To: bugtraq@securityfocus.com
Subject: [ MDKSA-2006:183 ] - Updated libksba packages correct DoS vulnerability
Date: Tue, 17 Oct 2006 15:43:00 -0600
From: security@mandriva.com
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1GZwiC-0006xQ-Lp@mercury.mandriva.com.>
Sender: QATeam User <qateam@mercury.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:183
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libksba
Date : October 17, 2006
Affected: 2006.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
The libksba library, as used by gpgsm in the gnupg2 package, allows
attackers to cause a denial of service (application crash) via a
malformed X.509 certificate in a signature.
libksba-0.9.15 in Mandriva 2007.0 is not affected by this issue.
Updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5111
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
8f3e8e56ed3cc75930ac17526e565e12 2006.0/i586/libksba8-0.9.11-2.1.20060mdk.i586.rpm
c3e82905d3281c6c32bf3689ad606866 2006.0/i586/libksba8-devel-0.9.11-2.1.20060mdk.i586.rpm
2e4266dd10459a85e466e0158d980b31 2006.0/SRPMS/libksba-0.9.11-2.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
34895ba2aef7cedd7463720a333e125c 2006.0/x86_64/lib64ksba8-0.9.11-2.1.20060mdk.x86_64.rpm
014585f62f3074d3bd6646eac7076d39 2006.0/x86_64/lib64ksba8-devel-0.9.11-2.1.20060mdk.x86_64.rpm
2e4266dd10459a85e466e0158d980b31 2006.0/SRPMS/libksba-0.9.11-2.1.20060mdk.src.rpm
Corporate 4.0:
cddf7be9c4bbf73b688cc0c95a6b77ce corporate/4.0/i586/libksba8-0.9.11-2.1.20060mlcs4.i586.rpm
d6252717330d573c24dea70899365e4d corporate/4.0/i586/libksba8-devel-0.9.11-2.1.20060mlcs4.i586.rpm
e8c7164eac4cc325120847f858944f2d corporate/4.0/SRPMS/libksba-0.9.11-2.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
6e447266e8b71fa94dfc271613f1df43 corporate/4.0/x86_64/lib64ksba8-0.9.11-2.1.20060mlcs4.x86_64.rpm
6eab52fe9640a888f358ffa3e978cbea corporate/4.0/x86_64/lib64ksba8-devel-0.9.11-2.1.20060mlcs4.x86_64.rpm
e8c7164eac4cc325120847f858944f2d corporate/4.0/SRPMS/libksba-0.9.11-2.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFFNSQymqjQ0CJFipgRAhtHAJ9gOCcITRQAbJAMg8q5BRHInzJ+mgCgo+Ut
tAH7mnhzdPxq3B0CZwX+HNE=
=1mA6
-----END PGP SIGNATURE-----
