To: [email protected]Subject: [ MDKSA-2006:164-1 ] - Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities
Date: Fri, 17 Nov 2006 19:42:00 -0700
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1GlG9Y-0005oX-Pp@mercury.mandriva.com.>
Sender: QATeam User <qateam@mercury.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:164-1
http://www.mandriva.com/security/
_______________________________________________________________________
Package : xorg-x11
Date : November 17, 2006
Affected: 2007.0
_______________________________________________________________________
Problem Description:
Local exploitation of an integer overflow vulnerability in the
'CIDAFM()' function in the X.Org and XFree86 X server could allow an
attacker to execute arbitrary code with privileges of the X server,
typically root (CVE-2006-3739).
Local exploitation of an integer overflow vulnerability in the
'scan_cidfont()' function in the X.Org and XFree86 X server could allow
an attacker to execute arbitrary code with privileges of the X server,
typically root (CVE-2006-3740).
Updated packages are patched to address this issue.
Update:
Updated packages for 2007.0 have been patched (libxfont)
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3739http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3740
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
450b96572ecc3cc1a58d596fc578a703 2007.0/i586/libxfont1-1.1.0-4.1mdv2007.0.i586.rpm
14062b73ca8dc6a1c8d1b7a4f047b1f4 2007.0/i586/libxfont1-devel-1.1.0-4.1mdv2007.0.i586.rpm
9d594cbb4ce10aa517d1bce91515854b 2007.0/i586/libxfont1-static-devel-1.1.0-4.1mdv2007.0.i586.rpm
be0b07f353c66939d676c139b29d686d 2007.0/SRPMS/libxfont-1.1.0-4.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
236b0e53bb7c9cfa09e50030bb812c1f 2007.0/x86_64/lib64xfont1-1.1.0-4.1mdv2007.0.x86_64.rpm
6ba1392948b5aa507675bb27a4783ff2 2007.0/x86_64/lib64xfont1-devel-1.1.0-4.1mdv2007.0.x86_64.rpm
d484c9490f06a16f71faf6fa2f5e1f21 2007.0/x86_64/lib64xfont1-static-devel-1.1.0-4.1mdv2007.0.x86_64.rpm
3af8ee0086a093daef39ec7be078f6e8 2007.0/x86_64/libxfont-debug-1.1.0-4.1mdv2007.0.x86_64.rpm
be0b07f353c66939d676c139b29d686d 2007.0/SRPMS/libxfont-1.1.0-4.1mdv2007.0.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFFXkibmqjQ0CJFipgRAlx3AKC7nBaY0a81+sPRYDGFKbBaF/Yp8QCg73Kn
gTs37DtNqvCcIEsH0dBorOg=
=ZNDW
-----END PGP SIGNATURE-----
