-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2015:116 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : libtasn1 Date : March 29, 2015 Affected: Business Server 2.0 _______________________________________________________________________ Problem Description: Updated libtasn1 packages fix security vulnerabilities: Multiple buffer boundary check issues were discovered in libtasn1 library, causing it to read beyond the boundary of an allocated buffer. An untrusted ASN.1 input could cause an application using the library to crash (CVE-2014-3467). It was discovered that libtasn1 library function asn1_get_bit_der() could incorrectly report negative bit length of the value read from ASN.1 input. This could possibly lead to an out of bounds access in an application using libtasn1, for example in case if application tried to terminate read value with NUL byte (CVE-2014-3468). A NULL pointer dereference flaw was found in libtasn1's asn1_read_value_type() / asn1_read_value() function. If an application called the function with a NULL value for an ivalue argument to determine the amount of memory needed to store data to be read from the ASN.1 input, libtasn1 could incorrectly attempt to dereference the NULL pointer, causing an application using the library to crash (CVE-2014-3469). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469 http://advisories.mageia.org/MGASA-2014-0247.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 2/X86_64: de6bb1c43cf66acc391b0866c78acc9d mbs2/x86_64/lib64tasn1_6-3.6-1.mbs2.x86_64.rpm 7190acef1aaac85573ade2ff1f25921e mbs2/x86_64/lib64tasn1-devel-3.6-1.mbs2.x86_64.rpm 5d87f79d7d3f3abb3d1b08e594eb5112 mbs2/x86_64/libtasn1-tools-3.6-1.mbs2.x86_64.rpm 67339ddfd49a0693dd664309fe47b351 mbs2/SRPMS/libtasn1-3.6-1.mbs2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFVF7hQmqjQ0CJFipgRAsOhAJ4i3LBbQrVk+SQcbOz4w0m15f0yQgCgjADw jh8cZSlUEuElsAbYnL80Ewg= =S9im -----END PGP SIGNATURE-----
