-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2008:037 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libcdio Date : February 7, 2008 Affected: 2007.0, 2007.1, 2008.0, Corporate 4.0 _______________________________________________________________________ Problem Description: A stack-based buffer overflow was discovered in libcdio that allowed context-dependent attackers to cause a denial of service (core dump) and possibly execute arbitrary code via a disk or image file that contains a long joliet file name. In addition, a fix for failed UTF-8 conversions that would cause a segfault on certain ISOs was also fixed. The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6613 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.0: 2c9cc285e6eaa1590987c2e604374439 2007.0/i586/libcdio++0-0.77-3.3mdv2007.0.i586.rpm 0b93aeb47499d446452aa9d38e169439 2007.0/i586/libcdio-apps-0.77-3.3mdv2007.0.i586.rpm 25e9a94f055a091e7bca1f25db1d109f 2007.0/i586/libcdio7-0.77-3.3mdv2007.0.i586.rpm 2e92352d2390c09fd07bfb27c7803683 2007.0/i586/libcdio7-devel-0.77-3.3mdv2007.0.i586.rpm 1175e0443c0369d044d15c88b81bab67 2007.0/i586/libcdio7-static-devel-0.77-3.3mdv2007.0.i586.rpm faca07c524f4a0c1c4809bb0b16989ec 2007.0/i586/libcdio_cdda0-0.77-3.3mdv2007.0.i586.rpm eb28fbf60618126b00db5663908596d0 2007.0/i586/libiso9660_5-0.77-3.3mdv2007.0.i586.rpm 88c25e6295c9fbfdee8be9a60ec6fc94 2007.0/SRPMS/libcdio-0.77-3.3mdv2007.0.src.rpm Mandriva Linux 2007.0/X86_64: bc3662e2a43469d0aaec0277c4167e47 2007.0/x86_64/lib64cdio++0-0.77-3.3mdv2007.0.x86_64.rpm da9f36e50f71e5afe0a5f08e23ab7c30 2007.0/x86_64/lib64cdio7-0.77-3.3mdv2007.0.x86_64.rpm 30d8b1a2176c46bf9f7451733acc2fc0 2007.0/x86_64/lib64cdio7-devel-0.77-3.3mdv2007.0.x86_64.rpm 3b011dd17ba6e31105e4149239e14458 2007.0/x86_64/lib64cdio7-static-devel-0.77-3.3mdv2007.0.x86_64.rpm f25134c5c3762ab484ef8f9efbcb565c 2007.0/x86_64/lib64cdio_cdda0-0.77-3.3mdv2007.0.x86_64.rpm 43678be8297a1e799d0569ec99734f16 2007.0/x86_64/lib64iso9660_5-0.77-3.3mdv2007.0.x86_64.rpm 6ec850f608d4dae487fc686b3674200c 2007.0/x86_64/libcdio-apps-0.77-3.3mdv2007.0.x86_64.rpm 88c25e6295c9fbfdee8be9a60ec6fc94 2007.0/SRPMS/libcdio-0.77-3.3mdv2007.0.src.rpm Mandriva Linux 2007.1: 015616a97d2892a7309820c6f30e0bc2 2007.1/i586/libcdio++0-0.78.2-1.3mdv2007.1.i586.rpm 483f5d6820b65fe8a2c9624041e5e421 2007.1/i586/libcdio-apps-0.78.2-1.3mdv2007.1.i586.rpm 2e1b5d579e9dead1a43fead7a928942b 2007.1/i586/libcdio-devel-0.78.2-1.3mdv2007.1.i586.rpm d6a4926d0b4e1a09138945a7d769abf3 2007.1/i586/libcdio-static-devel-0.78.2-1.3mdv2007.1.i586.rpm d43c19e428089a724c50f0a181d86205 2007.1/i586/libcdio7-0.78.2-1.3mdv2007.1.i586.rpm a530b7c47f94a01e85d586d8c2acc9b1 2007.1/i586/libcdio_cdda0-0.78.2-1.3mdv2007.1.i586.rpm 427d7ef2f84584da59bf46fa8c6fbca9 2007.1/i586/libiso9660_5-0.78.2-1.3mdv2007.1.i586.rpm ed03d91688897301ad3de8194af269bc 2007.1/SRPMS/libcdio-0.78.2-1.3mdv2007.1.src.rpm Mandriva Linux 2007.1/X86_64: 70474d9f0a13187ef8cce53775af6bdc 2007.1/x86_64/lib64cdio++0-0.78.2-1.3mdv2007.1.x86_64.rpm 4824f3576666c2cb03f4070428f24a05 2007.1/x86_64/lib64cdio-devel-0.78.2-1.3mdv2007.1.x86_64.rpm 0bf6a7e35e2bce1c76b6edc85e9eb5a1 2007.1/x86_64/lib64cdio-static-devel-0.78.2-1.3mdv2007.1.x86_64.rpm 470191c5314cdb2f7699b105c156026f 2007.1/x86_64/lib64cdio7-0.78.2-1.3mdv2007.1.x86_64.rpm 23d262db4df2eb09f5d5d9b9d1be73ad 2007.1/x86_64/lib64cdio_cdda0-0.78.2-1.3mdv2007.1.x86_64.rpm 1d2fbe5a1976d2b959b4a9803a84eed0 2007.1/x86_64/lib64iso9660_5-0.78.2-1.3mdv2007.1.x86_64.rpm 626c51a013c96f8af70c035060245732 2007.1/x86_64/libcdio-apps-0.78.2-1.3mdv2007.1.x86_64.rpm ed03d91688897301ad3de8194af269bc 2007.1/SRPMS/libcdio-0.78.2-1.3mdv2007.1.src.rpm Mandriva Linux 2008.0: e3eb0c870ab4b9a1edafca77816fc5fc 2008.0/i586/libcdio++0-0.78.2-1.3mdv2008.0.i586.rpm 08dcca55b6249b4600f144ee82408cff 2008.0/i586/libcdio-apps-0.78.2-1.3mdv2008.0.i586.rpm 2cc1f700b7d3cc1f6421dbd981f66174 2008.0/i586/libcdio-devel-0.78.2-1.3mdv2008.0.i586.rpm 229faf0dfa36e61e0dd2e01faa816930 2008.0/i586/libcdio-static-devel-0.78.2-1.3mdv2008.0.i586.rpm a0782d56dd832c6fd354185051f6ea6f 2008.0/i586/libcdio7-0.78.2-1.3mdv2008.0.i586.rpm 217a974e232e1fe10391f9cf85e7282c 2008.0/i586/libcdio_cdda0-0.78.2-1.3mdv2008.0.i586.rpm a445bc8f518b77021e077f7e57025f63 2008.0/i586/libiso9660_5-0.78.2-1.3mdv2008.0.i586.rpm f1f88dd612afd6216bfcba8fdfeda2a9 2008.0/SRPMS/libcdio-0.78.2-1.3mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 0efe21f68f68c5fe5bd60dc7ffb2b3ef 2008.0/x86_64/lib64cdio++0-0.78.2-1.3mdv2008.0.x86_64.rpm 03e8dc953895d2e81e1af0e868441c68 2008.0/x86_64/lib64cdio-devel-0.78.2-1.3mdv2008.0.x86_64.rpm 472d25bf85fafd52e073c7841f15c7e5 2008.0/x86_64/lib64cdio-static-devel-0.78.2-1.3mdv2008.0.x86_64.rpm 954c045e33b39cb679c9298a4927de42 2008.0/x86_64/lib64cdio7-0.78.2-1.3mdv2008.0.x86_64.rpm fe746e1ae207d8322e03f51f0b260ae6 2008.0/x86_64/lib64cdio_cdda0-0.78.2-1.3mdv2008.0.x86_64.rpm 137922e931d94b992e9ab246a0c2488f 2008.0/x86_64/lib64iso9660_5-0.78.2-1.3mdv2008.0.x86_64.rpm d4ec5858a6c36a50948921b94173a0c3 2008.0/x86_64/libcdio-apps-0.78.2-1.3mdv2008.0.x86_64.rpm f1f88dd612afd6216bfcba8fdfeda2a9 2008.0/SRPMS/libcdio-0.78.2-1.3mdv2008.0.src.rpm Corporate 4.0: e3ffa54c3352c16ceec69da17bd6bad2 corporate/4.0/i586/libcdio-apps-0.75-2.3.20060mlcs4.i586.rpm 8267aa6560b8bfba5627612f8d5856da corporate/4.0/i586/libcdio6-0.75-2.3.20060mlcs4.i586.rpm 1aa85ccfb99f88e22837f11f5404d3f6 corporate/4.0/i586/libcdio6-devel-0.75-2.3.20060mlcs4.i586.rpm b2693881bb56f168d9cff12dd0449f03 corporate/4.0/i586/libcdio6-static-devel-0.75-2.3.20060mlcs4.i586.rpm 957697031d34545a7673206368e0607c corporate/4.0/i586/libcdio_cdda0-0.75-2.3.20060mlcs4.i586.rpm d08da96ba13eae5c5b9d71160fc1c784 corporate/4.0/i586/libiso9660_4-0.75-2.3.20060mlcs4.i586.rpm 544367bbb5c9f4b0cf13e3e1f4847b25 corporate/4.0/SRPMS/libcdio-0.75-2.3.20060mlcs4.src.rpm Corporate 4.0/X86_64: f2d1c4534de96a39c68a4e34029d953c corporate/4.0/x86_64/lib64cdio6-0.75-2.3.20060mlcs4.x86_64.rpm fd5e870ac62e863fe29dbca597030fbf corporate/4.0/x86_64/lib64cdio6-devel-0.75-2.3.20060mlcs4.x86_64.rpm 136ed4e57be4d922b2eb5ffe4c51991b corporate/4.0/x86_64/lib64cdio6-static-devel-0.75-2.3.20060mlcs4.x86_64.rpm 8a3954b8da2d157591467e60d36b907f corporate/4.0/x86_64/lib64cdio_cdda0-0.75-2.3.20060mlcs4.x86_64.rpm c113ef04258a71ea65fdffb7e014ab59 corporate/4.0/x86_64/lib64iso9660_4-0.75-2.3.20060mlcs4.x86_64.rpm 53446335d5f05f02fa29f0d8b82029c9 corporate/4.0/x86_64/libcdio-apps-0.75-2.3.20060mlcs4.x86_64.rpm 544367bbb5c9f4b0cf13e3e1f4847b25 corporate/4.0/SRPMS/libcdio-0.75-2.3.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (GNU/Linux) iD8DBQFHqz/bmqjQ0CJFipgRAgeMAJ9k7tM4Y9GWeSgWjbDrxpPC7S9gaQCcCCvH arDFtHWkwhcvB5BxGO84kCI= =kjqq -----END PGP SIGNATURE-----
