[ MDVSA-2008:024 ] - Updated libxfont packages fix font handling vulnerability

[security@xxxxxxxxxxxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:024
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : libxfont
 Date    : January 23, 2008
 Affected: 2007.0, 2007.1, 2008.0
 _______________________________________________________________________
 
 Problem Description:
 
 A heap-based buffer overflow flaw was found in how the X.org server
 handled malformed font files that could allow a malicious local user
 to potentially execute arbitrary code with the privileges of the
 X.org server (CVE-2008-0006).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0006
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 de2a22a48e7cd0f6fcd4029488c3b724  
2007.0/i586/libxfont1-1.1.0-4.3mdv2007.0.i586.rpm
 606851fb030d7f7d823b7937b0bd5edc  
2007.0/i586/libxfont1-devel-1.1.0-4.3mdv2007.0.i586.rpm
 4cdcd0cd1bfaf72fca9a91a8b1ebf2db  
2007.0/i586/libxfont1-static-devel-1.1.0-4.3mdv2007.0.i586.rpm 
 662b54bd2bee49585526a91812df5ef3  
2007.0/SRPMS/libxfont-1.1.0-4.3mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 5194fbab1156016018e1c84256e35a9c  
2007.0/x86_64/lib64xfont1-1.1.0-4.3mdv2007.0.x86_64.rpm
 c1bdcc83564f38832c3d1c6747b95f15  
2007.0/x86_64/lib64xfont1-devel-1.1.0-4.3mdv2007.0.x86_64.rpm
 0f04e1dfcb4c00a1c9a3dc4b343d9046  
2007.0/x86_64/lib64xfont1-static-devel-1.1.0-4.3mdv2007.0.x86_64.rpm 
 662b54bd2bee49585526a91812df5ef3  
2007.0/SRPMS/libxfont-1.1.0-4.3mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 1eb6a6ab126948a6de556626bb5acdf6  
2007.1/i586/libxfont1-1.2.7-1.2mdv2007.1.i586.rpm
 f191e395133848b99a526ef4126da15c  
2007.1/i586/libxfont1-devel-1.2.7-1.2mdv2007.1.i586.rpm
 669ff7732d4a64830806b11a895c1fe9  
2007.1/i586/libxfont1-static-devel-1.2.7-1.2mdv2007.1.i586.rpm 
 952bff2032efe5741eba6642efcca297  
2007.1/SRPMS/libxfont-1.2.7-1.2mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 c2f41cfbfa369948be6bd3aa02a6e440  
2007.1/x86_64/lib64xfont1-1.2.7-1.2mdv2007.1.x86_64.rpm
 f04821e7e5501030441235867eeaf29d  
2007.1/x86_64/lib64xfont1-devel-1.2.7-1.2mdv2007.1.x86_64.rpm
 f0779a2188eff86c547becb7887e9139  
2007.1/x86_64/lib64xfont1-static-devel-1.2.7-1.2mdv2007.1.x86_64.rpm 
 952bff2032efe5741eba6642efcca297  
2007.1/SRPMS/libxfont-1.2.7-1.2mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 59b42399eb714d9c602cd60c593198c4  
2008.0/i586/libxfont1-1.3.0-3.1mdv2008.0.i586.rpm
 b046056a0a1c7a45adb9302474c638a9  
2008.0/i586/libxfont1-devel-1.3.0-3.1mdv2008.0.i586.rpm
 f5bf67b39474def8949289e87e7cb4a1  
2008.0/i586/libxfont1-static-devel-1.3.0-3.1mdv2008.0.i586.rpm 
 2bfb7cf39a5bdddce7845341fe1f887a  
2008.0/SRPMS/libxfont-1.3.0-3.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 1c939b9c9cd5f66fdf31d88435c47189  
2008.0/x86_64/lib64xfont1-1.3.0-3.1mdv2008.0.x86_64.rpm
 f1ed2695c9c5b4822384327b1b242799  
2008.0/x86_64/lib64xfont1-devel-1.3.0-3.1mdv2008.0.x86_64.rpm
 ca468b32d0624f0faacb6e4f06402382  
2008.0/x86_64/lib64xfont1-static-devel-1.3.0-3.1mdv2008.0.x86_64.rpm 
 2bfb7cf39a5bdddce7845341fe1f887a  
2008.0/SRPMS/libxfont-1.3.0-3.1mdv2008.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHl+hCmqjQ0CJFipgRAjM0AJ9nnMFPVOcA1auk0QleLcCNnjT9XQCg2ieg
2vr4Stc6+K3eaaxtzn+cCgs=
=OKTw
-----END PGP SIGNATURE-----