-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:202 http://www.mandriva.com/security/ _______________________________________________________________________ Package : memcached Date : August 14, 2009 Affected: 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in memcached: Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows (CVE-2009-2415). This update provides a solution to this vulnerability. Additionally memcached-1.2.x has been upgraded to 1.2.8 for 2009.0/2009.1 and MES 5 that contains a number of upstream fixes, the repcached patch has been upgraded to 2.2 as well. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2415 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.0: 9d4d42fe76af248132f829d160495adc 2009.0/i586/memcached-1.2.8-0.1mdv2009.0.i586.rpm d53cac61eb5aa89846b8cd7916c5a758 2009.0/SRPMS/memcached-1.2.8-0.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: ba6a1444fcfcce618ec84cbc6d46f109 2009.0/x86_64/memcached-1.2.8-0.1mdv2009.0.x86_64.rpm d53cac61eb5aa89846b8cd7916c5a758 2009.0/SRPMS/memcached-1.2.8-0.1mdv2009.0.src.rpm Mandriva Linux 2009.1: a996c0c7afdc057fa23a60d9bdc3f5d0 2009.1/i586/memcached-1.2.8-0.1mdv2009.1.i586.rpm 2864ec90f52b817534c36e680ebd924f 2009.1/SRPMS/memcached-1.2.8-0.1mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 64a9462f4a36f128c1025531985b44a6 2009.1/x86_64/memcached-1.2.8-0.1mdv2009.1.x86_64.rpm 2864ec90f52b817534c36e680ebd924f 2009.1/SRPMS/memcached-1.2.8-0.1mdv2009.1.src.rpm Corporate 4.0: 630916635aa2bb9d4f34b7b16a5b9636 corporate/4.0/i586/memcached-1.1.12-4.2.20060mlcs4.i586.rpm 079b93b62379d4ba632eba013675ead3 corporate/4.0/SRPMS/memcached-1.1.12-4.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 89c891eb8c1543762ec8606fab339ed1 corporate/4.0/x86_64/memcached-1.1.12-4.2.20060mlcs4.x86_64.rpm 079b93b62379d4ba632eba013675ead3 corporate/4.0/SRPMS/memcached-1.1.12-4.2.20060mlcs4.src.rpm Mandriva Enterprise Server 5: 96b5ff9995f32f06dc16ac4568694926 mes5/i586/memcached-1.2.8-0.1mdvmes5.i586.rpm 4a6050639b2ef47a686c9571bfafbec9 mes5/SRPMS/memcached-1.2.8-0.1mdvmes5.src.rpm Mandriva Enterprise Server 5/X86_64: 5873483ba54835638044efee0e8d2898 mes5/x86_64/memcached-1.2.8-0.1mdvmes5.x86_64.rpm 4a6050639b2ef47a686c9571bfafbec9 mes5/SRPMS/memcached-1.2.8-0.1mdvmes5.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFKhX8ImqjQ0CJFipgRAoDGAJ4vt5jtckDM1+BLAwvk1RDNc4RlMwCfVcf+ f96rWeMUdAJnRxsj5d9lAn4= =PKA2 -----END PGP SIGNATURE-----
