[Security Announce] [ MDVSA-2009:043 ] gnumeric

[news 28]

This is a multi-part message in MIME format...

 

------------=_1235084588-6173-1037

 

 

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

_______________________________________________________________________

 

Mandriva Linux Security Advisory MDVSA-2009:043

http://www.mandriva.com/security/

_______________________________________________________________________

 

Package : gnumeric

Date : February 19, 2009

Affected: 2008.1, 2009.0, Corporate 3.0

_______________________________________________________________________

 

Problem Description:

 

Python has a variable called sys.path that contains all paths where

Python loads modules by using import scripting procedure. A wrong

handling of that variable enables local attackers to execute arbitrary

code via Python scripting in the current Gnumeric working directory

(CVE-2009-0318).

 

This update provides fix for that vulnerability.

_______________________________________________________________________

 

References:

 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0318

_______________________________________________________________________

 

Updated Packages:

 

Mandriva Linux 2008.1:

cde73c669bf39b0ec2519b1a96994a9f 2008.1/i586/gnumeric-1.8.2-1.1mdv2008.1.i586.rpm

b85a607477914ba9aed7642fd1dceafc 2008.1/i586/libspreadsheet1.8.2-1.8.2-1.1mdv2008.1.i586.rpm

f3fd0927cca9cf6007cbb2bf71ccfc3d 2008.1/i586/libspreadsheet-devel-1.8.2-1.1mdv2008.1.i586.rpm

9f22fe3b15688a7f690e67e6006c1d42 2008.1/SRPMS/gnumeric-1.8.2-1.1mdv2008.1.src.rpm

 

Mandriva Linux 2008.1/X86_64:

6b4bd81945f4ef6a504677e3ed31b423 2008.1/x86_64/gnumeric-1.8.2-1.1mdv2008.1.x86_64.rpm

f40fcda03171d5fa2336c759d402e072 2008.1/x86_64/lib64spreadsheet1.8.2-1.8.2-1.1mdv2008.1.x86_64.rpm

864955a183c327659a3916ab9a6341f4 2008.1/x86_64/lib64spreadsheet-devel-1.8.2-1.1mdv2008.1.x86_64.rpm

9f22fe3b15688a7f690e67e6006c1d42 2008.1/SRPMS/gnumeric-1.8.2-1.1mdv2008.1.src.rpm

 

Mandriva Linux 2009.0:

90afa0f699d32b88202e45d61ac1bd39 2009.0/i586/gnumeric-1.9.2-1.1mdv2009.0.i586.rpm

2678f7942f2b8cb86d9569c5975027e0 2009.0/i586/libspreadsheet1.9.2-1.9.2-1.1mdv2009.0.i586.rpm

442f1782281f368f180fc45857bb4615 2009.0/i586/libspreadsheet-devel-1.9.2-1.1mdv2009.0.i586.rpm

1f1c8009eca1ab3095545b8f35ae08b3 2009.0/SRPMS/gnumeric-1.9.2-1.1mdv2009.0.src.rpm

 

Mandriva Linux 2009.0/X86_64:

915e3f8229d33522255b9c828e5b6dff 2009.0/x86_64/gnumeric-1.9.2-1.1mdv2009.0.x86_64.rpm

d42b159af4f4c84fefc75d4340e1c439 2009.0/x86_64/lib64spreadsheet1.9.2-1.9.2-1.1mdv2009.0.x86_64.rpm

467e369116f45d5176b30d80b355b8f7 2009.0/x86_64/lib64spreadsheet-devel-1.9.2-1.1mdv2009.0.x86_64.rpm

1f1c8009eca1ab3095545b8f35ae08b3 2009.0/SRPMS/gnumeric-1.9.2-1.1mdv2009.0.src.rpm

 

Corporate 3.0:

78a72609cceb5a3e23d75431c9b0aac6 corporate/3.0/i586/gnumeric-1.2.6-1.2.C30mdk.i586.rpm

0bba80fa78ed2abff7fbf8859d41afbd corporate/3.0/SRPMS/gnumeric-1.2.6-1.2.C30mdk.src.rpm

 

Corporate 3.0/X86_64:

07ae6744a0f076c58f0a554a8a978f70 corporate/3.0/x86_64/gnumeric-1.2.6-1.2.C30mdk.x86_64.rpm

0bba80fa78ed2abff7fbf8859d41afbd corporate/3.0/SRPMS/gnumeric-1.2.6-1.2.C30mdk.src.rpm

_______________________________________________________________________

 

To upgrade automatically use MandrivaUpdate or urpmi. The verification

of md5 checksums and GPG signatures is performed automatically for you.

 

All packages are signed by Mandriva for security. You can obtain the

GPG public key of the Mandriva Security Team by executing:

 

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 

You can view other update advisories for Mandriva Linux at:

 

http://www.mandriva.com/security/advisories

 

If you want to report vulnerabilities, please contact

 

security_(at)_mandriva.com

_______________________________________________________________________

 

Type Bits/KeyID Date User ID

pub 1024D/22458A98 2000-07-10 Mandriva Security Team

 

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (GNU/Linux)

 

iD8DBQFJnbiJmqjQ0CJFipgRAkBHAJ9TwLM1SGmNQoffnR8dn2zgSD2dxQCgrgs0

KCEW+1JLytf2yxIshqzXksc=

=UoOQ

-----END PGP SIGNATURE-----

 

 

------------=_1235084588-6173-1037

Content-Type: text/plain; name="message-footer.txt"

Content-Disposition: inline; filename="message-footer.txt"

Content-Transfer-Encoding: 8bit

 

To unsubscribe, send a email to sympa ( -at -) mandrivalinux.org

with this subject : unsubscribe security-announce

_______________________________________________________

Want to buy your Pack or Services from Mandriva?

Go to http://www.mandrivastore.com

Join the Club : http://www.mandrivaclub.com

_______________________________________________________

 

------------=_1235084588-6173-1037--