full-disclosure - [USN-772-1] MPFR vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1241720833.5979.11.camel@mdlinux.technorage.com>
Date: Thu, 07 May 2009 14:27:13 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-772-1] MPFR vulnerability

===========================================================
Ubuntu Security Notice USN-772-1               May 07, 2009
mpfr vulnerability
CVE-2009-0757
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.04:
  lib64mpfr1                      2.4.0-1ubuntu3.1
  libmpfr1ldbl                    2.4.0-1ubuntu3.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that MPFR improperly handled string lengths in its print
routines. If a user or automated system were tricked into processing
specially crafted data with applications linked against MPFR, an attacker
could cause a denial of service or execute arbitrary code with privileges
of the user invoking the program.


Updated packages for Ubuntu 9.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0-1ubuntu3.1.diff.gz
      Size/MD5:     7603 d996b99c39cae2d82db24bd5f123ade1
    http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0-1ubuntu3.1.dsc
      Size/MD5:     1316 a28e504aedb1c804af4b7156a9dc3573
    http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0.orig.tar.gz
      Size/MD5:  1336846 232f9d6917898e8277041bcc046fbb72

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-doc_2.4.0-1ubuntu3.1_all.deb
      Size/MD5:   645652 a0041c74091777ecc87686fab37ab1da

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_amd64.deb
      Size/MD5:   459986 a9e110cdaf84103c6c8c5c1b09aa11a8
    http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_amd64.deb
      Size/MD5:   417730 6fba616c8ab42fda163bd35a5993d5e5

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_i386.deb
      Size/MD5:   431566 872b92cab9aa82122435a6d80c3dabb7
    http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_i386.deb
      Size/MD5:   404100 81cee51ae17a92f65a8fe8881c0417ca

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_lpia.deb
      Size/MD5:   433150 d60c4b1377d722bcdfb881480079e089
    http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_lpia.deb
      Size/MD5:   404108 eb59aaaefdfa8bf954ca16be35c61896

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/m/mpfr/lib64mpfr-dev_2.4.0-1ubuntu3.1_powerpc.deb
      Size/MD5:   461744 a943b5f7d8566cb91405ff162e07bf14
    http://ports.ubuntu.com/pool/main/m/mpfr/lib64mpfr1_2.4.0-1ubuntu3.1_powerpc.deb
      Size/MD5:   407042 8646e75a38bc8c0f28ab5478a768ffdc
    http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_powerpc.deb
      Size/MD5:   469676 05b5927c2c359dcf8060d00e14cde769
    http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_powerpc.deb
      Size/MD5:   421772 e209d7e0b960f4c734547b0fc71fe56d

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_sparc.deb
      Size/MD5:   444678 14b90d05922e55b437b7bf613f7a2fce
    http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_sparc.deb
      Size/MD5:   403328 5af0d9a4665f3bdeb58755e32235aceb



Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/