MDKSA-2005:198 - Updated uim packages fix suid linking vulnerabilities.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:198
http://www.mandriva.com/security/
_______________________________________________________________________
Package : uim
Date : October 26, 2005
Affected: 10.2, 2006.0
_______________________________________________________________________
Problem Description:
Masanari Yamamoto discovered that Uim uses environment variables
incorrectly. This bug causes a privilege escalation if setuid/setgid
applications are linked to libuim.
The updated packages have been patched to address this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3149
_______________________________________________________________________
Updated Packages:
Mandriva Linux 10.2:
0b40b2bf269eebdb578b7ccad6376ee7 10.2/RPMS/libuim0-0.4.6-6.1.102mdk.i586.rpm
0fa0b1b530cbe088168575f93e27af16
10.2/RPMS/libuim0-devel-0.4.6-6.1.102mdk.i586.rpm
ff9d291ec6260b7b8dbcb7ffff44723c 10.2/RPMS/uim-0.4.6-6.1.102mdk.i586.rpm
58748280b6409a8ad303d373af08f095 10.2/RPMS/uim-anthy-0.4.6-6.1.102mdk.i586.rpm
de4817e89863e467f60f0bdfc8e367ee 10.2/RPMS/uim-gtk-0.4.6-6.1.102mdk.i586.rpm
9f604d7675aac699f2415a251ecea3c8
10.2/RPMS/uim-m17nlib-0.4.6-6.1.102mdk.i586.rpm
39ecbe0eba6a0e577fb4964eb056f1be 10.2/RPMS/uim-prime-0.4.6-6.1.102mdk.i586.rpm
ba70ceeadff24ddf3116ca7ca896bc29 10.2/RPMS/uim-qt-0.4.6-6.1.102mdk.i586.rpm
a4724afdb7fd954d0a5e4cbfe76da9ea 10.2/RPMS/uim-skk-0.4.6-6.1.102mdk.i586.rpm
1aaae40c2eb11aeb27894f0adad90c78 10.2/SRPMS/uim-0.4.6-6.1.102mdk.src.rpm
Mandriva Linux 10.2/X86_64:
a4577bc46ee837064e90d76de15dc0d8
x86_64/10.2/RPMS/lib64uim0-0.4.6-6.1.102mdk.x86_64.rpm
4f5481e87619492b66b872189b64a746
x86_64/10.2/RPMS/lib64uim0-devel-0.4.6-6.1.102mdk.x86_64.rpm
b0136005ec97560c3b69f1afe866858c
x86_64/10.2/RPMS/uim-0.4.6-6.1.102mdk.x86_64.rpm
ec86c03dbc8931b1fafd3afa0ab1076c
x86_64/10.2/RPMS/uim-anthy-0.4.6-6.1.102mdk.x86_64.rpm
16eafc984239f9cca8ac8b11ca6add5c
x86_64/10.2/RPMS/uim-gtk-0.4.6-6.1.102mdk.x86_64.rpm
ff44a9d79f64c4ddf016808c82676248
x86_64/10.2/RPMS/uim-m17nlib-0.4.6-6.1.102mdk.x86_64.rpm
cc12102858c03a110123750217e4fe98
x86_64/10.2/RPMS/uim-prime-0.4.6-6.1.102mdk.x86_64.rpm
61e11d3562720bb2899e0847786c61c0
x86_64/10.2/RPMS/uim-qt-0.4.6-6.1.102mdk.x86_64.rpm
72b234c251423aaa12958b726af54e9c
x86_64/10.2/RPMS/uim-skk-0.4.6-6.1.102mdk.x86_64.rpm
1aaae40c2eb11aeb27894f0adad90c78
x86_64/10.2/SRPMS/uim-0.4.6-6.1.102mdk.src.rpm
Mandriva Linux 2006.0:
13f254622cce2b61e252b85f2b3b89df
2006.0/RPMS/libuim0-0.4.8-4.1.20060mdk.i586.rpm
093f761ec0406e72463d0318cc58484a
2006.0/RPMS/libuim0-devel-0.4.8-4.1.20060mdk.i586.rpm
97bb193739679b4b20312c26e63f750f 2006.0/RPMS/uim-0.4.8-4.1.20060mdk.i586.rpm
eef6b766c1283e770d872d440f1ab8dc
2006.0/RPMS/uim-gtk-0.4.8-4.1.20060mdk.i586.rpm
1c2a7bb3cb25ba173289098c3ce80b07
2006.0/RPMS/uim-qt-0.4.8-4.1.20060mdk.i586.rpm
ad441f9127511a1e5b0d83472ae54862
2006.0/RPMS/uim-qtimmodule-0.4.8-4.1.20060mdk.i586.rpm
58946cffcb345bbaaae8a3b2e5192a8f 2006.0/SRPMS/uim-0.4.8-4.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
6ccb325145baeed7ea30b78a367941dd
x86_64/2006.0/RPMS/lib64uim0-0.4.8-4.1.20060mdk.x86_64.rpm
21465e1d5bb3a169053e5930ef03074d
x86_64/2006.0/RPMS/lib64uim0-devel-0.4.8-4.1.20060mdk.x86_64.rpm
f0e752e8177553041fefa013ce4598df
x86_64/2006.0/RPMS/uim-0.4.8-4.1.20060mdk.x86_64.rpm
3056648cfdbcfdb715106531dda70700
x86_64/2006.0/RPMS/uim-gtk-0.4.8-4.1.20060mdk.x86_64.rpm
3f5264d09059fadc77229b696cbea267
x86_64/2006.0/RPMS/uim-qt-0.4.8-4.1.20060mdk.x86_64.rpm
9d586985de4c10e879bcd699af023cae
x86_64/2006.0/RPMS/uim-qtimmodule-0.4.8-4.1.20060mdk.x86_64.rpm
58946cffcb345bbaaae8a3b2e5192a8f
x86_64/2006.0/SRPMS/uim-0.4.8-4.1.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDX/cbmqjQ0CJFipgRAmtUAJ9uoYAcWo7lpfRjWo2Ak+rTEMx+EACfdO5R
ejHcUW3I/0IxlAoZNN+4qzo=
=YxAm
-----END PGP SIGNATURE-----