Jump to content
Compatible Support Forums
Sign in to follow this  
news

[Security Announce] [ MDVSA-2009:041 ] jhead

Recommended Posts

This is a multi-part message in MIME format...

 

------------=_1234900662-6173-897

 

 

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

_______________________________________________________________________

 

Mandriva Linux Security Advisory MDVSA-2009:041

http://www.mandriva.com/security/

_______________________________________________________________________

 

Package : jhead

Date : February 17, 2009

Affected: 2008.0, 2008.1, 2009.0

_______________________________________________________________________

 

Problem Description:

 

Security vulnerabilies have been identified and fixed in jhead.

 

Buffer overflow in the DoCommand function in jhead before 2.84 might

allow context-dependent attackers to cause a denial of service (crash)

(CVE-2008-4575).

 

Jhead before 2.84 allows local users to overwrite arbitrary files

via a symlink attack on a temporary file (CVE-2008-4639).

 

Jhead 2.84 and earlier allows local users to delete arbitrary files

via vectors involving a modified input filename (CVE-2008-4640).

 

jhead 2.84 and earlier allows attackers to execute arbitrary commands

via shell metacharacters in unspecified input (CVE-2008-4641).

 

This update provides the latest Jhead to correct these issues.

_______________________________________________________________________

 

References:

 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4575

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4639

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4640

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4641

_______________________________________________________________________

 

Updated Packages:

 

Mandriva Linux 2008.0:

441d3119c29e74427f8c8a2c2589450b 2008.0/i586/jhead-2.86-0.1mdv2008.0.i586.rpm

8275bd4ad7ed0ebca8f3936f291846eb 2008.0/SRPMS/jhead-2.86-0.1mdv2008.0.src.rpm

 

Mandriva Linux 2008.0/X86_64:

371d922e6244a289a1ef0848d0a92076 2008.0/x86_64/jhead-2.86-0.1mdv2008.0.x86_64.rpm

8275bd4ad7ed0ebca8f3936f291846eb 2008.0/SRPMS/jhead-2.86-0.1mdv2008.0.src.rpm

 

Mandriva Linux 2008.1:

2c8593b1c6ee841645f8052d2262a694 2008.1/i586/jhead-2.86-0.1mdv2008.1.i586.rpm

72ef0127cabb83a5bea9a293002f5e59 2008.1/SRPMS/jhead-2.86-0.1mdv2008.1.src.rpm

 

Mandriva Linux 2008.1/X86_64:

a62b13bfcfb21d59f3686ae93e9dcae8 2008.1/x86_64/jhead-2.86-0.1mdv2008.1.x86_64.rpm

72ef0127cabb83a5bea9a293002f5e59 2008.1/SRPMS/jhead-2.86-0.1mdv2008.1.src.rpm

 

Mandriva Linux 2009.0:

c08f58d5cce3c286cc40f94039e9daf1 2009.0/i586/jhead-2.86-0.1mdv2009.0.i586.rpm

da9d3f99a662ac543c837098e0648b46 2009.0/SRPMS/jhead-2.86-0.1mdv2009.0.src.rpm

 

Mandriva Linux 2009.0/X86_64:

c070d4670f4a0059c04cb8863cb4dfb4 2009.0/x86_64/jhead-2.86-0.1mdv2009.0.x86_64.rpm

da9d3f99a662ac543c837098e0648b46 2009.0/SRPMS/jhead-2.86-0.1mdv2009.0.src.rpm

_______________________________________________________________________

 

To upgrade automatically use MandrivaUpdate or urpmi. The verification

of md5 checksums and GPG signatures is performed automatically for you.

 

All packages are signed by Mandriva for security. You can obtain the

GPG public key of the Mandriva Security Team by executing:

 

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 

You can view other update advisories for Mandriva Linux at:

 

http://www.mandriva.com/security/advisories

 

If you want to report vulnerabilities, please contact

 

security_(at)_mandriva.com

_______________________________________________________________________

 

Type Bits/KeyID Date User ID

pub 1024D/22458A98 2000-07-10 Mandriva Security Team

 

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (GNU/Linux)

 

iD8DBQFJmtQBmqjQ0CJFipgRAideAJ9j4MRAHhsfB53neolPluMEpqjQvQCdE7nv

uJ7pvbSTAj4qYoG6h6nbeno=

=0qi7

-----END PGP SIGNATURE-----

 

 

------------=_1234900662-6173-897

Content-Type: text/plain; name="message-footer.txt"

Content-Disposition: inline; filename="message-footer.txt"

Content-Transfer-Encoding: 8bit

 

To unsubscribe, send a email to sympa ( -at -) mandrivalinux.org

with this subject : unsubscribe security-announce

_______________________________________________________

Want to buy your Pack or Services from Mandriva?

Go to http://www.mandrivastore.com

Join the Club : http://www.mandrivaclub.com

_______________________________________________________

 

------------=_1234900662-6173-897--

 

 

Share this post


Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  

×