full-disclosure - [ MDVSA-2013:182 ] mesa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1UsCE0-00055D-SA@titan.mandriva.com>
Date: Thu, 27 Jun 2013 15:27:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2013:182 ] mesa

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2013:182
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : mesa
 Date    : June 27, 2013
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated mesa packages fix multiple vulnerabilties
 
 An out-of-bounds access flaw was found in Mesa. If an application
 using Mesa exposed the Mesa API to untrusted inputs (Mozilla Firefox
 does this), an attacker could cause the application to crash or,
 potentially, execute arbitrary code with the privileges of the user
 running the application (CVE-2013-1872).
 
 It was found that Mesa did not correctly validate messages from the
 X server. A malicious X server could cause an application using Mesa
 to crash or, potentially, execute arbitrary code with the privileges
 of the user running the application (CVE-2013-1993).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1872
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1993
 http://advisories.mageia.org/MGASA-2013-0190.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 f6c149b9c6d323e773b035c66d674950  mbs1/x86_64/lib64dri-drivers-8.0.5-1.1.mbs1.x86_64.rpm
 d6d3a02aac014c15183d7970001ea26b  mbs1/x86_64/lib64gbm1-8.0.5-1.1.mbs1.x86_64.rpm
 16421d30fcf1e3a1483f94457c67863b  mbs1/x86_64/lib64gbm1-devel-8.0.5-1.1.mbs1.x86_64.rpm
 944f58f19d1bcebf748916398a77e44b  mbs1/x86_64/lib64glapi0-8.0.5-1.1.mbs1.x86_64.rpm
 11bd6d9f5a99b99cc305a03090e15d73  mbs1/x86_64/lib64glapi0-devel-8.0.5-1.1.mbs1.x86_64.rpm
 0ec3550458e61ef7774cfb0e12942b60  mbs1/x86_64/lib64mesaegl1-8.0.5-1.1.mbs1.x86_64.rpm
 731881a5c0e903d78bb82ba32f2d1311  mbs1/x86_64/lib64mesaegl1-devel-8.0.5-1.1.mbs1.x86_64.rpm
 df1fe2997d95167bf06f8416f79f367e  mbs1/x86_64/lib64mesagl1-8.0.5-1.1.mbs1.x86_64.rpm
 2f52c1fcd8628fa9ff4c705c102127cb  mbs1/x86_64/lib64mesagl1-devel-8.0.5-1.1.mbs1.x86_64.rpm
 631b9aab4dbae2f2d2f4abc4d000228b  mbs1/x86_64/lib64mesaglesv1_1-8.0.5-1.1.mbs1.x86_64.rpm
 96d888d875add6c574d2edf6718cf5dc  mbs1/x86_64/lib64mesaglesv1_1-devel-8.0.5-1.1.mbs1.x86_64.rpm
 f79a12a85997422fbec1bf987ff02ac8  mbs1/x86_64/lib64mesaglesv2_2-8.0.5-1.1.mbs1.x86_64.rpm
 731221cc8ad3cae9ba37e32449a61d97  mbs1/x86_64/lib64mesaglesv2_2-devel-8.0.5-1.1.mbs1.x86_64.rpm
 8892fdddb19c43e914af34e975eeb95d  mbs1/x86_64/lib64mesaglu1-8.0.5-1.1.mbs1.x86_64.rpm
 6c1814baa7930c18f2bbae27d0868b43  mbs1/x86_64/lib64mesaglu1-devel-8.0.5-1.1.mbs1.x86_64.rpm
 276e7eed6573335b16aec8a649e99300  mbs1/x86_64/lib64mesaopenvg1-8.0.5-1.1.mbs1.x86_64.rpm
 32d9ef8bec2abe8fc22726fbc8649741  mbs1/x86_64/lib64mesaopenvg1-devel-8.0.5-1.1.mbs1.x86_64.rpm
 dba1a82ae5f142b8359e2905a4916e5f  mbs1/x86_64/lib64wayland-egl1-8.0.5-1.1.mbs1.x86_64.rpm
 ac3cd4fd1194c3ab459954448889e78e  mbs1/x86_64/lib64wayland-egl1-devel-8.0.5-1.1.mbs1.x86_64.rpm
 ec57319a96d89360d32b864e6fe32ac9  mbs1/x86_64/mesa-8.0.5-1.1.mbs1.x86_64.rpm
 b94216125034d06c78bfc1a6a7f5784c  mbs1/x86_64/mesa-common-devel-8.0.5-1.1.mbs1.x86_64.rpm 
 7b5bcfacd8cf0348d84a53b993d3935f  mbs1/SRPMS/mesa-8.0.5-1.1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFRzBOLmqjQ0CJFipgRAv8cAKC1TC2KURGen4IQdKVykCyppOqIEwCg34si
oIFP9A5+QgNCtB1P8zPaDvw=
=p7/e
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/