To: [email protected]Subject: [ MDVSA-2009:202 ] memcached
Date: Fri, 14 Aug 2009 20:23:01 +0200
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1Mc1Qb-00013z-LK@titan.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:202
http://www.mandriva.com/security/
_______________________________________________________________________
Package : memcached
Date : August 14, 2009
Affected: 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
A vulnerability has been found and corrected in memcached:
Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote
attackers to execute arbitrary code via vectors involving length
attributes that trigger heap-based buffer overflows (CVE-2009-2415).
This update provides a solution to this vulnerability. Additionally
memcached-1.2.x has been upgraded to 1.2.8 for 2009.0/2009.1 and MES
5 that contains a number of upstream fixes, the repcached patch has
been upgraded to 2.2 as well.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2415
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2009.0:
9d4d42fe76af248132f829d160495adc 2009.0/i586/memcached-1.2.8-0.1mdv2009.0.i586.rpm
d53cac61eb5aa89846b8cd7916c5a758 2009.0/SRPMS/memcached-1.2.8-0.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
ba6a1444fcfcce618ec84cbc6d46f109 2009.0/x86_64/memcached-1.2.8-0.1mdv2009.0.x86_64.rpm
d53cac61eb5aa89846b8cd7916c5a758 2009.0/SRPMS/memcached-1.2.8-0.1mdv2009.0.src.rpm
Mandriva Linux 2009.1:
a996c0c7afdc057fa23a60d9bdc3f5d0 2009.1/i586/memcached-1.2.8-0.1mdv2009.1.i586.rpm
2864ec90f52b817534c36e680ebd924f 2009.1/SRPMS/memcached-1.2.8-0.1mdv2009.1.src.rpm
Mandriva Linux 2009.1/X86_64:
64a9462f4a36f128c1025531985b44a6 2009.1/x86_64/memcached-1.2.8-0.1mdv2009.1.x86_64.rpm
2864ec90f52b817534c36e680ebd924f 2009.1/SRPMS/memcached-1.2.8-0.1mdv2009.1.src.rpm
Corporate 4.0:
630916635aa2bb9d4f34b7b16a5b9636 corporate/4.0/i586/memcached-1.1.12-4.2.20060mlcs4.i586.rpm
079b93b62379d4ba632eba013675ead3 corporate/4.0/SRPMS/memcached-1.1.12-4.2.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
89c891eb8c1543762ec8606fab339ed1 corporate/4.0/x86_64/memcached-1.1.12-4.2.20060mlcs4.x86_64.rpm
079b93b62379d4ba632eba013675ead3 corporate/4.0/SRPMS/memcached-1.1.12-4.2.20060mlcs4.src.rpm
Mandriva Enterprise Server 5:
96b5ff9995f32f06dc16ac4568694926 mes5/i586/memcached-1.2.8-0.1mdvmes5.i586.rpm
4a6050639b2ef47a686c9571bfafbec9 mes5/SRPMS/memcached-1.2.8-0.1mdvmes5.src.rpm
Mandriva Enterprise Server 5/X86_64:
5873483ba54835638044efee0e8d2898 mes5/x86_64/memcached-1.2.8-0.1mdvmes5.x86_64.rpm
4a6050639b2ef47a686c9571bfafbec9 mes5/SRPMS/memcached-1.2.8-0.1mdvmes5.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFKhX8ImqjQ0CJFipgRAoDGAJ4vt5jtckDM1+BLAwvk1RDNc4RlMwCfVcf+
f96rWeMUdAJnRxsj5d9lAn4=
=PKA2
-----END PGP SIGNATURE-----
