full-disclosure - [ MDVSA-2009:041 ] jhead

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1LZUaz-0002xP-1o@titan.mandriva.com>
Date: Tue, 17 Feb 2009 19:23:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2009:041 ] jhead


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:041
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : jhead
 Date    : February 17, 2009
 Affected: 2008.0, 2008.1, 2009.0
 _______________________________________________________________________

 Problem Description:

 Security vulnerabilies have been identified and fixed in jhead.
 
 Buffer overflow in the DoCommand function in jhead before 2.84 might
 allow context-dependent attackers to cause a denial of service (crash)
 (CVE-2008-4575).
 
 Jhead before 2.84 allows local users to overwrite arbitrary files
 via a symlink attack on a temporary file (CVE-2008-4639).
 
 Jhead 2.84 and earlier allows local users to delete arbitrary files
 via vectors involving a modified input filename (CVE-2008-4640).
 
 jhead 2.84 and earlier allows attackers to execute arbitrary commands
 via shell metacharacters in unspecified input (CVE-2008-4641).
 
 This update provides the latest Jhead to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4575
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4639
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4640
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4641
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 441d3119c29e74427f8c8a2c2589450b  2008.0/i586/jhead-2.86-0.1mdv2008.0.i586.rpm 
 8275bd4ad7ed0ebca8f3936f291846eb  2008.0/SRPMS/jhead-2.86-0.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 371d922e6244a289a1ef0848d0a92076  2008.0/x86_64/jhead-2.86-0.1mdv2008.0.x86_64.rpm 
 8275bd4ad7ed0ebca8f3936f291846eb  2008.0/SRPMS/jhead-2.86-0.1mdv2008.0.src.rpm

 Mandriva Linux 2008.1:
 2c8593b1c6ee841645f8052d2262a694  2008.1/i586/jhead-2.86-0.1mdv2008.1.i586.rpm 
 72ef0127cabb83a5bea9a293002f5e59  2008.1/SRPMS/jhead-2.86-0.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 a62b13bfcfb21d59f3686ae93e9dcae8  2008.1/x86_64/jhead-2.86-0.1mdv2008.1.x86_64.rpm 
 72ef0127cabb83a5bea9a293002f5e59  2008.1/SRPMS/jhead-2.86-0.1mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 c08f58d5cce3c286cc40f94039e9daf1  2009.0/i586/jhead-2.86-0.1mdv2009.0.i586.rpm 
 da9d3f99a662ac543c837098e0648b46  2009.0/SRPMS/jhead-2.86-0.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 c070d4670f4a0059c04cb8863cb4dfb4  2009.0/x86_64/jhead-2.86-0.1mdv2009.0.x86_64.rpm 
 da9d3f99a662ac543c837098e0648b46  2009.0/SRPMS/jhead-2.86-0.1mdv2009.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJmtQBmqjQ0CJFipgRAideAJ9j4MRAHhsfB53neolPluMEpqjQvQCdE7nv
uJ7pvbSTAj4qYoG6h6nbeno=
=0qi7
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/