-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:124 http://www.mandriva.com/security/ _______________________________________________________________________ Package : pulseaudio Date : June 23, 2010 Affected: 2008.0, 2009.0, 2009.1, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file (CVE-2009-1299). This update fixes this issue. _______________________________________________________________________ References: https://qa.mandriva.com/59912 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: e804c90f35435c1a76bc743dfbb584b3 2008.0/i586/libpulseaudio0-0.9.6-3.3mdv2008.0.i586.rpm e977f66696f16c53e64117759de27f22 2008.0/i586/libpulseaudio0-devel-0.9.6-3.3mdv2008.0.i586.rpm a4220dc3aaaa2792f7a8d11384f5b628 2008.0/i586/libpulsecore3-0.9.6-3.3mdv2008.0.i586.rpm 61395325609d32c442cdefafca42dc52 2008.0/i586/pulseaudio-0.9.6-3.3mdv2008.0.i586.rpm 0ba18d08033d15655e5f694d7c84227b 2008.0/SRPMS/pulseaudio-0.9.6-3.3mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 1c8d71d9b7d90c3008ea2201c6fb014e 2008.0/x86_64/lib64pulseaudio0-0.9.6-3.3mdv2008.0.x86_64.rpm 4461979beb9d0f03020f3118b6f1b14f 2008.0/x86_64/lib64pulseaudio0-devel-0.9.6-3.3mdv2008.0.x86_64.rpm 161dbf74c188615e5333b880fe48de36 2008.0/x86_64/lib64pulsecore3-0.9.6-3.3mdv2008.0.x86_64.rpm 30fff089a03a648a4b23bff5eab57ec0 2008.0/x86_64/pulseaudio-0.9.6-3.3mdv2008.0.x86_64.rpm 0ba18d08033d15655e5f694d7c84227b 2008.0/SRPMS/pulseaudio-0.9.6-3.3mdv2008.0.src.rpm Mandriva Linux 2009.0: e13bc62bbe4364ce5d48679375a8a8a9 2009.0/i586/libpulseaudio0-0.9.10-11.3mdv2009.0.i586.rpm e3005151972fb8441654b7561fe0d248 2009.0/i586/libpulseaudio-devel-0.9.10-11.3mdv2009.0.i586.rpm f9cf0ba017a14ee8f733ff5f5a0df6c0 2009.0/i586/libpulsecore5-0.9.10-11.3mdv2009.0.i586.rpm 6976571851b946eb02acedd3d8dbebf7 2009.0/i586/libpulseglib20-0.9.10-11.3mdv2009.0.i586.rpm b7b2fcf19c8686c973ee3fc23bdb7cfa 2009.0/i586/libpulsezeroconf0-0.9.10-11.3mdv2009.0.i586.rpm db6ad87e2431c3217226d5785fb648c6 2009.0/i586/pulseaudio-0.9.10-11.3mdv2009.0.i586.rpm 07c1769eea04c7891b50fdb4765799a9 2009.0/i586/pulseaudio-esound-compat-0.9.10-11.3mdv2009.0.i586.rpm 494d401585b5de7db760df82aa7ae545 2009.0/i586/pulseaudio-module-bluetooth-0.9.10-11.3mdv2009.0.i586.rpm 81e5f19d64bc27bd4c2b6eda98510c8b 2009.0/i586/pulseaudio-module-gconf-0.9.10-11.3mdv2009.0.i586.rpm 8888b788ed9bad20bec0855eef3a89d1 2009.0/i586/pulseaudio-module-jack-0.9.10-11.3mdv2009.0.i586.rpm 1990f690e68919123f869a2eb41be03f 2009.0/i586/pulseaudio-module-lirc-0.9.10-11.3mdv2009.0.i586.rpm 9851f1403bcf97d69a1b0b132e08efed 2009.0/i586/pulseaudio-module-x11-0.9.10-11.3mdv2009.0.i586.rpm 6b96ede5c13a8cb8c4a5863ec3551fbf 2009.0/i586/pulseaudio-module-zeroconf-0.9.10-11.3mdv2009.0.i586.rpm 0478ee23de1e032957216ecca370aaed 2009.0/i586/pulseaudio-utils-0.9.10-11.3mdv2009.0.i586.rpm 6343de51cb79c96543eae2cf9e75213c 2009.0/SRPMS/pulseaudio-0.9.10-11.3mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 868e128f6d5f37d71a3ed6abd70efbc1 2009.0/x86_64/lib64pulseaudio0-0.9.10-11.3mdv2009.0.x86_64.rpm 2f17c281d3f8819f102d0b6014c2c899 2009.0/x86_64/lib64pulseaudio-devel-0.9.10-11.3mdv2009.0.x86_64.rpm 96815eb2ab7782bdf208d505ac08da13 2009.0/x86_64/lib64pulsecore5-0.9.10-11.3mdv2009.0.x86_64.rpm a7c9d1a2883a7722134a3c2c2eea67ad 2009.0/x86_64/lib64pulseglib20-0.9.10-11.3mdv2009.0.x86_64.rpm a95dea7043a6decd0a5b149f8d021d21 2009.0/x86_64/lib64pulsezeroconf0-0.9.10-11.3mdv2009.0.x86_64.rpm f69e362b7a9c5a246fef4522ed0f9fa3 2009.0/x86_64/pulseaudio-0.9.10-11.3mdv2009.0.x86_64.rpm 322f2306c1c476a1d1e6c781e30d994d 2009.0/x86_64/pulseaudio-esound-compat-0.9.10-11.3mdv2009.0.x86_64.rpm 65ee2ebdbb91b7162b918f4f3718ed20 2009.0/x86_64/pulseaudio-module-bluetooth-0.9.10-11.3mdv2009.0.x86_64.rpm e68c209a41e10d90f8d14e9a523b2283 2009.0/x86_64/pulseaudio-module-gconf-0.9.10-11.3mdv2009.0.x86_64.rpm 314e4acfb4b29f9aa7b6b2e9bd50bb1c 2009.0/x86_64/pulseaudio-module-jack-0.9.10-11.3mdv2009.0.x86_64.rpm 21eac366956f3dcbd995d5e3872f6355 2009.0/x86_64/pulseaudio-module-lirc-0.9.10-11.3mdv2009.0.x86_64.rpm cb86695cda059f7a71efeddfa33e9957 2009.0/x86_64/pulseaudio-module-x11-0.9.10-11.3mdv2009.0.x86_64.rpm f7c95a9df28794a0d7292f0b9f3bdd3f 2009.0/x86_64/pulseaudio-module-zeroconf-0.9.10-11.3mdv2009.0.x86_64.rpm d7de58dfe97c5f1098fe3612dfaac819 2009.0/x86_64/pulseaudio-utils-0.9.10-11.3mdv2009.0.x86_64.rpm 6343de51cb79c96543eae2cf9e75213c 2009.0/SRPMS/pulseaudio-0.9.10-11.3mdv2009.0.src.rpm Mandriva Linux 2009.1: 43f10d8943a47397cda9a459a52ecdc6 2009.1/i586/libpulseaudio0-0.9.15-2.1mdv2009.1.i586.rpm deefa751a75e91bfd4871cf0c84f9acd 2009.1/i586/libpulseaudio-devel-0.9.15-2.1mdv2009.1.i586.rpm b42b5a3cb7f451fef63c00767804a2a4 2009.1/i586/libpulseglib20-0.9.15-2.1mdv2009.1.i586.rpm c8e62314ddc0231f4d0cf1c10754bc65 2009.1/i586/libpulsezeroconf0-0.9.15-2.1mdv2009.1.i586.rpm 0dc8a2ebe1dc70ed968d7e043fcd0443 2009.1/i586/pulseaudio-0.9.15-2.1mdv2009.1.i586.rpm 63d757b6620a578aa49dd11ddc8cdca0 2009.1/i586/pulseaudio-esound-compat-0.9.15-2.1mdv2009.1.i586.rpm 90b35ac556fc1c94fe8595c4b53c429a 2009.1/i586/pulseaudio-module-bluetooth-0.9.15-2.1mdv2009.1.i586.rpm 26e8f63ccf48d9d1e91eca04b4337c2b 2009.1/i586/pulseaudio-module-gconf-0.9.15-2.1mdv2009.1.i586.rpm d44eeb62fc828bf9eaaa0214e5803a56 2009.1/i586/pulseaudio-module-jack-0.9.15-2.1mdv2009.1.i586.rpm c74c88b8f1cdf0492e766861e0e9a328 2009.1/i586/pulseaudio-module-lirc-0.9.15-2.1mdv2009.1.i586.rpm ad6a7fd46c3a846b15118465d3deb019 2009.1/i586/pulseaudio-module-x11-0.9.15-2.1mdv2009.1.i586.rpm 6d3680ad3a179431341a818c14ea88c8 2009.1/i586/pulseaudio-module-zeroconf-0.9.15-2.1mdv2009.1.i586.rpm 009ffc74be4d656f84e5af2a2fe7700c 2009.1/i586/pulseaudio-utils-0.9.15-2.1mdv2009.1.i586.rpm bd0d81ae4238e2eebc4087628c61c7f3 2009.1/SRPMS/pulseaudio-0.9.15-2.1mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: d8383bf892d4f06c81fc96983a1b16f5 2009.1/x86_64/lib64pulseaudio0-0.9.15-2.1mdv2009.1.x86_64.rpm 9f748165c144c0f06758d1bb58fbd3fb 2009.1/x86_64/lib64pulseaudio-devel-0.9.15-2.1mdv2009.1.x86_64.rpm 602fd8b8aba1a2dc1fb96bbd445baedc 2009.1/x86_64/lib64pulseglib20-0.9.15-2.1mdv2009.1.x86_64.rpm 828abbdbf958de94af84c9bf214592c3 2009.1/x86_64/lib64pulsezeroconf0-0.9.15-2.1mdv2009.1.x86_64.rpm 69337b185108d299a77805e4d8ad13af 2009.1/x86_64/pulseaudio-0.9.15-2.1mdv2009.1.x86_64.rpm f13ed52bd2b0ad4d09b215664beb67e3 2009.1/x86_64/pulseaudio-esound-compat-0.9.15-2.1mdv2009.1.x86_64.rpm 51410c9ca131d140e3f6940b7c9ff18a 2009.1/x86_64/pulseaudio-module-bluetooth-0.9.15-2.1mdv2009.1.x86_64.rpm e0cc8bff44a5d3ab846e12e8a1fb5cc9 2009.1/x86_64/pulseaudio-module-gconf-0.9.15-2.1mdv2009.1.x86_64.rpm 28decc382ed9604c4f00475b909ff073 2009.1/x86_64/pulseaudio-module-jack-0.9.15-2.1mdv2009.1.x86_64.rpm 6b4d11bc23dd9a209ec9b102a48a8b67 2009.1/x86_64/pulseaudio-module-lirc-0.9.15-2.1mdv2009.1.x86_64.rpm 86c6ba0fd9bfc23233339348820c71f2 2009.1/x86_64/pulseaudio-module-x11-0.9.15-2.1mdv2009.1.x86_64.rpm 0187acc31cd3de991880813a2ffca003 2009.1/x86_64/pulseaudio-module-zeroconf-0.9.15-2.1mdv2009.1.x86_64.rpm e0580d28406c12aa9c6998f09c69450f 2009.1/x86_64/pulseaudio-utils-0.9.15-2.1mdv2009.1.x86_64.rpm bd0d81ae4238e2eebc4087628c61c7f3 2009.1/SRPMS/pulseaudio-0.9.15-2.1mdv2009.1.src.rpm Mandriva Enterprise Server 5: a97e9c6847af75c5635a919a94e42e38 mes5/i586/libpulseaudio0-0.9.10-11.3mdvmes5.i586.rpm d928752def3ad996fe8d7cb74f002bef mes5/i586/libpulseaudio-devel-0.9.10-11.3mdvmes5.i586.rpm d47e529fe04f4bc6a793f417556b019c mes5/i586/libpulsecore5-0.9.10-11.3mdvmes5.i586.rpm 071ea1f27540559f4d02a4be7108199d mes5/i586/libpulseglib20-0.9.10-11.3mdvmes5.i586.rpm c6f11601c0aee1631daee948f57ee6f5 mes5/i586/libpulsezeroconf0-0.9.10-11.3mdvmes5.i586.rpm afaa500081de2de7ec08687276e4ed4d mes5/i586/pulseaudio-0.9.10-11.3mdvmes5.i586.rpm d9cd49795ee77e5b13eb4cf515e8e9d6 mes5/i586/pulseaudio-esound-compat-0.9.10-11.3mdvmes5.i586.rpm 3055f0c3498de1c113b2ccf2adc39ec1 mes5/i586/pulseaudio-module-bluetooth-0.9.10-11.3mdvmes5.i586.rpm ada2e846882fedf8b9f063ab772e2f93 mes5/i586/pulseaudio-module-gconf-0.9.10-11.3mdvmes5.i586.rpm 4baebe8d3d3b0455e6f52e0d86765179 mes5/i586/pulseaudio-module-jack-0.9.10-11.3mdvmes5.i586.rpm aac6cd87367f1846a1bf9f312fc8823c mes5/i586/pulseaudio-module-lirc-0.9.10-11.3mdvmes5.i586.rpm bdec5a5e3764239435343a77829b9996 mes5/i586/pulseaudio-module-x11-0.9.10-11.3mdvmes5.i586.rpm a1e2d6adb6f6194e6a48ca446359135f mes5/i586/pulseaudio-module-zeroconf-0.9.10-11.3mdvmes5.i586.rpm 31599be5d635c8ee362bc9f6c04f6a2f mes5/i586/pulseaudio-utils-0.9.10-11.3mdvmes5.i586.rpm fcfd1bc3a9195d9026a5ec9292eebbc3 mes5/SRPMS/pulseaudio-0.9.10-11.3mdv2009.0.src.rpm Mandriva Enterprise Server 5/X86_64: d1078a72274f3505bf693f21ae05505d mes5/x86_64/lib64pulseaudio0-0.9.10-11.3mdvmes5.x86_64.rpm 645bb0f48c0624fe4c78bc4d6e7ac788 mes5/x86_64/lib64pulseaudio-devel-0.9.10-11.3mdvmes5.x86_64.rpm 490b31680b1232e111d875287738e748 mes5/x86_64/lib64pulsecore5-0.9.10-11.3mdvmes5.x86_64.rpm 01cf3776cfaccaf401cf4ab9dd56ed71 mes5/x86_64/lib64pulseglib20-0.9.10-11.3mdvmes5.x86_64.rpm 1c1639d5c4059c1a6bf8b2342d4d76f6 mes5/x86_64/lib64pulsezeroconf0-0.9.10-11.3mdvmes5.x86_64.rpm 009282370a3e510a61692d4782a9eadc mes5/x86_64/pulseaudio-0.9.10-11.3mdvmes5.x86_64.rpm f1a08c330344e6539e32e94c019ff719 mes5/x86_64/pulseaudio-esound-compat-0.9.10-11.3mdvmes5.x86_64.rpm 4323818e9f535d40c9e7d13837a81588 mes5/x86_64/pulseaudio-module-bluetooth-0.9.10-11.3mdvmes5.x86_64.rpm 1ed849d9a5663412307d541e6175f05c mes5/x86_64/pulseaudio-module-gconf-0.9.10-11.3mdvmes5.x86_64.rpm 5088d06e237e9978d127623fc21d9a7f mes5/x86_64/pulseaudio-module-jack-0.9.10-11.3mdvmes5.x86_64.rpm b5fcfec98aed3eb60839722087c286ae mes5/x86_64/pulseaudio-module-lirc-0.9.10-11.3mdvmes5.x86_64.rpm 289f88d4e9d49c2228a90580f65df2e7 mes5/x86_64/pulseaudio-module-x11-0.9.10-11.3mdvmes5.x86_64.rpm 088d9b902d9f435a63bde203e377f5e9 mes5/x86_64/pulseaudio-module-zeroconf-0.9.10-11.3mdvmes5.x86_64.rpm 725f8b1c9b3158e8b3650cd3567c0482 mes5/x86_64/pulseaudio-utils-0.9.10-11.3mdvmes5.x86_64.rpm fcfd1bc3a9195d9026a5ec9292eebbc3 mes5/SRPMS/pulseaudio-0.9.10-11.3mdv2009.0.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFMIniAmqjQ0CJFipgRAqJ2AJ9pTwMrUr2lI6s1nqpFX50axuaHZgCgxX+6 Ow31YR588crVaxJIFhP3mJA= =oSlv -----END PGP SIGNATURE-----
