Date: Tue, 19 Jun 2007 18:21:33 -0600
From: security@mandriva.com
Subject: [ MDKSA-2007:128 ] - Updated libexif packages fix integer overflow flaw
To: bugtraq@securityfocus.com
Reply-To: xsecurity@mandriva.com
Message-id: <E1I0nwz-0004hr-5J@artemis.annvix.ca.>
X-SA-Exim-Connect-IP: 10.0.5.11
X-SA-Exim-Mail-From: qateam@artemis.annvix.ca
X-SA-Exim-Version: 4.2.1 (built Fri, 02 Feb 2007 19:02:33 -0700)
X-SA-Exim-Scanned: Yes (on hades.annvix.org)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:128
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libexif
Date : June 19, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
Another integer overflow was found in the way libexif parses EXIF
image tags. An individual who opened a carefully-crafted EXIF image
file could cause the application linked against libexif to crash or
possibly execute arbitrary code.
Updated packages have been patched to prevent this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4168
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
aea52b8b415d79199555b138040dc117 2007.0/i586/libexif12-0.6.13-2.2mdv2007.0.i586.rpm
235324d550727d73e80953bf0b70b7fe 2007.0/i586/libexif12-devel-0.6.13-2.2mdv2007.0.i586.rpm
77a2d90649912764b5f23b94fbc09bf9 2007.0/SRPMS/libexif-0.6.13-2.2mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
c6bf402af2d36bc636a4b53682b4279d 2007.0/x86_64/lib64exif12-0.6.13-2.2mdv2007.0.x86_64.rpm
7c16cb8228769253a61fb223e6ac5015 2007.0/x86_64/lib64exif12-devel-0.6.13-2.2mdv2007.0.x86_64.rpm
77a2d90649912764b5f23b94fbc09bf9 2007.0/SRPMS/libexif-0.6.13-2.2mdv2007.0.src.rpm
Mandriva Linux 2007.1:
76ac34860308ac16c0ddc0457684ac39 2007.1/i586/libexif12-0.6.13-4.2mdv2007.1.i586.rpm
4610d01483922b4b8e18a586405257f7 2007.1/i586/libexif12-devel-0.6.13-4.2mdv2007.1.i586.rpm
de1465368f5eca18797b77287bd0e425 2007.1/SRPMS/libexif-0.6.13-4.2mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
1a92e5266b5a92e39f4b9343fc16554a 2007.1/x86_64/lib64exif12-0.6.13-4.2mdv2007.1.x86_64.rpm
d2d151b5163ae6ffe99ccba69d3afcce 2007.1/x86_64/lib64exif12-devel-0.6.13-4.2mdv2007.1.x86_64.rpm
de1465368f5eca18797b77287bd0e425 2007.1/SRPMS/libexif-0.6.13-4.2mdv2007.1.src.rpm
Corporate 3.0:
d35e56a5dbee270b4dac92cd0e23bf10 corporate/3.0/i586/libexif9-0.5.12-3.3.C30mdk.i586.rpm
0b519895a69a6c03134a02c1ec8f1fbd corporate/3.0/i586/libexif9-devel-0.5.12-3.3.C30mdk.i586.rpm
7739d6573e2bf53148532394a6467af7 corporate/3.0/SRPMS/libexif-0.5.12-3.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
9edbd655e6fd38a12f6e7722dbb5d50f corporate/3.0/x86_64/lib64exif9-0.5.12-3.3.C30mdk.x86_64.rpm
d2a879e2b1a030012eb6e49764b8869d corporate/3.0/x86_64/lib64exif9-devel-0.5.12-3.3.C30mdk.x86_64.rpm
d35e56a5dbee270b4dac92cd0e23bf10 corporate/3.0/x86_64/libexif9-0.5.12-3.3.C30mdk.i586.rpm
7739d6573e2bf53148532394a6467af7 corporate/3.0/SRPMS/libexif-0.5.12-3.3.C30mdk.src.rpm
Corporate 4.0:
1aa75c3c68ba6a52c513a3c96238d12e corporate/4.0/i586/libexif12-0.6.12-2.2.20060mlcs4.i586.rpm
cde17b0c57044d132016a3be579bbbae corporate/4.0/i586/libexif12-devel-0.6.12-2.2.20060mlcs4.i586.rpm
1a09002fd17721aca1c29fc4e971c38b corporate/4.0/SRPMS/libexif-0.6.12-2.2.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
41c47eed02c3780cd5394a93f9d793f6 corporate/4.0/x86_64/lib64exif12-0.6.12-2.2.20060mlcs4.x86_64.rpm
78b6c776e2b71d96d6125c32838a6584 corporate/4.0/x86_64/lib64exif12-devel-0.6.12-2.2.20060mlcs4.x86_64.rpm
1aa75c3c68ba6a52c513a3c96238d12e corporate/4.0/x86_64/libexif12-0.6.12-2.2.20060mlcs4.i586.rpm
cde17b0c57044d132016a3be579bbbae corporate/4.0/x86_64/libexif12-devel-0.6.12-2.2.20060mlcs4.i586.rpm
1a09002fd17721aca1c29fc4e971c38b corporate/4.0/SRPMS/libexif-0.6.12-2.2.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFGeEekmqjQ0CJFipgRAmhJAJ9zUqX5PY2gtCcWewFIPsTk4LT7uQCggWmo
70HSRJ9MNadqZ46Ui1UAuk0=
=Fwpz
-----END PGP SIGNATURE-----
