-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:106 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libwmf Date : May 5, 2009 Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0 _______________________________________________________________________ Problem Description: Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file (CVE-2009-1364). The updated packages have been patched to prevent this. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1364 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.1: 2d342dc40ab150992cf1a8a6621fab7f 2008.1/i586/libwmf0.2_7-0.2.8.4-16.1mdv2008.1.i586.rpm 7a0521fbdf9a6da2bffbf12aebf1715f 2008.1/i586/libwmf0.2_7-devel-0.2.8.4-16.1mdv2008.1.i586.rpm ba695656e60503bda08f70c925b8330e 2008.1/i586/libwmf-0.2.8.4-16.1mdv2008.1.i586.rpm 322e036dea7ba8140a18824005d9b92a 2008.1/SRPMS/libwmf-0.2.8.4-16.1mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: 459bad68ba0653eb1bc6780e77751a93 2008.1/x86_64/lib64wmf0.2_7-0.2.8.4-16.1mdv2008.1.x86_64.rpm 8618459d455aadfd73b92aed90b9cfe5 2008.1/x86_64/lib64wmf0.2_7-devel-0.2.8.4-16.1mdv2008.1.x86_64.rpm 2cde8c262a9d16e137d138c59cfd9e8b 2008.1/x86_64/libwmf-0.2.8.4-16.1mdv2008.1.x86_64.rpm 322e036dea7ba8140a18824005d9b92a 2008.1/SRPMS/libwmf-0.2.8.4-16.1mdv2008.1.src.rpm Mandriva Linux 2009.0: e2b9bedbeb985a3c99006bba788934e9 2009.0/i586/libwmf0.2_7-0.2.8.4-17.1mdv2009.0.i586.rpm 13d8a396ce0df792b8e4969cb9cde254 2009.0/i586/libwmf0.2_7-devel-0.2.8.4-17.1mdv2009.0.i586.rpm e71c42640bb10178a89169c8248dd01b 2009.0/i586/libwmf-0.2.8.4-17.1mdv2009.0.i586.rpm 59ff2c3574addc0a81bb6796c81904d3 2009.0/SRPMS/libwmf-0.2.8.4-17.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: f7cff966df6cf93f609cac9a6b3696e5 2009.0/x86_64/lib64wmf0.2_7-0.2.8.4-17.1mdv2009.0.x86_64.rpm 2da8139058b46db4b2745aaec2ce02a5 2009.0/x86_64/lib64wmf0.2_7-devel-0.2.8.4-17.1mdv2009.0.x86_64.rpm 518fd614057faf6d0f3e29ad0e7c7fa7 2009.0/x86_64/libwmf-0.2.8.4-17.1mdv2009.0.x86_64.rpm 59ff2c3574addc0a81bb6796c81904d3 2009.0/SRPMS/libwmf-0.2.8.4-17.1mdv2009.0.src.rpm Mandriva Linux 2009.1: 6d180eab4e408273366ae5f093f1677c 2009.1/i586/libwmf0.2_7-0.2.8.4-17.1mdv2009.1.i586.rpm 81f66bafa0a33afea19102cfe2706534 2009.1/i586/libwmf0.2_7-devel-0.2.8.4-17.1mdv2009.1.i586.rpm 5d11c53dd0edd170621fc35ca508a9ce 2009.1/i586/libwmf-0.2.8.4-17.1mdv2009.1.i586.rpm 5f3069da8567b287d51b2a8376f2e4bf 2009.1/SRPMS/libwmf-0.2.8.4-17.1mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 5ccf282d020f5a79c5fda7e2c7d1230e 2009.1/x86_64/lib64wmf0.2_7-0.2.8.4-17.1mdv2009.1.x86_64.rpm 43c1cc09b1d6aa8a1be1270a92f177e2 2009.1/x86_64/lib64wmf0.2_7-devel-0.2.8.4-17.1mdv2009.1.x86_64.rpm e60fb7a8cfc492b48946184d2981b6ef 2009.1/x86_64/libwmf-0.2.8.4-17.1mdv2009.1.x86_64.rpm 5f3069da8567b287d51b2a8376f2e4bf 2009.1/SRPMS/libwmf-0.2.8.4-17.1mdv2009.1.src.rpm Corporate 3.0: 56348848bcbdeea3b3392c6e6eb50aa9 corporate/3.0/i586/libwmf0.2_7-0.2.8-6.6.C30mdk.i586.rpm b03ca678d92bf48fce95f0afdfdd98b5 corporate/3.0/i586/libwmf0.2_7-devel-0.2.8-6.6.C30mdk.i586.rpm a3e45d91ca75b796115b15a1e299e43e corporate/3.0/i586/libwmf-0.2.8-6.6.C30mdk.i586.rpm fb1a17a5e64ba156b386a94cbbc52355 corporate/3.0/SRPMS/libwmf-0.2.8-6.6.C30mdk.src.rpm Corporate 3.0/X86_64: 54cd23ce8d40499970f26dbd841ab8a6 corporate/3.0/x86_64/lib64wmf0.2_7-0.2.8-6.6.C30mdk.x86_64.rpm 089cadda8c879d3e4aed68e4b0feccd4 corporate/3.0/x86_64/lib64wmf0.2_7-devel-0.2.8-6.6.C30mdk.x86_64.rpm adbfbafa64eeb734f21fc8f8483c2f7b corporate/3.0/x86_64/libwmf-0.2.8-6.6.C30mdk.x86_64.rpm fb1a17a5e64ba156b386a94cbbc52355 corporate/3.0/SRPMS/libwmf-0.2.8-6.6.C30mdk.src.rpm Corporate 4.0: 48a7c42b8e4bd5465ce3acb4e2f03d19 corporate/4.0/i586/libwmf0.2_7-0.2.8.3-6.6.20060mlcs4.i586.rpm ee957f0a4c3fe69d50aa2b8ce9bad619 corporate/4.0/i586/libwmf0.2_7-devel-0.2.8.3-6.6.20060mlcs4.i586.rpm d99ed07d9087627101ec3a6bfc8ddf13 corporate/4.0/i586/libwmf-0.2.8.3-6.6.20060mlcs4.i586.rpm a1c9970e6f7317d4776decc4f4b02665 corporate/4.0/SRPMS/libwmf-0.2.8.3-6.6.20060mlcs4.src.rpm Corporate 4.0/X86_64: be0efb665fb41259f3e49db45bf86bf7 corporate/4.0/x86_64/lib64wmf0.2_7-0.2.8.3-6.6.20060mlcs4.x86_64.rpm 9f199425e1d97dd0d7b5c50f40316baa corporate/4.0/x86_64/lib64wmf0.2_7-devel-0.2.8.3-6.6.20060mlcs4.x86_64.rpm 576d6e1efd6b83ea226a2ad656a71f04 corporate/4.0/x86_64/libwmf-0.2.8.3-6.6.20060mlcs4.x86_64.rpm a1c9970e6f7317d4776decc4f4b02665 corporate/4.0/SRPMS/libwmf-0.2.8.3-6.6.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFKAIpfmqjQ0CJFipgRAl/bAJ0fCNQ4BMjoTrJisl5ISSH/iVfBJACgiCNf WpHdeUhRY1FcZ+dRrYMBm6o= =iHYX -----END PGP SIGNATURE-----
