-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:098 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : libupnp Date : April 10, 2013 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated libupnp packages fix security vulnerabilities: The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet (CVE-2012-5958, CVE-2012-5959, CVE-2012-5960, CVE-2012-5961, CVE-2012-5962, CVE-2012-5963, CVE-2012-5964, CVE-2012-5965). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5958 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5959 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5960 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5961 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5962 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5963 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5964 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5965 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0037 _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: e1a84a18b2e770dbce77c11d0155a1f9 mbs1/x86_64/lib64ixml2-1.6.15-2.1.mbs1.x86_64.rpm e1d530a001d425d49eddc2ec2dc999d5 mbs1/x86_64/lib64threadutil6-1.6.15-2.1.mbs1.x86_64.rpm 17c487876aaac30cf97b9ff616b90bf7 mbs1/x86_64/lib64upnp6-1.6.15-2.1.mbs1.x86_64.rpm 685671dfa94ec5145568712ff5d805cd mbs1/x86_64/lib64upnp-devel-1.6.15-2.1.mbs1.x86_64.rpm 2416afd16222310951a75ae68083e38c mbs1/SRPMS/libupnp-1.6.15-2.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRZRMSmqjQ0CJFipgRAq+CAKDy9zvv7WPwoYY42+BtKeHYZ7XqDQCePsx4 IsvYihwpTeTREw4cWkln/vA= =Qz3A -----END PGP SIGNATURE-----
