full-disclosure - [ MDKSA-2006:157 ] - Updated musicbrainz packages fix buffer overflow vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1GIYwa-0003CF-MD@mercury.mandriva.com>
Date: Wed, 30 Aug 2006 16:54:00 -0600
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDKSA-2006:157 ] - Updated musicbrainz packages
	fix buffer overflow vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDKSA-2006:157
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : musicbrainz
 Date    : August 30, 2006
 Affected: 2006.0
 _______________________________________________________________________

 Problem Description:

 Multiple buffer overflows in libmusicbrainz (aka mb_client or
 MusicBrainz Client Library) 2.1.2 and earlier, and SVN 8406 and
 earlier, allow remote attackers to cause a denial of service (crash)
 or execute arbitrary code via (1) a long Location header by the HTTP
 server, which triggers an overflow in the MBHttp::Download function in
 lib/http.cpp; and (2) a long URL in RDF data, as demonstrated by a URL
 in an rdf:resource field in an RDF XML document, which triggers
 overflows in many functions in lib/rdfparse.c.

 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4197
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2006.0:
 7f958824f626937333164370204436a4  2006.0/RPMS/libmusicbrainz4-2.1.1-3.2.20060mdk.i586.rpm
 2e46ed494e52fb2ef47274ffd8f89e9b  2006.0/RPMS/libmusicbrainz4-devel-2.1.1-3.2.20060mdk.i586.rpm
 ed0c309b2d648ea55cadec0383ede538  2006.0/SRPMS/musicbrainz-2.1.1-3.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 85270a120b6da2fdfe9e72e09394a479  x86_64/2006.0/RPMS/lib64musicbrainz4-2.1.1-3.2.20060mdk.x86_64.rpm
 6555da767d22f9f65ee5726f458e001a  x86_64/2006.0/RPMS/lib64musicbrainz4-devel-2.1.1-3.2.20060mdk.x86_64.rpm
 ed0c309b2d648ea55cadec0383ede538  x86_64/2006.0/SRPMS/musicbrainz-2.1.1-3.2.20060mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFE9et5mqjQ0CJFipgRAh3XAKChOvajLTbHLyl0cFImOiCTnjADPwCg0igS
uy9EYU4HhQ59q7iI27036A8=
=QGeJ
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/