To: [email protected]Subject: [ MDKSA-2005:048 ] - Updated mplayer packages fix integer overflow vulnerabilities
Date: Fri, 24 Feb 2006 17:10:00 -0700
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1FCn0b-0007Ed-0A@mercury.mandriva.com.>
Sender: QATeam User <qateam@mercury.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:048
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mplayer
Date : February 24, 2005
Affected: 2006.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Multiple integer overflows in (1) the new_demux_packet function in
demuxer.h and (2) the demux_asf_read_packet function in demux_asf.c in
MPlayer 1.0pre7try2 and earlier allow remote attackers to execute
arbitrary code via an ASF file with a large packet length value.
The updated packages have been patched to prevent this problem.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0579
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
6a9787d26d2b82697525ea3ce1a42528 2006.0/RPMS/libdha1.0-1.0-1.pre7.12.2.20060mdk.i586.rpm
2cee96ab48d748bd5c218c6b72762a69 2006.0/RPMS/libpostproc0-1.0-1.pre7.12.2.20060mdk.i586.rpm
7d85bd28f30c98b00002c4da1fb27935 2006.0/RPMS/libpostproc0-devel-1.0-1.pre7.12.2.20060mdk.i586.rpm
eeaae4efea7c733946468504c0847c6e 2006.0/RPMS/mencoder-1.0-1.pre7.12.2.20060mdk.i586.rpm
a3e1114604c50095b4a00e3e2546fad4 2006.0/RPMS/mplayer-1.0-1.pre7.12.2.20060mdk.i586.rpm
7c1d40d98a7c63b84836f17742424572 2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.2.20060mdk.i586.rpm
0ae9253d37d09e4e015c0dbea3e3238b 2006.0/SRPMS/mplayer-1.0-1.pre7.12.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
083cd368b22c862c3ad4e3c6809373ba x86_64/2006.0/RPMS/lib64postproc0-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
f6764f327bc34aea319211a1ba848d46 x86_64/2006.0/RPMS/lib64postproc0-devel-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
7cd2b81fe303956e07ead2be2ce40d01 x86_64/2006.0/RPMS/mencoder-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
9962424187f6d7f99f91d65b22e62eea x86_64/2006.0/RPMS/mplayer-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
fc4d22d72852405516379f36249626ae x86_64/2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.2.20060mdk.x86_64.rpm
0ae9253d37d09e4e015c0dbea3e3238b x86_64/2006.0/SRPMS/mplayer-1.0-1.pre7.12.2.20060mdk.src.rpm
Corporate 3.0:
79227923f532fd0d481b6a8999a48fb6 corporate/3.0/RPMS/libdha0.1-1.0-0.pre3.14.6.C30mdk.i586.rpm
8239e565804440e9b5f33dab590825c4 corporate/3.0/RPMS/libpostproc0-1.0-0.pre3.14.6.C30mdk.i586.rpm
b92ecaf616a975c840fd2d8d1640141b corporate/3.0/RPMS/libpostproc0-devel-1.0-0.pre3.14.6.C30mdk.i586.rpm
1a5c6dba5378d086e76ec1c05f5fe416 corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.6.C30mdk.i586.rpm
5d264152c0c2934f45c14576e3094a9d corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.6.C30mdk.i586.rpm
74c1e627dd747a52181e49502fa404b6 corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.6.C30mdk.i586.rpm
7ea541987b4b2285112e6c822704b797 corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.6.C30mdk.src.rpm
Corporate 3.0/X86_64:
49ab3887057e1a407e85b09cea56d977 x86_64/corporate/3.0/RPMS/lib64postproc0-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
3e8fdbfc03ba3bdbba4a31c52b8a6770 x86_64/corporate/3.0/RPMS/lib64postproc0-devel-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
8d45d891ed90b1576acbc512f035f9bf x86_64/corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
2236312827cad9d6490340a9e7c66f6d x86_64/corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
803888f3129e969e1351ce6ce8a88d59 x86_64/corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.6.C30mdk.x86_64.rpm
7ea541987b4b2285112e6c822704b797 x86_64/corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.6.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFD/3SJmqjQ0CJFipgRAppdAJwMKNiyvLVH+QXkX5IOMRvGzhA8iACfawcl
4MpPnK4igEjRxRY2ODPNZdg=
=LcLq
-----END PGP SIGNATURE-----
