To: bugtraq@securityfocus.com
Subject: [ MDKSA-2006:085 ] - Updated xine-ui packages fix format string vulnerabilities
Date: Wed, 10 May 2006 15:18:01 -0600
From: security@mandriva.com
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1Fdw4H-0000bP-2b@mercury.mandriva.com.>
Sender: QATeam User <qateam@mercury.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:085
http://www.mandriva.com/security/
_______________________________________________________________________
Package : xine-ui
Date : May 10, 2006
Affected: 2006.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine allow
remote attackers to execute arbitrary code via format string specifiers in
a long filename on an EXTINFO line in a playlist file.
Packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1905
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
650fe424e812f24ca55fbae9ac58f191 2006.0/RPMS/xine-ui-0.99.4-1.1.20060mdk.i586.rpm
93642d5dcbf76bdb55f6a1b79a82a740 2006.0/RPMS/xine-ui-aa-0.99.4-1.1.20060mdk.i586.rpm
233e02e5d13ea968b7497a67df0094a9 2006.0/RPMS/xine-ui-fb-0.99.4-1.1.20060mdk.i586.rpm
f4b89ad1d813c792c5700861b360066f 2006.0/SRPMS/xine-ui-0.99.4-1.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
71e490c1d0941c5c93601968165af681 x86_64/2006.0/RPMS/xine-ui-0.99.4-1.1.20060mdk.x86_64.rpm
263a49cfbf4be6832af2f583b0e30ea8 x86_64/2006.0/RPMS/xine-ui-aa-0.99.4-1.1.20060mdk.x86_64.rpm
2f6a5637fd940883b8381491dc1fa403 x86_64/2006.0/RPMS/xine-ui-fb-0.99.4-1.1.20060mdk.x86_64.rpm
f4b89ad1d813c792c5700861b360066f x86_64/2006.0/SRPMS/xine-ui-0.99.4-1.1.20060mdk.src.rpm
Corporate 3.0:
19461fcb7b20d100d804d59a156d47e9 corporate/3.0/RPMS/xine-ui-0.9.23-3.3.C30mdk.i586.rpm
e72a7090b1027ffd1d051785ba638d2b corporate/3.0/RPMS/xine-ui-aa-0.9.23-3.3.C30mdk.i586.rpm
9f735f80528fbe7645819b8c7ee1392e corporate/3.0/RPMS/xine-ui-fb-0.9.23-3.3.C30mdk.i586.rpm
70b43223c2a42e044cc92e6721b9c074 corporate/3.0/SRPMS/xine-ui-0.9.23-3.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
40d8285c71ff0b1c6649576ba98bb1d3 x86_64/corporate/3.0/RPMS/xine-ui-0.9.23-3.3.C30mdk.x86_64.rpm
a8ed9fe1599138cfa39dc8a748bbcb3d x86_64/corporate/3.0/RPMS/xine-ui-aa-0.9.23-3.3.C30mdk.x86_64.rpm
53a46955f3dff408ff65995043ec30da x86_64/corporate/3.0/RPMS/xine-ui-fb-0.9.23-3.3.C30mdk.x86_64.rpm
70b43223c2a42e044cc92e6721b9c074 x86_64/corporate/3.0/SRPMS/xine-ui-0.9.23-3.3.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFEYiyXmqjQ0CJFipgRApTHAKDtzmh1uicPEuGbvPLc5Gr6wM+hJgCg22Zd
VHvcUKcFBGTsmikARwjTa2c=
=i4ob
-----END PGP SIGNATURE-----
