December 2005
Six Mandriva Linux Security Advisories: 1. MDKSA-2005:227 - ethereal 2. MDKSA-2005:228 - xine-lib 3. MDKSA-2005:229 - xmovie 4. MDKSA-2005:230 - mplayer 5. MDKSA-2005:231 - ffmpeg 6. MDKSA-2005:232 - gstreamer-ffmpeg
ID: 01101
Ref: 1033/2005
Date: 15 December 2005:12:04:18
Version: 1
Title: Six Mandriva Linux Security Advisories: 1. MDKSA-2005:227 - ethereal 2. MDKSA-2005:228 - xine-lib 3. MDKSA-2005:229 - xmovie 4. MDKSA-2005:230 - mplayer 5. MDKSA-2005:231 - ffmpeg 6. MDKSA-2005:232 - gstreamer-ffmpeg
Abstract:
Vendors affected: Mandriva
Operating systems affected: Mandriva
Applications affected: Mandriva
Title
=====
Six Mandriva Linux Security Advisories:
1. MDKSA-2005:227 - ethereal
2. MDKSA-2005:228 - xine-lib
3. MDKSA-2005:229 - xmovie
4. MDKSA-2005:230 - mplayer
5. MDKSA-2005:231 - ffmpeg
6. MDKSA-2005:232 - gstreamer-ffmpeg
Detail
======
1. A stack-based buffer overflow was discovered in the OSPF dissector in
Ethereal. This could potentially be abused to allow remote attackers
to execute arbitrary code via crafted packets.
2. Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
3. Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
4. Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
5. Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
6. Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
1.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:227
http://www.mandriva.com/security/
_______________________________________________________________________
Package : ethereal
Date : December 14, 2005
Affected: 2006.0
_______________________________________________________________________
Problem Description:
A stack-based buffer overflow was discovered in the OSPF dissector in
Ethereal. This could potentially be abused to allow remote attackers
to execute arbitrary code via crafted packets.
The updated packages have been patched to prevent this problem.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3651
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
027fdd01892a957cbd51e12bfb67c5f8 2006.0/RPMS/ethereal-0.10.13-0.5.20060mdk.i586.rpm
73193fe2d3878cecab885d8b6cd6a08a 2006.0/RPMS/ethereal-tools-0.10.13-0.5.20060mdk.i586.rpm
2ec34afc4cdbd31bfa68640f13ff806e 2006.0/RPMS/libethereal0-0.10.13-0.5.20060mdk.i586.rpm
5254cd0a674ed501d25ec42ee4191cf1 2006.0/RPMS/tethereal-0.10.13-0.5.20060mdk.i586.rpm
a8c390894b8410e06b12d1f2049db2d6 2006.0/SRPMS/ethereal-0.10.13-0.5.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
09829fadefeb435e75aefa966b51cc56 x86_64/2006.0/RPMS/ethereal-0.10.13-0.5.20060mdk.x86_64.rpm
5c0e3a206220014841a540e149fe96e0 x86_64/2006.0/RPMS/ethereal-tools-0.10.13-0.5.20060mdk.x86_64.rpm
7ca64eb45c380c5eccec6d99e4ca9780 x86_64/2006.0/RPMS/lib64ethereal0-0.10.13-0.5.20060mdk.x86_64.rpm
8510de1e6d3f38ed08d6f863d56c0ee9 x86_64/2006.0/RPMS/tethereal-0.10.13-0.5.20060mdk.x86_64.rpm
a8c390894b8410e06b12d1f2049db2d6 x86_64/2006.0/SRPMS/ethereal-0.10.13-0.5.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDoICmmqjQ0CJFipgRAoI7AJ9y6m4vBYBTxsqLPS/ieSeSEEr4YACgwMhN
9IHFyD0B6DyavCcao09sVsk=
=AKMk
- -----END PGP SIGNATURE-----
2.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:228
http://www.mandriva.com/security/
_______________________________________________________________________
Package : xine-lib
Date : December 14, 2005
Affected: 2006.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
The vulnerability is caused due to a boundary error in the
"avcodec_default_get_buffer()" function of "utils.c" in libavcodec.
This can be exploited to cause a heap-based buffer overflow when a
specially-crafted 1x1 ".png" file containing a palette is read.
Xine-lib is built with a private copy of ffmpeg containing this
same code. (Corporate Server 2.1 is not vulnerable)
The updated packages have been patched to prevent this problem.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
106bddc3b9cb60714c00c9ca0709f24f 2006.0/RPMS/libxine1-1.1.0-9.2.20060mdk.i586.rpm
080965d48571a7c6a21f5509b9edc6bb 2006.0/RPMS/libxine1-devel-1.1.0-9.2.20060mdk.i586.rpm
1b5cab0dea7da6a896f076f40057b04f 2006.0/RPMS/xine-aa-1.1.0-9.2.20060mdk.i586.rpm
749413958bae867d0e401cf3fb7ad2d4 2006.0/RPMS/xine-arts-1.1.0-9.2.20060mdk.i586.rpm
6dacf41d2ebea975675eeec3daaa5ed2 2006.0/RPMS/xine-dxr3-1.1.0-9.2.20060mdk.i586.rpm
1c0a5a698ffd77dac839cdd70e3a568b 2006.0/RPMS/xine-esd-1.1.0-9.2.20060mdk.i586.rpm
ce3a5ecb960a91faafd6376eb1d79bfb 2006.0/RPMS/xine-flac-1.1.0-9.2.20060mdk.i586.rpm
cff6a28e36785bb64f5cde6911d03a49 2006.0/RPMS/xine-gnomevfs-1.1.0-9.2.20060mdk.i586.rpm
8cffb6762d014113bdcb78f3b7c682f9 2006.0/RPMS/xine-image-1.1.0-9.2.20060mdk.i586.rpm
22a248a5660f5098dcbd0731a92ba7e0 2006.0/RPMS/xine-plugins-1.1.0-9.2.20060mdk.i586.rpm
4a3ce0b28a549de15f9668f0236bf50c 2006.0/RPMS/xine-polyp-1.1.0-9.2.20060mdk.i586.rpm
f5f118f2bbfb1bdd4f9a940450050e53 2006.0/RPMS/xine-smb-1.1.0-9.2.20060mdk.i586.rpm
424b1913ecb7aa0f96b19c71500f65a3 2006.0/SRPMS/xine-lib-1.1.0-9.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
913f831f85eb7cce65d79c46febb1973 x86_64/2006.0/RPMS/lib64xine1-1.1.0-9.2.20060mdk.x86_64.rpm
cb5cbf9e7e5e3d47818ef3fc6702b04b x86_64/2006.0/RPMS/lib64xine1-devel-1.1.0-9.2.20060mdk.x86_64.rpm
1559fb1a68019ed74047b602f14c0cc9 x86_64/2006.0/RPMS/xine-aa-1.1.0-9.2.20060mdk.x86_64.rpm
931aec226e6266e10963d68e12cc3546 x86_64/2006.0/RPMS/xine-arts-1.1.0-9.2.20060mdk.x86_64.rpm
966f1ef51f097657718d45e7611c64d8 x86_64/2006.0/RPMS/xine-dxr3-1.1.0-9.2.20060mdk.x86_64.rpm
62bce4ff948e301e81ff228925dc96af x86_64/2006.0/RPMS/xine-esd-1.1.0-9.2.20060mdk.x86_64.rpm
c9b162cfd51ab3877711245d14af4e1c x86_64/2006.0/RPMS/xine-flac-1.1.0-9.2.20060mdk.x86_64.rpm
ffacd2cef4e3c181b12f663b19e7bda7 x86_64/2006.0/RPMS/xine-gnomevfs-1.1.0-9.2.20060mdk.x86_64.rpm
199ca828d6e3314b67330c32d45cc4a3 x86_64/2006.0/RPMS/xine-image-1.1.0-9.2.20060mdk.x86_64.rpm
81cb882870abf57921c96a66edf5185e x86_64/2006.0/RPMS/xine-plugins-1.1.0-9.2.20060mdk.x86_64.rpm
74a37edf5d9b2cb28a2ce758904b113b x86_64/2006.0/RPMS/xine-polyp-1.1.0-9.2.20060mdk.x86_64.rpm
f930bcfa573f7c250f54c48564e943e1 x86_64/2006.0/RPMS/xine-smb-1.1.0-9.2.20060mdk.x86_64.rpm
424b1913ecb7aa0f96b19c71500f65a3 x86_64/2006.0/SRPMS/xine-lib-1.1.0-9.2.20060mdk.src.rpm
Corporate 3.0:
eb66ad363e7225f165cdbd67f6e26065 corporate/3.0/RPMS/libxine1-1-0.rc3.6.7.C30mdk.i586.rpm
6c89df1070e6b26f35d75a48cb7405ad corporate/3.0/RPMS/libxine1-devel-1-0.rc3.6.7.C30mdk.i586.rpm
6e583c278819c349670a5a305fff766c corporate/3.0/RPMS/xine-aa-1-0.rc3.6.7.C30mdk.i586.rpm
e77f19f13166e42fd3df09fd9b9eba15 corporate/3.0/RPMS/xine-arts-1-0.rc3.6.7.C30mdk.i586.rpm
89d7298da642be02345cdf98d33daf00 corporate/3.0/RPMS/xine-dxr3-1-0.rc3.6.7.C30mdk.i586.rpm
1947fd6e09255382a3c797b81ba41200 corporate/3.0/RPMS/xine-esd-1-0.rc3.6.7.C30mdk.i586.rpm
c39de7583826f7987a96f392daaad4ea corporate/3.0/RPMS/xine-flac-1-0.rc3.6.7.C30mdk.i586.rpm
9eb882a4d1925a5e75de338294d5fee3 corporate/3.0/RPMS/xine-gnomevfs-1-0.rc3.6.7.C30mdk.i586.rpm
be189966eee8bb042e3066c9d96f0b4f corporate/3.0/RPMS/xine-plugins-1-0.rc3.6.7.C30mdk.i586.rpm
cf0248a3252c55af1e15b01efae50298 corporate/3.0/SRPMS/xine-lib-1-0.rc3.6.7.C30mdk.src.rpm
Corporate 3.0/X86_64:
833c0e0f8468d4df40e300c0a72ac1cb x86_64/corporate/3.0/RPMS/lib64xine1-1-0.rc3.6.7.C30mdk.x86_64.rpm
7a802e66ab344aa9b151679d669b0620 x86_64/corporate/3.0/RPMS/lib64xine1-devel-1-0.rc3.6.7.C30mdk.x86_64.rpm
18132113599b1330359a045d11410d5d x86_64/corporate/3.0/RPMS/xine-arts-1-0.rc3.6.7.C30mdk.x86_64.rpm
94beaa6edc2fd1be6badef18d818dc0c x86_64/corporate/3.0/RPMS/xine-plugins-1-0.rc3.6.7.C30mdk.x86_64.rpm
cf0248a3252c55af1e15b01efae50298 x86_64/corporate/3.0/SRPMS/xine-lib-1-0.rc3.6.7.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDoIkfmqjQ0CJFipgRAsJPAJ90bC8k3OUmZ0/Ov+j4ART8b4W+9wCg6kdf
HQwPF/7Y6E3vpgrdYViCUEk=
=MIpp
- -----END PGP SIGNATURE-----
3.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:229
http://www.mandriva.com/security/
_______________________________________________________________________
Package : xmovie
Date : December 14, 2005
Affected: 2006.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
The vulnerability is caused due to a boundary error in the
"avcodec_default_get_buffer()" function of "utils.c" in libavcodec.
This can be exploited to cause a heap-based buffer overflow when a
specially-crafted 1x1 ".png" file containing a palette is read.
Xmovie is built with a private copy of ffmpeg containing this
same code.
The updated packages have been patched to prevent this problem.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
b6b3622d949af833f6fbb5b89a32a10d 2006.0/RPMS/xmovie-1.9.13-2.2.20060mdk.i586.rpm
48f0b55b1d8547eb77d3f4cf9787544b 2006.0/SRPMS/xmovie-1.9.13-2.2.20060mdk.src.rpm
Corporate 3.0:
3fae159ac8ab7aa190d341868009e3c6 corporate/3.0/RPMS/xmovie-1.9.11-1.2.C30mdk.i586.rpm
18674dd3aff5f923ac327bbf134aca8c corporate/3.0/SRPMS/xmovie-1.9.11-1.2.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDoImJmqjQ0CJFipgRAjvUAKCnN0bVkbd9HsA8+KgveXVd9DVKdwCfa0Hm
7jgGjjBwWM6iVdgSewMJviw=
=JTeK
- -----END PGP SIGNATURE-----
4.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:230
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mplayer
Date : December 14, 2005
Affected: 2006.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
The vulnerability is caused due to a boundary error in the
"avcodec_default_get_buffer()" function of "utils.c" in libavcodec.
This can be exploited to cause a heap-based buffer overflow when a
specially-crafted 1x1 ".png" file containing a palette is read.
Mplayer is built with a private copy of ffmpeg containing this
same code.
The updated packages have been patched to prevent this problem.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
0ec3fbc7140878b8852bfe4523bc976f 2006.0/RPMS/libdha1.0-1.0-1.pre7.12.1.20060mdk.i586.rpm
4d06925f029d9cb90de021361ec1eb8a 2006.0/RPMS/libpostproc0-1.0-1.pre7.12.1.20060mdk.i586.rpm
480697743af240b95de26f3ee2ee27bb 2006.0/RPMS/libpostproc0-devel-1.0-1.pre7.12.1.20060mdk.i586.rpm
bd5f41b990b0f44258e22574f7995267 2006.0/RPMS/mencoder-1.0-1.pre7.12.1.20060mdk.i586.rpm
2e03b0379a736eeda906f521f51a8aae 2006.0/RPMS/mplayer-1.0-1.pre7.12.1.20060mdk.i586.rpm
a0b6a9272cb389107871176acd59374d 2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.1.20060mdk.i586.rpm
598d3194b03a2953478058300e9867be 2006.0/SRPMS/mplayer-1.0-1.pre7.12.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
5ec60b589f7b913e5da5b410d476df34 x86_64/2006.0/RPMS/lib64postproc0-1.0-1.pre7.12.1.20060mdk.x86_64.rpm
f169744934c966e9d6f063bdaabe61df x86_64/2006.0/RPMS/lib64postproc0-devel-1.0-1.pre7.12.1.20060mdk.x86_64.rpm
e5cd5361fbf279b75adeb038e45f30b3 x86_64/2006.0/RPMS/mencoder-1.0-1.pre7.12.1.20060mdk.x86_64.rpm
d955698040d2ccc2999b847b5f2d675b x86_64/2006.0/RPMS/mplayer-1.0-1.pre7.12.1.20060mdk.x86_64.rpm
1f4bdb33c3e36ee18be2caaef670882d x86_64/2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.1.20060mdk.x86_64.rpm
598d3194b03a2953478058300e9867be x86_64/2006.0/SRPMS/mplayer-1.0-1.pre7.12.1.20060mdk.src.rpm
Corporate 3.0:
573a0671a726dda3e54147a1c9ba29ed corporate/3.0/RPMS/libdha0.1-1.0-0.pre3.14.5.C30mdk.i586.rpm
aa92e33a95a2e1848b9204fdb7d7e802 corporate/3.0/RPMS/libpostproc0-1.0-0.pre3.14.5.C30mdk.i586.rpm
52cbda2a1568908abb2b5dfe6e5df742 corporate/3.0/RPMS/libpostproc0-devel-1.0-0.pre3.14.5.C30mdk.i586.rpm
2d4eef182721451a986db84cd02bb98f corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.5.C30mdk.i586.rpm
74c84c00d4f23cd359b2b86ecd441a35 corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.5.C30mdk.i586.rpm
168340803feefa90fd44204f1a57832e corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.5.C30mdk.i586.rpm
37026a2af62ea105e5191ba63ae7abcc corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.5.C30mdk.src.rpm
Corporate 3.0/X86_64:
8fbf576d3d232fcdc273ee79d1b8a411 x86_64/corporate/3.0/RPMS/lib64postproc0-1.0-0.pre3.14.5.C30mdk.x86_64.rpm
bfeeb43e38be402db9a15d09017c57fc x86_64/corporate/3.0/RPMS/lib64postproc0-devel-1.0-0.pre3.14.5.C30mdk.x86_64.rpm
b261ec2a243b557b842372a8500e0102 x86_64/corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.5.C30mdk.x86_64.rpm
5ee546e66a0956b4cfcc8f7f76ac5c1b x86_64/corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.5.C30mdk.x86_64.rpm
5d079fccbb6aa538e2e462bf8195ccf1 x86_64/corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.5.C30mdk.x86_64.rpm
37026a2af62ea105e5191ba63ae7abcc x86_64/corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.5.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDoItpmqjQ0CJFipgRAnHYAKD1C/yirdkJgmCCgzHQ3LuPbrCvCQCfdo04
B4ULYp42H7z3rnTp5a+UcVo=
=fnux
- -----END PGP SIGNATURE-----
5.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:231
http://www.mandriva.com/security/
_______________________________________________________________________
Package : ffmpeg
Date : December 14, 2005
Affected: 2006.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
The vulnerability is caused due to a boundary error in the
"avcodec_default_get_buffer()" function of "utils.c" in libavcodec.
This can be exploited to cause a heap-based buffer overflow when a
specially-crafted 1x1 ".png" file containing a palette is read.
The updated packages have been patched to prevent this problem.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
328ece4eb327ae1a8bd469e7cfd67a3e 2006.0/RPMS/ffmpeg-0.4.9-0.pre1.5.1.20060mdk.i586.rpm
56b14628f0c39a90e73efdd707c01abb 2006.0/RPMS/libffmpeg0-0.4.9-0.pre1.5.1.20060mdk.i586.rpm
26e70cd6bcf85d2da24ff21d23e54ec4 2006.0/RPMS/libffmpeg0-devel-0.4.9-0.pre1.5.1.20060mdk.i586.rpm
33c744c5c8b5e97b26d3a871c664f38d 2006.0/SRPMS/ffmpeg-0.4.9-0.pre1.5.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
fffaeaf65e153d5c68ba8fc2e63f5a20 x86_64/2006.0/RPMS/ffmpeg-0.4.9-0.pre1.5.1.20060mdk.x86_64.rpm
cfe92867d45206761c2d0442fc94438b x86_64/2006.0/RPMS/lib64ffmpeg0-0.4.9-0.pre1.5.1.20060mdk.x86_64.rpm
69a16bc824805150c1c08660421215bf x86_64/2006.0/RPMS/lib64ffmpeg0-devel-0.4.9-0.pre1.5.1.20060mdk.x86_64.rpm
33c744c5c8b5e97b26d3a871c664f38d x86_64/2006.0/SRPMS/ffmpeg-0.4.9-0.pre1.5.1.20060mdk.src.rpm
Corporate 3.0:
8c9f945457c3c6b6ea27bdc09b551228 corporate/3.0/RPMS/ffmpeg-0.4.8-7.2.C30mdk.i586.rpm
7a18cf6e760524cdc11dcb41674de4c4 corporate/3.0/RPMS/libffmpeg0-0.4.8-7.2.C30mdk.i586.rpm
a28eed315d715bf831fe4e1c4fa755b0 corporate/3.0/RPMS/libffmpeg0-devel-0.4.8-7.2.C30mdk.i586.rpm
c0933f7bdd4c18c2acbc87daaa575dc7 corporate/3.0/SRPMS/ffmpeg-0.4.8-7.2.C30mdk.src.rpm
Corporate 3.0/X86_64:
005b38cf84986bcb47a96eae3312196c x86_64/corporate/3.0/RPMS/ffmpeg-0.4.8-7.2.C30mdk.x86_64.rpm
cd8c5a941ce2a7c8b3b1bd698627391c x86_64/corporate/3.0/RPMS/lib64ffmpeg0-0.4.8-7.2.C30mdk.x86_64.rpm
66c67e4a1bea207ecccd6b7c5336b489 x86_64/corporate/3.0/RPMS/lib64ffmpeg0-devel-0.4.8-7.2.C30mdk.x86_64.rpm
c0933f7bdd4c18c2acbc87daaa575dc7 x86_64/corporate/3.0/SRPMS/ffmpeg-0.4.8-7.2.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDoIvSmqjQ0CJFipgRAvWxAJ9yOBnb23UJaYz6Qop3euOTW7Xr8QCg2VH2
nQECP6rdrur/l2TikKV1V30=
=+fkD
- -----END PGP SIGNATURE-----
6.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:232
http://www.mandriva.com/security/
_______________________________________________________________________
Package : gstreamer-ffmpeg
Date : December 14, 2005
Affected: 2006.0
_______________________________________________________________________
Problem Description:
Simon Kilvington discovered a vulnerability in FFmpeg libavcodec,
which can be exploited by malicious people to cause a DoS (Denial
of Service) and potentially to compromise a user's system.
The vulnerability is caused due to a boundary error in the
"avcodec_default_get_buffer()" function of "utils.c" in libavcodec.
This can be exploited to cause a heap-based buffer overflow when a
specially-crafted 1x1 ".png" file containing a palette is read.
Gstreamer-ffmpeg is built with a private copy of ffmpeg containing
this same code.
The updated packages have been patched to prevent this problem.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4048
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
1e7f7ad8be3efcc5152901d1de9050c7 2006.0/RPMS/gstreamer-ffmpeg-0.8.6-1.1.20060mdk.i586.rpm
2923eb22aafa7aedd073516e47a7d94f 2006.0/SRPMS/gstreamer-ffmpeg-0.8.6-1.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
617b165113eb1af7e805d7c2423a771b x86_64/2006.0/RPMS/gstreamer-ffmpeg-0.8.6-1.1.20060mdk.x86_64.rpm
2923eb22aafa7aedd073516e47a7d94f x86_64/2006.0/SRPMS/gstreamer-ffmpeg-0.8.6-1.1.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDoI2UmqjQ0CJFipgRAj5nAJ9pHRQCF/d1c0LzB9fbYJjhN3+i/wCgnyv7
vBp5g+DjEjutOTklN3tvNLs=
=xQN5
- -----END PGP SIGNATURE-----