| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-id: <E1INCsP-0002EB-6L@artemis.annvix.ca> Date: Mon, 20 Aug 2007 13:25:25 -0600 From: security@...driva.com To: full-disclosure@...ts.grok.org.uk Subject: [ MDKSA-2007:167-1 ] - Updated libvorbis packages fix vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2007:167-1 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libvorbis Date : August 20, 2007 Affected: 2007.1 _______________________________________________________________________ Problem Description: David Thiel discovered that libvorbis did not correctly verify the size of certain headers, and did not correctly clean up a broken stream. If a user were tricked into processing a specially crafted Vorbis stream, a remote attacker could possibly cause a denial of service or execute arbitrary code with the user's privileges. Update: Due to a packaging problem, the libvorbis development package was not able to be upgraded on Mandriva Linux 2007.1 This has been corrected with this new update. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3106 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4029 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.1: 2e0f3ba6bab84829f4eb5602610f0283 2007.1/i586/libvorbis0-1.1.2-1.2mdv2007.1.i586.rpm 4c1f8bf27383b5e60a83c877e82c6d28 2007.1/i586/libvorbis0-devel-1.1.2-1.2mdv2007.1.i586.rpm bb34b14893244635f9babcec95f0a4c6 2007.1/i586/libvorbisenc2-1.1.2-1.2mdv2007.1.i586.rpm 70a25cd8bd2d7401d0e6856cac302181 2007.1/i586/libvorbisfile3-1.1.2-1.2mdv2007.1.i586.rpm 74aafd22d2b5a3bbb22b22256436cc24 2007.1/SRPMS/libvorbis-1.1.2-1.2mdv2007.1.src.rpm Mandriva Linux 2007.1/X86_64: 7dfa1037d95c4a177486d1a86bd53541 2007.1/x86_64/lib64vorbis0-1.1.2-1.2mdv2007.1.x86_64.rpm 036c3670b57f6a0b142562e21134a103 2007.1/x86_64/lib64vorbis0-devel-1.1.2-1.2mdv2007.1.x86_64.rpm bf09716e4000c8fd92870fd037e7eef8 2007.1/x86_64/lib64vorbisenc2-1.1.2-1.2mdv2007.1.x86_64.rpm 88c10d6028086f241ae32b20ee192a87 2007.1/x86_64/lib64vorbisfile3-1.1.2-1.2mdv2007.1.x86_64.rpm 74aafd22d2b5a3bbb22b22256436cc24 2007.1/SRPMS/libvorbis-1.1.2-1.2mdv2007.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGycBYmqjQ0CJFipgRAsIaAKCNKOjD/hvRK/l4Ux5CGAR90n3YYgCgiRTp Ch5TP/RwBTZ4GudyHdXm5qo= =ssHw -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists