full-disclosure - [ MDVSA-2008:037 ] - Updated libcdio packages fix DoS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1JNDR8-0006BV-4c@artemis.annvix.ca>
Date: Thu, 07 Feb 2008 13:33:34 -0700
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2008:037 ] - Updated libcdio packages fix
	DoS vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:037
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : libcdio
 Date    : February 7, 2008
 Affected: 2007.0, 2007.1, 2008.0, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 A stack-based buffer overflow was discovered in libcdio that allowed
 context-dependent attackers to cause a denial of service (core dump)
 and possibly execute arbitrary code via a disk or image file that
 contains a long joliet file name.
 
 In addition, a fix for failed UTF-8 conversions that would cause a
 segfault on certain ISOs was also fixed.
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6613
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 2c9cc285e6eaa1590987c2e604374439  2007.0/i586/libcdio++0-0.77-3.3mdv2007.0.i586.rpm
 0b93aeb47499d446452aa9d38e169439  2007.0/i586/libcdio-apps-0.77-3.3mdv2007.0.i586.rpm
 25e9a94f055a091e7bca1f25db1d109f  2007.0/i586/libcdio7-0.77-3.3mdv2007.0.i586.rpm
 2e92352d2390c09fd07bfb27c7803683  2007.0/i586/libcdio7-devel-0.77-3.3mdv2007.0.i586.rpm
 1175e0443c0369d044d15c88b81bab67  2007.0/i586/libcdio7-static-devel-0.77-3.3mdv2007.0.i586.rpm
 faca07c524f4a0c1c4809bb0b16989ec  2007.0/i586/libcdio_cdda0-0.77-3.3mdv2007.0.i586.rpm
 eb28fbf60618126b00db5663908596d0  2007.0/i586/libiso9660_5-0.77-3.3mdv2007.0.i586.rpm 
 88c25e6295c9fbfdee8be9a60ec6fc94  2007.0/SRPMS/libcdio-0.77-3.3mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 bc3662e2a43469d0aaec0277c4167e47  2007.0/x86_64/lib64cdio++0-0.77-3.3mdv2007.0.x86_64.rpm
 da9f36e50f71e5afe0a5f08e23ab7c30  2007.0/x86_64/lib64cdio7-0.77-3.3mdv2007.0.x86_64.rpm
 30d8b1a2176c46bf9f7451733acc2fc0  2007.0/x86_64/lib64cdio7-devel-0.77-3.3mdv2007.0.x86_64.rpm
 3b011dd17ba6e31105e4149239e14458  2007.0/x86_64/lib64cdio7-static-devel-0.77-3.3mdv2007.0.x86_64.rpm
 f25134c5c3762ab484ef8f9efbcb565c  2007.0/x86_64/lib64cdio_cdda0-0.77-3.3mdv2007.0.x86_64.rpm
 43678be8297a1e799d0569ec99734f16  2007.0/x86_64/lib64iso9660_5-0.77-3.3mdv2007.0.x86_64.rpm
 6ec850f608d4dae487fc686b3674200c  2007.0/x86_64/libcdio-apps-0.77-3.3mdv2007.0.x86_64.rpm 
 88c25e6295c9fbfdee8be9a60ec6fc94  2007.0/SRPMS/libcdio-0.77-3.3mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 015616a97d2892a7309820c6f30e0bc2  2007.1/i586/libcdio++0-0.78.2-1.3mdv2007.1.i586.rpm
 483f5d6820b65fe8a2c9624041e5e421  2007.1/i586/libcdio-apps-0.78.2-1.3mdv2007.1.i586.rpm
 2e1b5d579e9dead1a43fead7a928942b  2007.1/i586/libcdio-devel-0.78.2-1.3mdv2007.1.i586.rpm
 d6a4926d0b4e1a09138945a7d769abf3  2007.1/i586/libcdio-static-devel-0.78.2-1.3mdv2007.1.i586.rpm
 d43c19e428089a724c50f0a181d86205  2007.1/i586/libcdio7-0.78.2-1.3mdv2007.1.i586.rpm
 a530b7c47f94a01e85d586d8c2acc9b1  2007.1/i586/libcdio_cdda0-0.78.2-1.3mdv2007.1.i586.rpm
 427d7ef2f84584da59bf46fa8c6fbca9  2007.1/i586/libiso9660_5-0.78.2-1.3mdv2007.1.i586.rpm 
 ed03d91688897301ad3de8194af269bc  2007.1/SRPMS/libcdio-0.78.2-1.3mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 70474d9f0a13187ef8cce53775af6bdc  2007.1/x86_64/lib64cdio++0-0.78.2-1.3mdv2007.1.x86_64.rpm
 4824f3576666c2cb03f4070428f24a05  2007.1/x86_64/lib64cdio-devel-0.78.2-1.3mdv2007.1.x86_64.rpm
 0bf6a7e35e2bce1c76b6edc85e9eb5a1  2007.1/x86_64/lib64cdio-static-devel-0.78.2-1.3mdv2007.1.x86_64.rpm
 470191c5314cdb2f7699b105c156026f  2007.1/x86_64/lib64cdio7-0.78.2-1.3mdv2007.1.x86_64.rpm
 23d262db4df2eb09f5d5d9b9d1be73ad  2007.1/x86_64/lib64cdio_cdda0-0.78.2-1.3mdv2007.1.x86_64.rpm
 1d2fbe5a1976d2b959b4a9803a84eed0  2007.1/x86_64/lib64iso9660_5-0.78.2-1.3mdv2007.1.x86_64.rpm
 626c51a013c96f8af70c035060245732  2007.1/x86_64/libcdio-apps-0.78.2-1.3mdv2007.1.x86_64.rpm 
 ed03d91688897301ad3de8194af269bc  2007.1/SRPMS/libcdio-0.78.2-1.3mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 e3eb0c870ab4b9a1edafca77816fc5fc  2008.0/i586/libcdio++0-0.78.2-1.3mdv2008.0.i586.rpm
 08dcca55b6249b4600f144ee82408cff  2008.0/i586/libcdio-apps-0.78.2-1.3mdv2008.0.i586.rpm
 2cc1f700b7d3cc1f6421dbd981f66174  2008.0/i586/libcdio-devel-0.78.2-1.3mdv2008.0.i586.rpm
 229faf0dfa36e61e0dd2e01faa816930  2008.0/i586/libcdio-static-devel-0.78.2-1.3mdv2008.0.i586.rpm
 a0782d56dd832c6fd354185051f6ea6f  2008.0/i586/libcdio7-0.78.2-1.3mdv2008.0.i586.rpm
 217a974e232e1fe10391f9cf85e7282c  2008.0/i586/libcdio_cdda0-0.78.2-1.3mdv2008.0.i586.rpm
 a445bc8f518b77021e077f7e57025f63  2008.0/i586/libiso9660_5-0.78.2-1.3mdv2008.0.i586.rpm 
 f1f88dd612afd6216bfcba8fdfeda2a9  2008.0/SRPMS/libcdio-0.78.2-1.3mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 0efe21f68f68c5fe5bd60dc7ffb2b3ef  2008.0/x86_64/lib64cdio++0-0.78.2-1.3mdv2008.0.x86_64.rpm
 03e8dc953895d2e81e1af0e868441c68  2008.0/x86_64/lib64cdio-devel-0.78.2-1.3mdv2008.0.x86_64.rpm
 472d25bf85fafd52e073c7841f15c7e5  2008.0/x86_64/lib64cdio-static-devel-0.78.2-1.3mdv2008.0.x86_64.rpm
 954c045e33b39cb679c9298a4927de42  2008.0/x86_64/lib64cdio7-0.78.2-1.3mdv2008.0.x86_64.rpm
 fe746e1ae207d8322e03f51f0b260ae6  2008.0/x86_64/lib64cdio_cdda0-0.78.2-1.3mdv2008.0.x86_64.rpm
 137922e931d94b992e9ab246a0c2488f  2008.0/x86_64/lib64iso9660_5-0.78.2-1.3mdv2008.0.x86_64.rpm
 d4ec5858a6c36a50948921b94173a0c3  2008.0/x86_64/libcdio-apps-0.78.2-1.3mdv2008.0.x86_64.rpm 
 f1f88dd612afd6216bfcba8fdfeda2a9  2008.0/SRPMS/libcdio-0.78.2-1.3mdv2008.0.src.rpm

 Corporate 4.0:
 e3ffa54c3352c16ceec69da17bd6bad2  corporate/4.0/i586/libcdio-apps-0.75-2.3.20060mlcs4.i586.rpm
 8267aa6560b8bfba5627612f8d5856da  corporate/4.0/i586/libcdio6-0.75-2.3.20060mlcs4.i586.rpm
 1aa85ccfb99f88e22837f11f5404d3f6  corporate/4.0/i586/libcdio6-devel-0.75-2.3.20060mlcs4.i586.rpm
 b2693881bb56f168d9cff12dd0449f03  corporate/4.0/i586/libcdio6-static-devel-0.75-2.3.20060mlcs4.i586.rpm
 957697031d34545a7673206368e0607c  corporate/4.0/i586/libcdio_cdda0-0.75-2.3.20060mlcs4.i586.rpm
 d08da96ba13eae5c5b9d71160fc1c784  corporate/4.0/i586/libiso9660_4-0.75-2.3.20060mlcs4.i586.rpm 
 544367bbb5c9f4b0cf13e3e1f4847b25  corporate/4.0/SRPMS/libcdio-0.75-2.3.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 f2d1c4534de96a39c68a4e34029d953c  corporate/4.0/x86_64/lib64cdio6-0.75-2.3.20060mlcs4.x86_64.rpm
 fd5e870ac62e863fe29dbca597030fbf  corporate/4.0/x86_64/lib64cdio6-devel-0.75-2.3.20060mlcs4.x86_64.rpm
 136ed4e57be4d922b2eb5ffe4c51991b  corporate/4.0/x86_64/lib64cdio6-static-devel-0.75-2.3.20060mlcs4.x86_64.rpm
 8a3954b8da2d157591467e60d36b907f  corporate/4.0/x86_64/lib64cdio_cdda0-0.75-2.3.20060mlcs4.x86_64.rpm
 c113ef04258a71ea65fdffb7e014ab59  corporate/4.0/x86_64/lib64iso9660_4-0.75-2.3.20060mlcs4.x86_64.rpm
 53446335d5f05f02fa29f0d8b82029c9  corporate/4.0/x86_64/libcdio-apps-0.75-2.3.20060mlcs4.x86_64.rpm 
 544367bbb5c9f4b0cf13e3e1f4847b25  corporate/4.0/SRPMS/libcdio-0.75-2.3.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHqz/bmqjQ0CJFipgRAgeMAJ9k7tM4Y9GWeSgWjbDrxpPC7S9gaQCcCCvH
arDFtHWkwhcvB5BxGO84kCI=
=kjqq
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/