[ MDVSA-2008:097 ] - Updated kdelibs packages fix vulnerability in start_kdeinit
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:097
http://www.mandriva.com/security/
_______________________________________________________________________
Package : kdelibs
Date : May 6, 2008
Affected: 2008.0, 2008.1
_______________________________________________________________________
Problem Description:
A vulnerability was found in start_kdeinit in KDE 3.5.5 through
3.5.9 where, if it was installed setuid root, it could allow local
users to cause a denial of service or possibly execute arbitrary code
(CVE-2008-1671).
By default, start_kdeinit is not installed setuid root on Mandriva
Linux, however updated packages have been patched to correct this
issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1671
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0:
6e9ec4d86831c1de8d97b1143e412094
2008.0/i586/kdelibs-common-3.5.7-43.8mdv2008.0.i586.rpm
13c4540bad80e97dea7d4f0ae0b85e48
2008.0/i586/kdelibs-devel-doc-3.5.7-43.8mdv2008.0.i586.rpm
e37ee088e281f3ac22aaa9a2cf967bff
2008.0/i586/libkdecore4-3.5.7-43.8mdv2008.0.i586.rpm
68de2c2c0c4aefaae88598329c4ae842
2008.0/i586/libkdecore4-devel-3.5.7-43.8mdv2008.0.i586.rpm
f88003b0ee66bf4bcb456b7352972507
2008.0/SRPMS/kdelibs-3.5.7-43.8mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
f22003b71a01cde99bbec436462d8b89
2008.0/x86_64/kdelibs-common-3.5.7-43.8mdv2008.0.x86_64.rpm
d22e1bbc15d300768f58c75d810bb799
2008.0/x86_64/kdelibs-devel-doc-3.5.7-43.8mdv2008.0.x86_64.rpm
d52a94a110cd8ccf0611f1c199f0ee91
2008.0/x86_64/lib64kdecore4-3.5.7-43.8mdv2008.0.x86_64.rpm
7fd7f380efa11735eb0b4a174f5c7ade
2008.0/x86_64/lib64kdecore4-devel-3.5.7-43.8mdv2008.0.x86_64.rpm
f88003b0ee66bf4bcb456b7352972507
2008.0/SRPMS/kdelibs-3.5.7-43.8mdv2008.0.src.rpm
Mandriva Linux 2008.1:
3fdded980feeb40749c9fbef31c8274d
2008.1/i586/kdelibs-common-3.5.9-10.1mdv2008.1.i586.rpm
c0bba005dbc4013ff8cbe933ff9e5584
2008.1/i586/kdelibs-devel-doc-3.5.9-10.1mdv2008.1.i586.rpm
8867c7c83437e532b632a3a8f578e39d
2008.1/i586/libkdecore4-3.5.9-10.1mdv2008.1.i586.rpm
eec45645cada33b83c4394cdfca05af8
2008.1/i586/libkdecore4-devel-3.5.9-10.1mdv2008.1.i586.rpm
5d6b90aaf30b609c801e6d41727be2a4
2008.1/SRPMS/kdelibs-3.5.9-10.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
880a8c5c0efe5688bbbcacda27866b32
2008.1/x86_64/kdelibs-common-3.5.9-10.1mdv2008.1.x86_64.rpm
e217bf386a48838736364332c9919639
2008.1/x86_64/kdelibs-devel-doc-3.5.9-10.1mdv2008.1.x86_64.rpm
cd18170a8fe9c90e577e2a322f6e6146
2008.1/x86_64/lib64kdecore4-3.5.9-10.1mdv2008.1.x86_64.rpm
c28603d515c0d86f5ac782541c5b24a9
2008.1/x86_64/lib64kdecore4-devel-3.5.9-10.1mdv2008.1.x86_64.rpm
5d6b90aaf30b609c801e6d41727be2a4
2008.1/SRPMS/kdelibs-3.5.9-10.1mdv2008.1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFIIMdZmqjQ0CJFipgRAsGVAKCYNxo0aNExSN2XAHUD+ifw8ha+SACg3wfA
/edYIt1LNstGmZtHW0hMW2g=
=mQaN
-----END PGP SIGNATURE-----