news 28 Posted February 17, 2009 This is a multi-part message in MIME format... ------------=_1234900662-6173-897 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:041 http://www.mandriva.com/security/ _______________________________________________________________________ Package : jhead Date : February 17, 2009 Affected: 2008.0, 2008.1, 2009.0 _______________________________________________________________________ Problem Description: Security vulnerabilies have been identified and fixed in jhead. Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) (CVE-2008-4575). Jhead before 2.84 allows local users to overwrite arbitrary files via a symlink attack on a temporary file (CVE-2008-4639). Jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename (CVE-2008-4640). jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input (CVE-2008-4641). This update provides the latest Jhead to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4575 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4639 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4640 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4641 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: 441d3119c29e74427f8c8a2c2589450b 2008.0/i586/jhead-2.86-0.1mdv2008.0.i586.rpm 8275bd4ad7ed0ebca8f3936f291846eb 2008.0/SRPMS/jhead-2.86-0.1mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 371d922e6244a289a1ef0848d0a92076 2008.0/x86_64/jhead-2.86-0.1mdv2008.0.x86_64.rpm 8275bd4ad7ed0ebca8f3936f291846eb 2008.0/SRPMS/jhead-2.86-0.1mdv2008.0.src.rpm Mandriva Linux 2008.1: 2c8593b1c6ee841645f8052d2262a694 2008.1/i586/jhead-2.86-0.1mdv2008.1.i586.rpm 72ef0127cabb83a5bea9a293002f5e59 2008.1/SRPMS/jhead-2.86-0.1mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: a62b13bfcfb21d59f3686ae93e9dcae8 2008.1/x86_64/jhead-2.86-0.1mdv2008.1.x86_64.rpm 72ef0127cabb83a5bea9a293002f5e59 2008.1/SRPMS/jhead-2.86-0.1mdv2008.1.src.rpm Mandriva Linux 2009.0: c08f58d5cce3c286cc40f94039e9daf1 2009.0/i586/jhead-2.86-0.1mdv2009.0.i586.rpm da9d3f99a662ac543c837098e0648b46 2009.0/SRPMS/jhead-2.86-0.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: c070d4670f4a0059c04cb8863cb4dfb4 2009.0/x86_64/jhead-2.86-0.1mdv2009.0.x86_64.rpm da9d3f99a662ac543c837098e0648b46 2009.0/SRPMS/jhead-2.86-0.1mdv2009.0.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFJmtQBmqjQ0CJFipgRAideAJ9j4MRAHhsfB53neolPluMEpqjQvQCdE7nv uJ7pvbSTAj4qYoG6h6nbeno= =0qi7 -----END PGP SIGNATURE----- ------------=_1234900662-6173-897 Content-Type: text/plain; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit To unsubscribe, send a email to sympa ( -at -) mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________ ------------=_1234900662-6173-897-- Share this post Link to post
