Date: Mon, 01 Oct 2007 14:31:08 -0600
From: security@mandriva.com
Subject: [ MDKSA-2007:191 ] - Updated libsndfile packages fix vulnerability
To: bugtraq@securityfocus.com
Reply-To: xsecurity@mandriva.com
Message-id: <E1IcRv2-0004CZ-3p@artemis.annvix.ca.>
X-SA-Exim-Connect-IP: 10.0.5.11
X-SA-Exim-Mail-From: qateam@artemis.annvix.ca
X-SA-Exim-Version: 4.2.1 (built Fri, 02 Feb 2007 19:02:33 -0700)
X-SA-Exim-Scanned: Yes (on hades.annvix.org)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:191
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libsndfile
Date : October 1, 2007
Affected: 2007.0, 2007.1
_______________________________________________________________________
Problem Description:
A heap-based buffer overflow in libsndfile could allow remote attackers
to execute arbitrary code via a FLAC file with crafted PCM data which
contains a block with a size exceeding that of the previous block.
Updated packages have been patched to prevent this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4974
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
24100ae70e6966132dd2df9c1b232888 2007.0/i586/libsndfile-progs-1.0.17-2.1mdv2007.0.i586.rpm
c5c705acb80947a1eb97755a1327e83c 2007.0/i586/libsndfile1-1.0.17-2.1mdv2007.0.i586.rpm
5958c9bb24d22926f68f7f92ee2571c9 2007.0/i586/libsndfile1-devel-1.0.17-2.1mdv2007.0.i586.rpm
71dfb4edb740b99a32667606048b055b 2007.0/i586/libsndfile1-static-devel-1.0.17-2.1mdv2007.0.i586.rpm
5f738e2181c2e32c75bc0213a8c28c0d 2007.0/SRPMS/libsndfile-1.0.17-2.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
0e642cd6090fe922f058b246c93efcd8 2007.0/x86_64/lib64sndfile1-1.0.17-2.1mdv2007.0.x86_64.rpm
23841c5fb2828c9205488b1c6755cbea 2007.0/x86_64/lib64sndfile1-devel-1.0.17-2.1mdv2007.0.x86_64.rpm
7836510356ed0f325ff23dbc329005a1 2007.0/x86_64/lib64sndfile1-static-devel-1.0.17-2.1mdv2007.0.x86_64.rpm
98f6ed8e57c9fd0f1f9dd377ad766813 2007.0/x86_64/libsndfile-progs-1.0.17-2.1mdv2007.0.x86_64.rpm
5f738e2181c2e32c75bc0213a8c28c0d 2007.0/SRPMS/libsndfile-1.0.17-2.1mdv2007.0.src.rpm
Mandriva Linux 2007.1:
04da55eb81107b358e3309d8dd82264b 2007.1/i586/libsndfile-progs-1.0.17-5.1mdv2007.1.i586.rpm
f26b54c27ca835daf206fbfe43f4129e 2007.1/i586/libsndfile1-1.0.17-5.1mdv2007.1.i586.rpm
2d10c1398d7fde98919a7c181fae5db3 2007.1/i586/libsndfile1-devel-1.0.17-5.1mdv2007.1.i586.rpm
58eb5002ea5e1a1a2331018addcf83fd 2007.1/i586/libsndfile1-static-devel-1.0.17-5.1mdv2007.1.i586.rpm
50e0901b2142c229a8c0564feb1bb550 2007.1/SRPMS/libsndfile-1.0.17-5.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
7ade2e35ca8c79740df74248fe15d83f 2007.1/x86_64/lib64sndfile1-1.0.17-5.1mdv2007.1.x86_64.rpm
0d3a26b5f9b92029d35760cee29847a4 2007.1/x86_64/lib64sndfile1-devel-1.0.17-5.1mdv2007.1.x86_64.rpm
d5dc6aae1605789598b9d7c7c4910dab 2007.1/x86_64/lib64sndfile1-static-devel-1.0.17-5.1mdv2007.1.x86_64.rpm
4476ecc80e248574f4a1af631024ddfd 2007.1/x86_64/libsndfile-progs-1.0.17-5.1mdv2007.1.x86_64.rpm
50e0901b2142c229a8c0564feb1bb550 2007.1/SRPMS/libsndfile-1.0.17-5.1mdv2007.1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFHAS6RmqjQ0CJFipgRAruqAJ0YYFCi9JfIOmXa8QVJlMVdghSb3gCg28jY
vBAAT39DVZDVBK8HBuwcwYg=
=XBET
-----END PGP SIGNATURE-----
