To: bugtraq@securityfocus.com
Subject: [ MDKSA-2007:029 ] - Updated libsoup packages fix DoS vulnerability
Date: Fri, 26 Jan 2007 18:32:23 -0700
From: security@mandriva.com
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1HAcQZ-0000Ht-4R@artemis.annvix.ca.>
Sender: QA Team <qateam@artemis.annvix.ca.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:029
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libsoup
Date : January 26, 2007
Affected: 2006.0, 2007.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
The soup_headers_parse function in soup-headers.c for libsoup HTTP
library before 2.2.99 allows remote attackers to cause a denial of
service (crash) via malformed HTTP headers, probably involving missing
fields or values.
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5876
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
4f2b5a0d73c7a7a8d44c993a7d5aa0c2 2006.0/i586/libsoup-2.2_7-2.2.3-2.1.20060mdk.i586.rpm
b908d651b283f7aad2914cc45621779d 2006.0/i586/libsoup-2.2_7-devel-2.2.3-2.1.20060mdk.i586.rpm
fa63dfce230031c179c38c2d4dfef3c0 2006.0/SRPMS/libsoup-2.2.3-2.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
f0fc3b38d4da6d0f852df61a58fa14e9 2006.0/x86_64/lib64soup-2.2_7-2.2.3-2.1.20060mdk.x86_64.rpm
e37aa16dcb0904d3d2bb6c16c192ce31 2006.0/x86_64/lib64soup-2.2_7-devel-2.2.3-2.1.20060mdk.x86_64.rpm
fa63dfce230031c179c38c2d4dfef3c0 2006.0/SRPMS/libsoup-2.2.3-2.1.20060mdk.src.rpm
Mandriva Linux 2007.0:
361254f9fc671c76de0c5b932ef59fbf 2007.0/i586/libsoup-2.2_8-2.2.96-1.1mdv2007.0.i586.rpm
31b044996c030de2563d4cd73c9f53c3 2007.0/i586/libsoup-2.2_8-devel-2.2.96-1.1mdv2007.0.i586.rpm
78e22b0c5511c6bcd1db2618ad824603 2007.0/SRPMS/libsoup-2.2.96-1.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
fc917532647266dc40b4ea5c9c0032c4 2007.0/x86_64/lib64soup-2.2_8-2.2.96-1.1mdv2007.0.x86_64.rpm
e169e51e44a32987e02f78d9b3773011 2007.0/x86_64/lib64soup-2.2_8-devel-2.2.96-1.1mdv2007.0.x86_64.rpm
78e22b0c5511c6bcd1db2618ad824603 2007.0/SRPMS/libsoup-2.2.96-1.1mdv2007.0.src.rpm
Corporate 3.0:
60c23eb5f8875a2438dc8e8c7a5a51c3 corporate/3.0/i586/libsoup-1.99.28-1.1.C30mdk.i586.rpm
7107ef4818fbddbe892043bf273c8286 corporate/3.0/i586/libsoup-2.0_0-1.99.28-1.1.C30mdk.i586.rpm
fd8a36bef1ac3e441f1636d5fb2a29e0 corporate/3.0/i586/libsoup-2.0_0-devel-1.99.28-1.1.C30mdk.i586.rpm
90e23de46abc7f6ddddb9d3d489f4d52 corporate/3.0/SRPMS/libsoup-1.99.28-1.1.C30mdk.src.rpm
Corporate 3.0/X86_64:
8ef5d3702721442e8eafd7ff3be5a5f2 corporate/3.0/x86_64/lib64soup-2.0_0-1.99.28-1.1.C30mdk.x86_64.rpm
a39fcf606ebf0c1b5a96283de9f4441f corporate/3.0/x86_64/lib64soup-2.0_0-devel-1.99.28-1.1.C30mdk.x86_64.rpm
ec4dc1c6a94e2954a350d0fc25d10d89 corporate/3.0/x86_64/libsoup-1.99.28-1.1.C30mdk.x86_64.rpm
90e23de46abc7f6ddddb9d3d489f4d52 corporate/3.0/SRPMS/libsoup-1.99.28-1.1.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFun/YmqjQ0CJFipgRAhhvAKC+7Ty2XJRtW0IxWcAob0ciHOuggACgp9/m
JarCwTg2Tzw/ahiTuXJhOSQ=
=CR5V
-----END PGP SIGNATURE-----
