[ MDKSA-2006:065 ] - Updated kaffeine packages fix remote buffer overflow vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:065
http://www.mandriva.com/security/
_______________________________________________________________________
Package : kaffeine
Date : April 5, 2006
Affected: 2006.0
_______________________________________________________________________
Problem Description:
Marcus Meissner discovered Kaffeine contains an unchecked buffer while
creating HTTP request headers for fetching remote RAM playlists, which
allows overflowing a heap allocated buffer. As a result, remotely
supplied RAM playlists can be used to execute arbitrary code on the
client machine.
Updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0051
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
221dc2b4b5a7c83d2071c076ee3493ec
2006.0/RPMS/kaffeine-0.7-6.1.20060mdk.i586.rpm
2c7e274246e1dc740f8697c0f210925d
2006.0/RPMS/libkaffeine0-0.7-6.1.20060mdk.i586.rpm
9b5bb05954386af7505784a955243b25
2006.0/RPMS/libkaffeine0-devel-0.7-6.1.20060mdk.i586.rpm
7b313e26ca91b6f306b28be4fb9f5aa2
2006.0/SRPMS/kaffeine-0.7-6.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
8f4271cab6ec4670ed8e76d6c1711ec9
x86_64/2006.0/RPMS/kaffeine-0.7-6.1.20060mdk.x86_64.rpm
fadb3df8afb1d523946fa59298287185
x86_64/2006.0/RPMS/lib64kaffeine0-0.7-6.1.20060mdk.x86_64.rpm
6ed84efb236fb8e0aeccb42bbb00b57b
x86_64/2006.0/RPMS/lib64kaffeine0-devel-0.7-6.1.20060mdk.x86_64.rpm
7b313e26ca91b6f306b28be4fb9f5aa2
x86_64/2006.0/SRPMS/kaffeine-0.7-6.1.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFEM9h0mqjQ0CJFipgRAmkFAJ9UlKXHZ8geXu9clxUPI1JzokKcqgCfenWD
IKy9b4oDlt49DTdaFSX8b1A=
=o2Jq
-----END PGP SIGNATURE-----