full-disclosure - [ MDVSA-2010:010 ] libthai

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1NWDY4-0005J6-Nn@titan.mandriva.com>
Date: Sat, 16 Jan 2010 19:39:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:010 ] libthai


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:010
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libthai
 Date    : January 16, 2010
 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in libthai:
 
 Tim Starling discovered that libthai, a set of Thai language support
 routines, is vulnerable of integer/heap overflow. This vulnerability
 could allow an attacker to run arbitrary code by sending a very long
 string (CVE-2009-4012).
 
 Packages for 2008.0 are provided for Corporate Desktop 2008.0
 customers.
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4012
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 39f2a5152fa1a24e61b44e3d3457b510  2008.0/i586/libthai0-0.1.9-3.1mdv2008.0.i586.rpm
 668b0599c98e9276276e40288f52e7f6  2008.0/i586/libthai-devel-0.1.9-3.1mdv2008.0.i586.rpm
 e76932108fd20cbfed5b1cd604ac8d3f  2008.0/i586/thai-data-0.1.9-3.1mdv2008.0.i586.rpm 
 280dc7e1d2c4bef4b0570cc75b2a0fe5  2008.0/SRPMS/libthai-0.1.9-3.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 6a916d184752f18ad6e1653f60ef3b8b  2008.0/x86_64/lib64thai0-0.1.9-3.1mdv2008.0.x86_64.rpm
 b2c32c7291bac1d7ba16054ccf61b1d5  2008.0/x86_64/lib64thai-devel-0.1.9-3.1mdv2008.0.x86_64.rpm
 01b4a1988713860149b8b0a7123e449e  2008.0/x86_64/thai-data-0.1.9-3.1mdv2008.0.x86_64.rpm 
 280dc7e1d2c4bef4b0570cc75b2a0fe5  2008.0/SRPMS/libthai-0.1.9-3.1mdv2008.0.src.rpm

 Mandriva Linux 2009.0:
 267484277b5d45549f2cea9f1f7e8c47  2009.0/i586/libthai0-0.1.9-7.1mdv2009.0.i586.rpm
 a452e05c9fed0a0c5b78eb2e4ee1116f  2009.0/i586/libthai-devel-0.1.9-7.1mdv2009.0.i586.rpm
 990e5e25dfa94ff7337c9afac5638f55  2009.0/i586/thai-data-0.1.9-7.1mdv2009.0.i586.rpm 
 f0eca7369c6fcc3470a0cb731199b213  2009.0/SRPMS/libthai-0.1.9-7.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 00a932b3b0c47dfb9a7bd6182faf5ccf  2009.0/x86_64/lib64thai0-0.1.9-7.1mdv2009.0.x86_64.rpm
 18e91e2868d69065686100a28ad5245c  2009.0/x86_64/lib64thai-devel-0.1.9-7.1mdv2009.0.x86_64.rpm
 e6399cd45aea4759e43b754481989b3c  2009.0/x86_64/thai-data-0.1.9-7.1mdv2009.0.x86_64.rpm 
 f0eca7369c6fcc3470a0cb731199b213  2009.0/SRPMS/libthai-0.1.9-7.1mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 5a3d827f4163a4fb6ad32844d3e48ee7  2009.1/i586/libthai0-0.1.9-7.1mdv2009.1.i586.rpm
 1ce758f78a981035d519c2271ae4dc57  2009.1/i586/libthai-devel-0.1.9-7.1mdv2009.1.i586.rpm
 6316a2ec579ed0a47f9685e81e39ae0e  2009.1/i586/thai-data-0.1.9-7.1mdv2009.1.i586.rpm 
 04f1d7876194ccd6c60b6d5172f5f75b  2009.1/SRPMS/libthai-0.1.9-7.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 58576cc35c244938a016c0b1b960e470  2009.1/x86_64/lib64thai0-0.1.9-7.1mdv2009.1.x86_64.rpm
 8594f489e881e44563d0b4cae4bb750a  2009.1/x86_64/lib64thai-devel-0.1.9-7.1mdv2009.1.x86_64.rpm
 beacf0f81e20a1e2ee62a1b50359c8f3  2009.1/x86_64/thai-data-0.1.9-7.1mdv2009.1.x86_64.rpm 
 04f1d7876194ccd6c60b6d5172f5f75b  2009.1/SRPMS/libthai-0.1.9-7.1mdv2009.1.src.rpm

 Mandriva Linux 2010.0:
 7fd54b41bd433d389cd59ea8ec5cb173  2010.0/i586/libthai0-0.1.12-1.1mdv2010.0.i586.rpm
 a8aaf23e6d18970c370213c153cfd2bc  2010.0/i586/libthai-devel-0.1.12-1.1mdv2010.0.i586.rpm
 e536c09d71c741b4d049739ecb505e92  2010.0/i586/thai-data-0.1.12-1.1mdv2010.0.i586.rpm 
 6458f44615eae24d0fc3c5bd927b9d18  2010.0/SRPMS/libthai-0.1.12-1.1mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 8b491ac2da204f6c7c2de6b2bf36bb51  2010.0/x86_64/lib64thai0-0.1.12-1.1mdv2010.0.x86_64.rpm
 84170ddf9a4e60f268f22f63f5e74f1b  2010.0/x86_64/lib64thai-devel-0.1.12-1.1mdv2010.0.x86_64.rpm
 af1ad9b477584e08d4704f6d14ba9ac2  2010.0/x86_64/thai-data-0.1.12-1.1mdv2010.0.x86_64.rpm 
 6458f44615eae24d0fc3c5bd927b9d18  2010.0/SRPMS/libthai-0.1.12-1.1mdv2010.0.src.rpm

 Mandriva Enterprise Server 5:
 21ddb50029b70668887b69d507b73d43  mes5/i586/libthai0-0.1.9-7.1mdvmes5.i586.rpm
 aea0d9de14b4ff8fa3dc3e7f012a20cb  mes5/i586/libthai-devel-0.1.9-7.1mdvmes5.i586.rpm
 2ce60260dad17cb053829d792e405438  mes5/i586/thai-data-0.1.9-7.1mdvmes5.i586.rpm 
 a2ed4567812490c59dbc04419d8cb9e1  mes5/SRPMS/libthai-0.1.9-7.1mdvmes5.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 9b4a9aed337bb0261f3b9658214452f4  mes5/x86_64/lib64thai0-0.1.9-7.1mdvmes5.x86_64.rpm
 23154601bc0d50d6cb7d552e1a72b468  mes5/x86_64/lib64thai-devel-0.1.9-7.1mdvmes5.x86_64.rpm
 1423bdd32a12965d140785313ebc73be  mes5/x86_64/thai-data-0.1.9-7.1mdvmes5.x86_64.rpm 
 a2ed4567812490c59dbc04419d8cb9e1  mes5/SRPMS/libthai-0.1.9-7.1mdvmes5.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLUdkimqjQ0CJFipgRAsAGAKD0P+rDjLcoQ/LHn3uWG74WYJrxZgCdEVWc
EjSXLG9kOIMOyzbhe7dsMBQ=
=o8VG
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/