-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:106 http://www.mandriva.com/security/ _______________________________________________________________________ Package : aria2 Date : May 24, 2010 Affected: 2009.0, 2009.1, 2010.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability was discovered in aria2 which allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file (CVE-2010-1512). This update fixes this issue. Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1512 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.0: 5ea05c2ad0ae20f6e6ec2407d7ec687c 2009.0/i586/aria2-0.15.3-0.20080918.3.2mdv2009.0.i586.rpm 23fe7be66e5ab872ecd529d6b4adb333 2009.0/SRPMS/aria2-0.15.3-0.20080918.3.2mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 7aef880fdb7cf05f04d3e5ffec5a88b4 2009.0/x86_64/aria2-0.15.3-0.20080918.3.2mdv2009.0.x86_64.rpm 23fe7be66e5ab872ecd529d6b4adb333 2009.0/SRPMS/aria2-0.15.3-0.20080918.3.2mdv2009.0.src.rpm Mandriva Linux 2009.1: defb85a38a22de997415c21d06e4a98f 2009.1/i586/aria2-1.2.0-0.20090201.5.3mdv2009.1.i586.rpm 604a90cb5d6c306c86a6d0eb9b408400 2009.1/SRPMS/aria2-1.2.0-0.20090201.5.3mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 3438511cfd153c536d867bbfc0f77c28 2009.1/x86_64/aria2-1.2.0-0.20090201.5.3mdv2009.1.x86_64.rpm 604a90cb5d6c306c86a6d0eb9b408400 2009.1/SRPMS/aria2-1.2.0-0.20090201.5.3mdv2009.1.src.rpm Mandriva Linux 2010.0: 36bc7a159d8c274e43a6ba0b9b5bd5cf 2010.0/i586/aria2-1.6.2-1.4mdv2010.0.i586.rpm 8750b5dc33e770d1c482a0816a6c117e 2010.0/SRPMS/aria2-1.6.2-1.4mdv2010.0.src.rpm Mandriva Linux 2010.0/X86_64: 19a28817e1009d43272161f72bdc1148 2010.0/x86_64/aria2-1.6.2-1.4mdv2010.0.x86_64.rpm 8750b5dc33e770d1c482a0816a6c117e 2010.0/SRPMS/aria2-1.6.2-1.4mdv2010.0.src.rpm Mandriva Enterprise Server 5: 44ff68b509e581bd4b7bccbb219b7d8d mes5/i586/aria2-0.15.3-0.20080918.3.2mdvmes5.1.i586.rpm 378aa9a1713fe97bf4ad025b38a68c3b mes5/SRPMS/aria2-0.15.3-0.20080918.3.2mdv2009.0.src.rpm Mandriva Enterprise Server 5/X86_64: bd717edf887ab38d2e05e0b407eaa6bb mes5/x86_64/aria2-0.15.3-0.20080918.3.2mdvmes5.1.x86_64.rpm 378aa9a1713fe97bf4ad025b38a68c3b mes5/SRPMS/aria2-0.15.3-0.20080918.3.2mdv2009.0.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFL+oPRmqjQ0CJFipgRAgK9AJ0dOVRUicAJZoXYE2Jmk+uMAIc/CACg9NAv OAZKpqeq6/usZzsSOhC0KRo= =+ClR -----END PGP SIGNATURE-----
