-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2006:157 http://www.mandriva.com/security/ _______________________________________________________________________ Package : musicbrainz Date : August 30, 2006 Affected: 2006.0 _______________________________________________________________________ Problem Description: Multiple buffer overflows in libmusicbrainz (aka mb_client or MusicBrainz Client Library) 2.1.2 and earlier, and SVN 8406 and earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) a long Location header by the HTTP server, which triggers an overflow in the MBHttp::Download function in lib/http.cpp; and (2) a long URL in RDF data, as demonstrated by a URL in an rdf:resource field in an RDF XML document, which triggers overflows in many functions in lib/rdfparse.c. The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4197 _______________________________________________________________________ Updated Packages: Mandriva Linux 2006.0: 7f958824f626937333164370204436a4 2006.0/RPMS/libmusicbrainz4-2.1.1-3.2.20060mdk.i586.rpm 2e46ed494e52fb2ef47274ffd8f89e9b 2006.0/RPMS/libmusicbrainz4-devel-2.1.1-3.2.20060mdk.i586.rpm ed0c309b2d648ea55cadec0383ede538 2006.0/SRPMS/musicbrainz-2.1.1-3.2.20060mdk.src.rpm Mandriva Linux 2006.0/X86_64: 85270a120b6da2fdfe9e72e09394a479 x86_64/2006.0/RPMS/lib64musicbrainz4-2.1.1-3.2.20060mdk.x86_64.rpm 6555da767d22f9f65ee5726f458e001a x86_64/2006.0/RPMS/lib64musicbrainz4-devel-2.1.1-3.2.20060mdk.x86_64.rpm ed0c309b2d648ea55cadec0383ede538 x86_64/2006.0/SRPMS/musicbrainz-2.1.1-3.2.20060mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFE9et5mqjQ0CJFipgRAh3XAKChOvajLTbHLyl0cFImOiCTnjADPwCg0igS uy9EYU4HhQ59q7iI27036A8= =QGeJ -----END PGP SIGNATURE-----
