpm
 78fa0456168d2156594aac90a196cd2b  x86_64/10.2/SRPMS/php-imap-4.3.10-6.1.102mdk.src.rpm

 Mandriva Linux 2006.0:
 7ebb8d2b7e9c2c876f4fde7c830aaa45  2006.0/RPMS/php-imap-5.0.4-2.1.20060mdk.i586.rpm
 422822aaad1b121dc6cffbea414b33e3  2006.0/SRPMS/php-imap-5.0.4-2.1.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 9217687789293eaaca8a66b44c00f196  x86_64/2006.0/RPMS/php-imap-5.0.4-2.1.20060mdk.x86_64.rpm
 422822aaad1b121dc6cffbea414b33e3  x86_64/2006.0/SRPMS/php-imap-5.0.4-2.1.20060mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFDX/XOmqjQ0CJFipgRAoc5AJ4l0wV9KTPTBeBaDi4VG6H7P63cwwCeJVQw
8eNfZ0bDyReJDLMmWbVbmhM=
=iKZU
-----END PGP SIGNATURE-----