news 28 Posted December 10, 2009 This is a multi-part message in MIME format... ------------=_1260467850-24326-1912 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:330 http://www.mandriva.com/security/ _______________________________________________________________________ Package : kdelibs Date : December 10, 2009 Affected: Corporate 4.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in kdelibs: The gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc in FreeBSD 6.4 and 7.2, NetBSD 5.0, and OpenBSD 4.5 allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large precision value in the format argument to a printf function, related to an array overrun. (CVE-2009-0689) The JavaScript garbage collector in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle allocation failures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document that triggers write access to an offset of a NULL pointer. (CVE-2009-1687) Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome 1.0.154.53, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by setting an unspecified property of an HTML tag that causes child elements to be freed and later accessed when an HTML error occurs, related to recursion in certain DOM event handlers. (CVE-2009-1690) WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. (CVE-2009-1698) WebKit in Apple Safari before 4.0.2, KHTML in kdelibs in KDE, QtWebKit (aka Qt toolkit), and possibly other products does not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. (CVE-2009-1725) KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692. (CVE-2009-2537) KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' (NUL) character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2009-2702). This update provides a solution to this vulnerability. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0689 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1687 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1690 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1698 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1725 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2537 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2702 _______________________________________________________________________ Updated Packages: Corporate 4.0: 7acdc4e3447233f977879643f035173b corporate/4.0/i586/kdelibs-arts-3.5.4-2.8.20060mlcs4.i586.rpm b432726fe9b46784471bba54fae66ecd corporate/4.0/i586/kdelibs-common-3.5.4-2.8.20060mlcs4.i586.rpm ddc6d1124349b4ac205207e8f23b3d86 corporate/4.0/i586/kdelibs-devel-doc-3.5.4-2.8.20060mlcs4.i586.rpm bbae38ae62265ea3424a8bf10a41faba corporate/4.0/i586/libkdecore4-3.5.4-2.8.20060mlcs4.i586.rpm 91170999ff9c01df165df971096cb37b corporate/4.0/i586/libkdecore4-devel-3.5.4-2.8.20060mlcs4.i586.rpm 93438dd5d56f45d3dd0bc074c0b3c027 corporate/4.0/SRPMS/kdelibs-3.5.4-2.8.20060mlcs4.src.rpm Corporate 4.0/X86_64: 6584b4a42d1a73449a4276eda26e9c89 corporate/4.0/x86_64/kdelibs-arts-3.5.4-2.8.20060mlcs4.x86_64.rpm 7c18a49d5c04bb38011bb9cee87a8525 corporate/4.0/x86_64/kdelibs-common-3.5.4-2.8.20060mlcs4.x86_64.rpm 71c57f6104be3f3d1cac58cf2daa2644 corporate/4.0/x86_64/kdelibs-devel-doc-3.5.4-2.8.20060mlcs4.x86_64.rpm 7761d809e89ea3fcf7f1f26c82a1063f corporate/4.0/x86_64/lib64kdecore4-3.5.4-2.8.20060mlcs4.x86_64.rpm 4205e00c9ac3f410f8193977c59af713 corporate/4.0/x86_64/lib64kdecore4-devel-3.5.4-2.8.20060mlcs4.x86_64.rpm 93438dd5d56f45d3dd0bc074c0b3c027 corporate/4.0/SRPMS/kdelibs-3.5.4-2.8.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLIQsymqjQ0CJFipgRAjn5AJ9mAk/YcPezbNcyinOC61F2Dv8QWwCdFbxe D5rcnKVnEkFg+vMjbSD0npI= =nEBf -----END PGP SIGNATURE----- ------------=_1260467850-24326-1912 Content-Type: text/plain; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit To unsubscribe, send a email to sympa ( -at -) mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________ ------------=_1260467850-24326-1912-- Share this post Link to post
