Date: 21 Oct 2004 20:47:02 -0000
From: Mandrake Linux Security Team <[email protected]>
To: [email protected]Subject: MDKSA-2004:110 - Updated gaim packages fix vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandrakelinux Security Update Advisory
_______________________________________________________________________
Package name: gaim
Advisory ID: MDKSA-2004:110
Date: October 21st, 2004
Affected versions: 10.0
______________________________________________________________________
Problem Description:
More vulnerabilities have been discovered in the gaim instant
messenger client. The vulnerabilities pertinent to version 0.75,
which is the version shipped with Mandrakelinux 10.0, are: installing
smiley themes could allow remote attackers to execute arbitrary
commands via shell metacharacters in the filename of the tar file that
is dragged to the smiley selector. There is also a buffer overflow in
the way gaim handles receiving very long URLs.
The provided packages have been patched to fix these problems. These
issues, amongst others, have been fixed upstream in version 0.82.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0784http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0785
______________________________________________________________________
Updated Packages:
Mandrakelinux 10.0:
fb5e0402f4debc556bbd9415d96f9638 10.0/RPMS/gaim-0.75-5.3.100mdk.i586.rpm
9b398cc925dabbf3cdc5f2dd412d09cb 10.0/RPMS/gaim-encrypt-0.75-5.3.100mdk.i586.rpm
d27addd1e3d0392f1076cb26ff274af3 10.0/RPMS/gaim-festival-0.75-5.3.100mdk.i586.rpm
2076ce789cfd20e8a09963d7966846d6 10.0/RPMS/gaim-perl-0.75-5.3.100mdk.i586.rpm
e9bb68490f6e66f8f53602c646bfe6e8 10.0/RPMS/libgaim-remote0-0.75-5.3.100mdk.i586.rpm
1fc1fb4b90b3772b315b84c35c9a91c1 10.0/RPMS/libgaim-remote0-devel-0.75-5.3.100mdk.i586.rpm
949b9d4232202401c724cb01fc220e1e 10.0/SRPMS/gaim-0.75-5.3.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
63f64fdf9a464f06a6626b27ca7a523c amd64/10.0/RPMS/gaim-0.75-5.3.100mdk.amd64.rpm
163af8675953560f0ffc38650971fd54 amd64/10.0/RPMS/gaim-encrypt-0.75-5.3.100mdk.amd64.rpm
8361be40fdbb0ed37be46fdf99885554 amd64/10.0/RPMS/gaim-festival-0.75-5.3.100mdk.amd64.rpm
7e618514ba49b043dce5e295240f7ef9 amd64/10.0/RPMS/gaim-perl-0.75-5.3.100mdk.amd64.rpm
2d21ba0e9402576f374a710946e7eae1 amd64/10.0/RPMS/lib64gaim-remote0-0.75-5.3.100mdk.amd64.rpm
4ae450fd3b03c6efd96ea2f62d9ab0d5 amd64/10.0/RPMS/lib64gaim-remote0-devel-0.75-5.3.100mdk.amd64.rpm
949b9d4232202401c724cb01fc220e1e amd64/10.0/SRPMS/gaim-0.75-5.3.100mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFBeCBGmqjQ0CJFipgRAti0AKCv7fBEs0OBtlPKJHcbMnQTKAqSQQCg4iVm
3gOIs6fw5qxQU2MziVHuu+8=
=RzAH
-----END PGP SIGNATURE-----
