[ MDVSA-2009:106 ] libwmf
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:106
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libwmf
Date : May 5, 2009
Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
Use-after-free vulnerability in the embedded GD library in libwmf
0.2.8.4 allows context-dependent attackers to cause a denial of service
(application crash) or possibly execute arbitrary code via a crafted
WMF file (CVE-2009-1364).
The updated packages have been patched to prevent this.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1364
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
2d342dc40ab150992cf1a8a6621fab7f
2008.1/i586/libwmf0.2_7-0.2.8.4-16.1mdv2008.1.i586.rpm
7a0521fbdf9a6da2bffbf12aebf1715f
2008.1/i586/libwmf0.2_7-devel-0.2.8.4-16.1mdv2008.1.i586.rpm
ba695656e60503bda08f70c925b8330e
2008.1/i586/libwmf-0.2.8.4-16.1mdv2008.1.i586.rpm
322e036dea7ba8140a18824005d9b92a
2008.1/SRPMS/libwmf-0.2.8.4-16.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
459bad68ba0653eb1bc6780e77751a93
2008.1/x86_64/lib64wmf0.2_7-0.2.8.4-16.1mdv2008.1.x86_64.rpm
8618459d455aadfd73b92aed90b9cfe5
2008.1/x86_64/lib64wmf0.2_7-devel-0.2.8.4-16.1mdv2008.1.x86_64.rpm
2cde8c262a9d16e137d138c59cfd9e8b
2008.1/x86_64/libwmf-0.2.8.4-16.1mdv2008.1.x86_64.rpm
322e036dea7ba8140a18824005d9b92a
2008.1/SRPMS/libwmf-0.2.8.4-16.1mdv2008.1.src.rpm
Mandriva Linux 2009.0:
e2b9bedbeb985a3c99006bba788934e9
2009.0/i586/libwmf0.2_7-0.2.8.4-17.1mdv2009.0.i586.rpm
13d8a396ce0df792b8e4969cb9cde254
2009.0/i586/libwmf0.2_7-devel-0.2.8.4-17.1mdv2009.0.i586.rpm
e71c42640bb10178a89169c8248dd01b
2009.0/i586/libwmf-0.2.8.4-17.1mdv2009.0.i586.rpm
59ff2c3574addc0a81bb6796c81904d3
2009.0/SRPMS/libwmf-0.2.8.4-17.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
f7cff966df6cf93f609cac9a6b3696e5
2009.0/x86_64/lib64wmf0.2_7-0.2.8.4-17.1mdv2009.0.x86_64.rpm
2da8139058b46db4b2745aaec2ce02a5
2009.0/x86_64/lib64wmf0.2_7-devel-0.2.8.4-17.1mdv2009.0.x86_64.rpm
518fd614057faf6d0f3e29ad0e7c7fa7
2009.0/x86_64/libwmf-0.2.8.4-17.1mdv2009.0.x86_64.rpm
59ff2c3574addc0a81bb6796c81904d3
2009.0/SRPMS/libwmf-0.2.8.4-17.1mdv2009.0.src.rpm
Mandriva Linux 2009.1:
6d180eab4e408273366ae5f093f1677c
2009.1/i586/libwmf0.2_7-0.2.8.4-17.1mdv2009.1.i586.rpm
81f66bafa0a33afea19102cfe2706534
2009.1/i586/libwmf0.2_7-devel-0.2.8.4-17.1mdv2009.1.i586.rpm
5d11c53dd0edd170621fc35ca508a9ce
2009.1/i586/libwmf-0.2.8.4-17.1mdv2009.1.i586.rpm
5f3069da8567b287d51b2a8376f2e4bf
2009.1/SRPMS/libwmf-0.2.8.4-17.1mdv2009.1.src.rpm
Mandriva Linux 2009.1/X86_64:
5ccf282d020f5a79c5fda7e2c7d1230e
2009.1/x86_64/lib64wmf0.2_7-0.2.8.4-17.1mdv2009.1.x86_64.rpm
43c1cc09b1d6aa8a1be1270a92f177e2
2009.1/x86_64/lib64wmf0.2_7-devel-0.2.8.4-17.1mdv2009.1.x86_64.rpm
e60fb7a8cfc492b48946184d2981b6ef
2009.1/x86_64/libwmf-0.2.8.4-17.1mdv2009.1.x86_64.rpm
5f3069da8567b287d51b2a8376f2e4bf
2009.1/SRPMS/libwmf-0.2.8.4-17.1mdv2009.1.src.rpm
Corporate 3.0:
56348848bcbdeea3b3392c6e6eb50aa9
corporate/3.0/i586/libwmf0.2_7-0.2.8-6.6.C30mdk.i586.rpm
b03ca678d92bf48fce95f0afdfdd98b5
corporate/3.0/i586/libwmf0.2_7-devel-0.2.8-6.6.C30mdk.i586.rpm
a3e45d91ca75b796115b15a1e299e43e
corporate/3.0/i586/libwmf-0.2.8-6.6.C30mdk.i586.rpm
fb1a17a5e64ba156b386a94cbbc52355
corporate/3.0/SRPMS/libwmf-0.2.8-6.6.C30mdk.src.rpm
Corporate 3.0/X86_64:
54cd23ce8d40499970f26dbd841ab8a6
corporate/3.0/x86_64/lib64wmf0.2_7-0.2.8-6.6.C30mdk.x86_64.rpm
089cadda8c879d3e4aed68e4b0feccd4
corporate/3.0/x86_64/lib64wmf0.2_7-devel-0.2.8-6.6.C30mdk.x86_64.rpm
adbfbafa64eeb734f21fc8f8483c2f7b
corporate/3.0/x86_64/libwmf-0.2.8-6.6.C30mdk.x86_64.rpm
fb1a17a5e64ba156b386a94cbbc52355
corporate/3.0/SRPMS/libwmf-0.2.8-6.6.C30mdk.src.rpm
Corporate 4.0:
48a7c42b8e4bd5465ce3acb4e2f03d19
corporate/4.0/i586/libwmf0.2_7-0.2.8.3-6.6.20060mlcs4.i586.rpm
ee957f0a4c3fe69d50aa2b8ce9bad619
corporate/4.0/i586/libwmf0.2_7-devel-0.2.8.3-6.6.20060mlcs4.i586.rpm
d99ed07d9087627101ec3a6bfc8ddf13
corporate/4.0/i586/libwmf-0.2.8.3-6.6.20060mlcs4.i586.rpm
a1c9970e6f7317d4776decc4f4b02665
corporate/4.0/SRPMS/libwmf-0.2.8.3-6.6.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
be0efb665fb41259f3e49db45bf86bf7
corporate/4.0/x86_64/lib64wmf0.2_7-0.2.8.3-6.6.20060mlcs4.x86_64.rpm
9f199425e1d97dd0d7b5c50f40316baa
corporate/4.0/x86_64/lib64wmf0.2_7-devel-0.2.8.3-6.6.20060mlcs4.x86_64.rpm
576d6e1efd6b83ea226a2ad656a71f04
corporate/4.0/x86_64/libwmf-0.2.8.3-6.6.20060mlcs4.x86_64.rpm
a1c9970e6f7317d4776decc4f4b02665
corporate/4.0/SRPMS/libwmf-0.2.8.3-6.6.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFKAIpfmqjQ0CJFipgRAl/bAJ0fCNQ4BMjoTrJisl5ISSH/iVfBJACgiCNf
WpHdeUhRY1FcZ+dRrYMBm6o=
=iHYX
-----END PGP SIGNATURE-----