full-disclosure - [ MDVSA-2009:208 ] libgadu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1MeBYP-0003db-BX@titan.mandriva.com>
Date: Thu, 20 Aug 2009 19:36:01 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2009:208 ] libgadu


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:208
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libgadu
 Date    : August 20, 2009
 Affected: 2008.1, 2009.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in libgadu:
 
 libgadu before 1.8.2 allows remote servers to cause a denial of service
 (crash) via a contact description with a large length, which triggers
 a buffer over-read (CVE-2008-4776).
 
 This update provides a solution to this vulnerability.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4776
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.1:
 1c0af6f00f073390ff69e6844394b813  2008.1/i586/libgadu3-1.8.0-1.1mdv2008.1.i586.rpm
 6d6fc79f0f8ea9deaa79f67013be103b  2008.1/i586/libgadu-devel-1.8.0-1.1mdv2008.1.i586.rpm 
 1a9d6c02ec1b2683253d1058f6a52ffc  2008.1/SRPMS/libgadu-1.8.0-1.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 673242fd7da029005a1fdcea295fe576  2008.1/x86_64/lib64gadu3-1.8.0-1.1mdv2008.1.x86_64.rpm
 5fe5265aa0a7f2a767b6b63d3dc4a00e  2008.1/x86_64/lib64gadu-devel-1.8.0-1.1mdv2008.1.x86_64.rpm 
 1a9d6c02ec1b2683253d1058f6a52ffc  2008.1/SRPMS/libgadu-1.8.0-1.1mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 a1c0c94b882c442897074c473bd7c432  2009.0/i586/libgadu3-1.8.1-2.1mdv2009.0.i586.rpm
 27f122bbc778314bc59f929f5efc4bd9  2009.0/i586/libgadu-devel-1.8.1-2.1mdv2009.0.i586.rpm 
 4e46ebf53c466e5afc61f740db59ef1e  2009.0/SRPMS/libgadu-1.8.1-2.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 d163436eefbc29409fb42289596f8ea9  2009.0/x86_64/lib64gadu3-1.8.1-2.1mdv2009.0.x86_64.rpm
 19bd5071b0ba3a348e846d177b5952eb  2009.0/x86_64/lib64gadu-devel-1.8.1-2.1mdv2009.0.x86_64.rpm 
 4e46ebf53c466e5afc61f740db59ef1e  2009.0/SRPMS/libgadu-1.8.1-2.1mdv2009.0.src.rpm

 Mandriva Enterprise Server 5:
 8618cf0c0b55a33249f2551b4c1cd2a8  mes5/i586/libgadu3-1.8.1-2.1mdvmes5.i586.rpm
 f5507588a57548cb6215b64c0e05a9da  mes5/i586/libgadu-devel-1.8.1-2.1mdvmes5.i586.rpm 
 343437290b1c8e4204d19fa3248f2388  mes5/SRPMS/libgadu-1.8.1-2.1mdvmes5.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 895a408fecee913966d93b26175edae3  mes5/x86_64/lib64gadu3-1.8.1-2.1mdvmes5.x86_64.rpm
 f76383153c792fd9fd4f3cd149d9aa83  mes5/x86_64/lib64gadu-devel-1.8.1-2.1mdvmes5.x86_64.rpm 
 343437290b1c8e4204d19fa3248f2388  mes5/SRPMS/libgadu-1.8.1-2.1mdvmes5.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKjVyQmqjQ0CJFipgRAsv2AKCoSFfc++y+Vn28wQTz8d5KS8yu5QCg33TN
39RyhVm7nN1ECwka+QoksSs=
=B9vQ
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/