-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2007:180 http://www.mandriva.com/security/ _______________________________________________________________________ Package : id3lib Date : September 12, 2007 Affected: 2007.0, 2007.1, Corporate 3.0 _______________________________________________________________________ Problem Description: A programming error was found in id3lib by Nikolaus Schulz that could lead to a denial of service through symlink attacks. Updated packages have been patched to prevent these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4460 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.0: 89ededb20e4a560dc4a15bc028bde937 2007.0/i586/id3lib-3.8.3-10.1mdv2007.0.i586.rpm 911e99bcbd3adc8d49175fa12297d6dd 2007.0/i586/libid3_3.8_3-3.8.3-10.1mdv2007.0.i586.rpm d792ca59dcbfbba0ec75742383dd0740 2007.0/i586/libid3_3.8_3-devel-3.8.3-10.1mdv2007.0.i586.rpm b5263e43bcc2c3e52cb96ce70769d663 2007.0/i586/libid3_3.8_3-static-devel-3.8.3-10.1mdv2007.0.i586.rpm 8046c1d4ed9191e1ea40caf4b7ba20f5 2007.0/SRPMS/id3lib-3.8.3-10.1mdv2007.0.src.rpm Mandriva Linux 2007.0/X86_64: 330799502bac0ea9cdf3e87a89836b61 2007.0/x86_64/id3lib-3.8.3-10.1mdv2007.0.x86_64.rpm 1be980ac246eee399e840933912c38dd 2007.0/x86_64/lib64id3_3.8_3-3.8.3-10.1mdv2007.0.x86_64.rpm 9c89408b8df0db6e0525818d72179b28 2007.0/x86_64/lib64id3_3.8_3-devel-3.8.3-10.1mdv2007.0.x86_64.rpm a46d3015c2b8281d89adcd6463b74fd0 2007.0/x86_64/lib64id3_3.8_3-static-devel-3.8.3-10.1mdv2007.0.x86_64.rpm 8046c1d4ed9191e1ea40caf4b7ba20f5 2007.0/SRPMS/id3lib-3.8.3-10.1mdv2007.0.src.rpm Mandriva Linux 2007.1: 012881ba00ae7a43fdda8daede5094ef 2007.1/i586/id3lib-3.8.3-10.1mdv2007.1.i586.rpm 0bb593e49f8c41552d27e4e663b56273 2007.1/i586/libid3_3.8_3-3.8.3-10.1mdv2007.1.i586.rpm 1a91fab14f81fb583f7acea0486220d7 2007.1/i586/libid3_3.8_3-devel-3.8.3-10.1mdv2007.1.i586.rpm ec3ec3f058a7aa84e19870bd11f3949f 2007.1/i586/libid3_3.8_3-static-devel-3.8.3-10.1mdv2007.1.i586.rpm eff155d8383d433ef3b6cee13fa3c0c4 2007.1/SRPMS/id3lib-3.8.3-10.1mdv2007.1.src.rpm Mandriva Linux 2007.1/X86_64: 7e6e147491fce23225e257049ea54231 2007.1/x86_64/id3lib-3.8.3-10.1mdv2007.1.x86_64.rpm 6e958567c9dcdd32cca5908af3d3d230 2007.1/x86_64/lib64id3_3.8_3-3.8.3-10.1mdv2007.1.x86_64.rpm 65dc5829f1df5aa29e16a7208f78efa0 2007.1/x86_64/lib64id3_3.8_3-devel-3.8.3-10.1mdv2007.1.x86_64.rpm 0cffc56e63ae5ed9bc0f6ac5143f225a 2007.1/x86_64/lib64id3_3.8_3-static-devel-3.8.3-10.1mdv2007.1.x86_64.rpm eff155d8383d433ef3b6cee13fa3c0c4 2007.1/SRPMS/id3lib-3.8.3-10.1mdv2007.1.src.rpm Corporate 3.0: 490549e67ef6b52bd06eaaf6dbff508a corporate/3.0/i586/libid3_3.8_3-3.8.3-6.1.C30mdk.i586.rpm 4647513ebae5dc1355d3e7f9b7ee51a5 corporate/3.0/i586/libid3_3.8_3-devel-3.8.3-6.1.C30mdk.i586.rpm 2339afded61377eff9f912bed1218cd1 corporate/3.0/i586/libid3_3.8_3-static-devel-3.8.3-6.1.C30mdk.i586.rpm 3c659b0444946057c77a019af1678810 corporate/3.0/SRPMS/id3lib-3.8.3-6.1.C30mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFG6EwOmqjQ0CJFipgRAodMAKC5yfiviupxANt/gXfqY6zdaVMf9ACeN5u+ S+u0izuqWpkjKrkVecA359k= =ysgi -----END PGP SIGNATURE-----
