January 2007
Three Mandriva Linux Security Advisories
ID: 00057
Ref: 54/2007
Date: 29 January 2007:14:39:54
Version: 1
Title: Three Mandriva Linux Security Advisories
Abstract: 1. Format string vulnerability in the errors_create_window function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors. XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017. 2. Buffer overflow in ulogd has unknown impact and attack vectors related to "improper string length calculations." 3. The soup_headers_parse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers, probably involving missing fields or values.
Vendors affected: Mandriva
Operating systems affected: Mandriva
Applications affected: Mandriva
Title
=====
Three Mandriva Linux Security Advisories:
1. MDKSA-2007:027 - Updated xine-ui packages fix vulnerabilities
2. MDKSA-2007:028 - Updated ulogd packaged to address buffer overflow vulnerability
3. MDKSA-2007:029 - Updated libsoup packages fix DoS vulnerability
Detail
======
1. Format string vulnerability in the errors_create_window function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors. XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017.
2. Buffer overflow in ulogd has unknown impact and attack vectors related to "improper string length calculations."
3. The soup_headers_parse function in soup-headers.c for libsoup HTTP library before
2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers, probably involving missing fields or values.
1.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:027
http://www.mandriva.com/security/
_______________________________________________________________________
Package : xine-ui
Date : January 26, 2007
Affected: 2007.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Format string vulnerability in the errors_create_window function in errors.c in xine-ui allows attackers to execute arbitrary code via unknown vectors. (CVE-2007-0254)
XINE 0.99.4 allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a certain M3U file that contains a long #EXTINF line and contains format string specifiers in an invalid udp:// URI, possibly a variant of CVE-2007-0017. (CVE-2007-0255)
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0254
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0255
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
5a00fa676e755f473ed3894fdbed6fae 2007.0/i586/xine-ui-0.99.4-7.1mdv2007.0.i586.rpm
22ee97e6cab9a53cfbb623911acbff08 2007.0/i586/xine-ui-aa-0.99.4-7.1mdv2007.0.i586.rpm
323d3e53cff4659c12fa4c9c64b8cf80 2007.0/i586/xine-ui-fb-0.99.4-7.1mdv2007.0.i586.rpm
3df57e9d2ba0e239fb0efaac6aae80b9 2007.0/SRPMS/xine-ui-0.99.4-7.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
6936d70577dac7200be466ddc5776ad8 2007.0/x86_64/xine-ui-0.99.4-7.1mdv2007.0.x86_64.rpm
47692d8f90bb60344b780a93b1465784 2007.0/x86_64/xine-ui-aa-0.99.4-7.1mdv2007.0.x86_64.rpm
afb78af3b93eb9ae77f5d26fa78a480e 2007.0/x86_64/xine-ui-fb-0.99.4-7.1mdv2007.0.x86_64.rpm
3df57e9d2ba0e239fb0efaac6aae80b9 2007.0/SRPMS/xine-ui-0.99.4-7.1mdv2007.0.src.rpm
Corporate 3.0:
47b308a588d752dd44a813a05a5aa20a corporate/3.0/i586/xine-ui-0.9.23-3.4.C30mdk.i586.rpm
41a13fc734f6d97f9b9c49763247df45 corporate/3.0/i586/xine-ui-aa-0.9.23-3.4.C30mdk.i586.rpm
488ece09c2e10ffe0403ccb38f259f61 corporate/3.0/i586/xine-ui-fb-0.9.23-3.4.C30mdk.i586.rpm
c37c03e48156837ed8081f53f79006d8 corporate/3.0/SRPMS/xine-ui-0.9.23-3.4.C30mdk.src.rpm
Corporate 3.0/X86_64:
eec4092fa0e0ca22af09e1e6f291f6e0 corporate/3.0/x86_64/xine-ui-0.9.23-3.4.C30mdk.x86_64.rpm
6763e423a13d3a9dffadf6c642085003 corporate/3.0/x86_64/xine-ui-aa-0.9.23-3.4.C30mdk.x86_64.rpm
57863e4da81d1e698e23d6b0889b33cb corporate/3.0/x86_64/xine-ui-fb-0.9.23-3.4.C30mdk.x86_64.rpm
c37c03e48156837ed8081f53f79006d8 corporate/3.0/SRPMS/xine-ui-0.9.23-3.4.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFueK2mqjQ0CJFipgRAiGeAJkBuTUHsp7RoAc8oYs74A1DtXfIBwCgrjQz
+rFssCLGFfA8BMg4ho+0vis=
=tWz9
- -----END PGP SIGNATURE-----
2.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:028
http://www.mandriva.com/security/
_______________________________________________________________________
Package : ulogd
Date : January 26, 2007
Affected: Corporate 4.0
_______________________________________________________________________
Problem Description:
Buffer overflow in ulogd has unknown impact and attack vectors related to "improper string length calculations."
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0460
_______________________________________________________________________
Updated Packages:
Corporate 4.0:
cb3fffdef63f6e7cc08bccc05b1e882c corporate/4.0/i586/ulogd-1.23-2.1.20060mlcs4.i586.rpm
784cbd25194bb71a3c197deb80f3b634 corporate/4.0/i586/ulogd-mysql-1.23-2.1.20060mlcs4.i586.rpm
76b7cb8610d47b7813d42f9878644336 corporate/4.0/i586/ulogd-pcap-1.23-2.1.20060mlcs4.i586.rpm
235a2afc3e88863082f2e9678316e5be corporate/4.0/i586/ulogd-pgsql-1.23-2.1.20060mlcs4.i586.rpm
418d6653046ddea3f3e9bfc3b9ee25c7 corporate/4.0/i586/ulogd-sqlite-1.23-2.1.20060mlcs4.i586.rpm
9873e7960f48810dd0d8fe5f72b2ebfc corporate/4.0/SRPMS/ulogd-1.23-2.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
3da5d0b9bf6af4d69f34cccecea42cfe corporate/4.0/x86_64/ulogd-1.23-2.1.20060mlcs4.x86_64.rpm
bee5bd7a190f23e5c15be8b4f7b052be corporate/4.0/x86_64/ulogd-mysql-1.23-2.1.20060mlcs4.x86_64.rpm
982b1a66fccd7df9ffa3272e0303f2e4 corporate/4.0/x86_64/ulogd-pcap-1.23-2.1.20060mlcs4.x86_64.rpm
e6cc11f6261021dd91b8ab970f6a1619 corporate/4.0/x86_64/ulogd-pgsql-1.23-2.1.20060mlcs4.x86_64.rpm
3e5a8211885c04b4b3df58b9e147a0e7 corporate/4.0/x86_64/ulogd-sqlite-1.23-2.1.20060mlcs4.x86_64.rpm
9873e7960f48810dd0d8fe5f72b2ebfc corporate/4.0/SRPMS/ulogd-1.23-2.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFun6JmqjQ0CJFipgRAgeIAKDzzFjWxExEMHbpzn+RLE3NJwiLcwCfSvU6
DSrLKRpU2m1uyJpM9IQ84BU=
=17Rv
- -----END PGP SIGNATURE-----
3.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:029
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libsoup
Date : January 26, 2007
Affected: 2006.0, 2007.0, Corporate 3.0 _______________________________________________________________________
Problem Description:
The soup_headers_parse function in soup-headers.c for libsoup HTTP library before 2.2.99 allows remote attackers to cause a denial of service (crash) via malformed HTTP headers, probably involving missing fields or values.
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5876
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
4f2b5a0d73c7a7a8d44c993a7d5aa0c2 2006.0/i586/libsoup-2.2_7-2.2.3-2.1.20060mdk.i586.rpm
b908d651b283f7aad2914cc45621779d 2006.0/i586/libsoup-2.2_7-devel-2.2.3-2.1.20060mdk.i586.rpm
fa63dfce230031c179c38c2d4dfef3c0 2006.0/SRPMS/libsoup-2.2.3-2.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
f0fc3b38d4da6d0f852df61a58fa14e9 2006.0/x86_64/lib64soup-2.2_7-2.2.3-2.1.20060mdk.x86_64.rpm
e37aa16dcb0904d3d2bb6c16c192ce31 2006.0/x86_64/lib64soup-2.2_7-devel-2.2.3-2.1.20060mdk.x86_64.rpm
fa63dfce230031c179c38c2d4dfef3c0 2006.0/SRPMS/libsoup-2.2.3-2.1.20060mdk.src.rpm
Mandriva Linux 2007.0:
361254f9fc671c76de0c5b932ef59fbf 2007.0/i586/libsoup-2.2_8-2.2.96-1.1mdv2007.0.i586.rpm
31b044996c030de2563d4cd73c9f53c3 2007.0/i586/libsoup-2.2_8-devel-2.2.96-1.1mdv2007.0.i586.rpm
78e22b0c5511c6bcd1db2618ad824603 2007.0/SRPMS/libsoup-2.2.96-1.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
fc917532647266dc40b4ea5c9c0032c4 2007.0/x86_64/lib64soup-2.2_8-2.2.96-1.1mdv2007.0.x86_64.rpm
e169e51e44a32987e02f78d9b3773011 2007.0/x86_64/lib64soup-2.2_8-devel-2.2.96-1.1mdv2007.0.x86_64.rpm
78e22b0c5511c6bcd1db2618ad824603 2007.0/SRPMS/libsoup-2.2.96-1.1mdv2007.0.src.rpm
Corporate 3.0:
60c23eb5f8875a2438dc8e8c7a5a51c3 corporate/3.0/i586/libsoup-1.99.28-1.1.C30mdk.i586.rpm
7107ef4818fbddbe892043bf273c8286 corporate/3.0/i586/libsoup-2.0_0-1.99.28-1.1.C30mdk.i586.rpm
fd8a36bef1ac3e441f1636d5fb2a29e0 corporate/3.0/i586/libsoup-2.0_0-devel-1.99.28-1.1.C30mdk.i586.rpm
90e23de46abc7f6ddddb9d3d489f4d52 corporate/3.0/SRPMS/libsoup-1.99.28-1.1.C30mdk.src.rpm
Corporate 3.0/X86_64:
8ef5d3702721442e8eafd7ff3be5a5f2 corporate/3.0/x86_64/lib64soup-2.0_0-1.99.28-1.1.C30mdk.x86_64.rpm
a39fcf606ebf0c1b5a96283de9f4441f corporate/3.0/x86_64/lib64soup-2.0_0-devel-1.99.28-1.1.C30mdk.x86_64.rpm
ec4dc1c6a94e2954a350d0fc25d10d89 corporate/3.0/x86_64/libsoup-1.99.28-1.1.C30mdk.x86_64.rpm
90e23de46abc7f6ddddb9d3d489f4d52 corporate/3.0/SRPMS/libsoup-1.99.28-1.1.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFun/YmqjQ0CJFipgRAhhvAKC+7Ty2XJRtW0IxWcAob0ciHOuggACgp9/m
JarCwTg2Tzw/ahiTuXJhOSQ=
=CR5V
- -----END PGP SIGNATURE-----