[ MDVSA-2008:037 ] - Updated libcdio packages fix DoS vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:037
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libcdio
Date : February 7, 2008
Affected: 2007.0, 2007.1, 2008.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
A stack-based buffer overflow was discovered in libcdio that allowed
context-dependent attackers to cause a denial of service (core dump)
and possibly execute arbitrary code via a disk or image file that
contains a long joliet file name.
In addition, a fix for failed UTF-8 conversions that would cause a
segfault on certain ISOs was also fixed.
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6613
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
2c9cc285e6eaa1590987c2e604374439
2007.0/i586/libcdio++0-0.77-3.3mdv2007.0.i586.rpm
0b93aeb47499d446452aa9d38e169439
2007.0/i586/libcdio-apps-0.77-3.3mdv2007.0.i586.rpm
25e9a94f055a091e7bca1f25db1d109f
2007.0/i586/libcdio7-0.77-3.3mdv2007.0.i586.rpm
2e92352d2390c09fd07bfb27c7803683
2007.0/i586/libcdio7-devel-0.77-3.3mdv2007.0.i586.rpm
1175e0443c0369d044d15c88b81bab67
2007.0/i586/libcdio7-static-devel-0.77-3.3mdv2007.0.i586.rpm
faca07c524f4a0c1c4809bb0b16989ec
2007.0/i586/libcdio_cdda0-0.77-3.3mdv2007.0.i586.rpm
eb28fbf60618126b00db5663908596d0
2007.0/i586/libiso9660_5-0.77-3.3mdv2007.0.i586.rpm
88c25e6295c9fbfdee8be9a60ec6fc94
2007.0/SRPMS/libcdio-0.77-3.3mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
bc3662e2a43469d0aaec0277c4167e47
2007.0/x86_64/lib64cdio++0-0.77-3.3mdv2007.0.x86_64.rpm
da9f36e50f71e5afe0a5f08e23ab7c30
2007.0/x86_64/lib64cdio7-0.77-3.3mdv2007.0.x86_64.rpm
30d8b1a2176c46bf9f7451733acc2fc0
2007.0/x86_64/lib64cdio7-devel-0.77-3.3mdv2007.0.x86_64.rpm
3b011dd17ba6e31105e4149239e14458
2007.0/x86_64/lib64cdio7-static-devel-0.77-3.3mdv2007.0.x86_64.rpm
f25134c5c3762ab484ef8f9efbcb565c
2007.0/x86_64/lib64cdio_cdda0-0.77-3.3mdv2007.0.x86_64.rpm
43678be8297a1e799d0569ec99734f16
2007.0/x86_64/lib64iso9660_5-0.77-3.3mdv2007.0.x86_64.rpm
6ec850f608d4dae487fc686b3674200c
2007.0/x86_64/libcdio-apps-0.77-3.3mdv2007.0.x86_64.rpm
88c25e6295c9fbfdee8be9a60ec6fc94
2007.0/SRPMS/libcdio-0.77-3.3mdv2007.0.src.rpm
Mandriva Linux 2007.1:
015616a97d2892a7309820c6f30e0bc2
2007.1/i586/libcdio++0-0.78.2-1.3mdv2007.1.i586.rpm
483f5d6820b65fe8a2c9624041e5e421
2007.1/i586/libcdio-apps-0.78.2-1.3mdv2007.1.i586.rpm
2e1b5d579e9dead1a43fead7a928942b
2007.1/i586/libcdio-devel-0.78.2-1.3mdv2007.1.i586.rpm
d6a4926d0b4e1a09138945a7d769abf3
2007.1/i586/libcdio-static-devel-0.78.2-1.3mdv2007.1.i586.rpm
d43c19e428089a724c50f0a181d86205
2007.1/i586/libcdio7-0.78.2-1.3mdv2007.1.i586.rpm
a530b7c47f94a01e85d586d8c2acc9b1
2007.1/i586/libcdio_cdda0-0.78.2-1.3mdv2007.1.i586.rpm
427d7ef2f84584da59bf46fa8c6fbca9
2007.1/i586/libiso9660_5-0.78.2-1.3mdv2007.1.i586.rpm
ed03d91688897301ad3de8194af269bc
2007.1/SRPMS/libcdio-0.78.2-1.3mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
70474d9f0a13187ef8cce53775af6bdc
2007.1/x86_64/lib64cdio++0-0.78.2-1.3mdv2007.1.x86_64.rpm
4824f3576666c2cb03f4070428f24a05
2007.1/x86_64/lib64cdio-devel-0.78.2-1.3mdv2007.1.x86_64.rpm
0bf6a7e35e2bce1c76b6edc85e9eb5a1
2007.1/x86_64/lib64cdio-static-devel-0.78.2-1.3mdv2007.1.x86_64.rpm
470191c5314cdb2f7699b105c156026f
2007.1/x86_64/lib64cdio7-0.78.2-1.3mdv2007.1.x86_64.rpm
23d262db4df2eb09f5d5d9b9d1be73ad
2007.1/x86_64/lib64cdio_cdda0-0.78.2-1.3mdv2007.1.x86_64.rpm
1d2fbe5a1976d2b959b4a9803a84eed0
2007.1/x86_64/lib64iso9660_5-0.78.2-1.3mdv2007.1.x86_64.rpm
626c51a013c96f8af70c035060245732
2007.1/x86_64/libcdio-apps-0.78.2-1.3mdv2007.1.x86_64.rpm
ed03d91688897301ad3de8194af269bc
2007.1/SRPMS/libcdio-0.78.2-1.3mdv2007.1.src.rpm
Mandriva Linux 2008.0:
e3eb0c870ab4b9a1edafca77816fc5fc
2008.0/i586/libcdio++0-0.78.2-1.3mdv2008.0.i586.rpm
08dcca55b6249b4600f144ee82408cff
2008.0/i586/libcdio-apps-0.78.2-1.3mdv2008.0.i586.rpm
2cc1f700b7d3cc1f6421dbd981f66174
2008.0/i586/libcdio-devel-0.78.2-1.3mdv2008.0.i586.rpm
229faf0dfa36e61e0dd2e01faa816930
2008.0/i586/libcdio-static-devel-0.78.2-1.3mdv2008.0.i586.rpm
a0782d56dd832c6fd354185051f6ea6f
2008.0/i586/libcdio7-0.78.2-1.3mdv2008.0.i586.rpm
217a974e232e1fe10391f9cf85e7282c
2008.0/i586/libcdio_cdda0-0.78.2-1.3mdv2008.0.i586.rpm
a445bc8f518b77021e077f7e57025f63
2008.0/i586/libiso9660_5-0.78.2-1.3mdv2008.0.i586.rpm
f1f88dd612afd6216bfcba8fdfeda2a9
2008.0/SRPMS/libcdio-0.78.2-1.3mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
0efe21f68f68c5fe5bd60dc7ffb2b3ef
2008.0/x86_64/lib64cdio++0-0.78.2-1.3mdv2008.0.x86_64.rpm
03e8dc953895d2e81e1af0e868441c68
2008.0/x86_64/lib64cdio-devel-0.78.2-1.3mdv2008.0.x86_64.rpm
472d25bf85fafd52e073c7841f15c7e5
2008.0/x86_64/lib64cdio-static-devel-0.78.2-1.3mdv2008.0.x86_64.rpm
954c045e33b39cb679c9298a4927de42
2008.0/x86_64/lib64cdio7-0.78.2-1.3mdv2008.0.x86_64.rpm
fe746e1ae207d8322e03f51f0b260ae6
2008.0/x86_64/lib64cdio_cdda0-0.78.2-1.3mdv2008.0.x86_64.rpm
137922e931d94b992e9ab246a0c2488f
2008.0/x86_64/lib64iso9660_5-0.78.2-1.3mdv2008.0.x86_64.rpm
d4ec5858a6c36a50948921b94173a0c3
2008.0/x86_64/libcdio-apps-0.78.2-1.3mdv2008.0.x86_64.rpm
f1f88dd612afd6216bfcba8fdfeda2a9
2008.0/SRPMS/libcdio-0.78.2-1.3mdv2008.0.src.rpm
Corporate 4.0:
e3ffa54c3352c16ceec69da17bd6bad2
corporate/4.0/i586/libcdio-apps-0.75-2.3.20060mlcs4.i586.rpm
8267aa6560b8bfba5627612f8d5856da
corporate/4.0/i586/libcdio6-0.75-2.3.20060mlcs4.i586.rpm
1aa85ccfb99f88e22837f11f5404d3f6
corporate/4.0/i586/libcdio6-devel-0.75-2.3.20060mlcs4.i586.rpm
b2693881bb56f168d9cff12dd0449f03
corporate/4.0/i586/libcdio6-static-devel-0.75-2.3.20060mlcs4.i586.rpm
957697031d34545a7673206368e0607c
corporate/4.0/i586/libcdio_cdda0-0.75-2.3.20060mlcs4.i586.rpm
d08da96ba13eae5c5b9d71160fc1c784
corporate/4.0/i586/libiso9660_4-0.75-2.3.20060mlcs4.i586.rpm
544367bbb5c9f4b0cf13e3e1f4847b25
corporate/4.0/SRPMS/libcdio-0.75-2.3.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
f2d1c4534de96a39c68a4e34029d953c
corporate/4.0/x86_64/lib64cdio6-0.75-2.3.20060mlcs4.x86_64.rpm
fd5e870ac62e863fe29dbca597030fbf
corporate/4.0/x86_64/lib64cdio6-devel-0.75-2.3.20060mlcs4.x86_64.rpm
136ed4e57be4d922b2eb5ffe4c51991b
corporate/4.0/x86_64/lib64cdio6-static-devel-0.75-2.3.20060mlcs4.x86_64.rpm
8a3954b8da2d157591467e60d36b907f
corporate/4.0/x86_64/lib64cdio_cdda0-0.75-2.3.20060mlcs4.x86_64.rpm
c113ef04258a71ea65fdffb7e014ab59
corporate/4.0/x86_64/lib64iso9660_4-0.75-2.3.20060mlcs4.x86_64.rpm
53446335d5f05f02fa29f0d8b82029c9
corporate/4.0/x86_64/libcdio-apps-0.75-2.3.20060mlcs4.x86_64.rpm
544367bbb5c9f4b0cf13e3e1f4847b25
corporate/4.0/SRPMS/libcdio-0.75-2.3.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
iD8DBQFHqz/bmqjQ0CJFipgRAgeMAJ9k7tM4Y9GWeSgWjbDrxpPC7S9gaQCcCCvH
arDFtHWkwhcvB5BxGO84kCI=
=kjqq
-----END PGP SIGNATURE-----