Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Bugtraq
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[ MDKSA-2006:157 ] - Updated musicbrainz packages fix buffer overflow vu

from [security] Network Security [Permanent Link]
Subject: [ MDKSA-2006:157 ] - Updated musicbrainz packages fix buffer overflow vulnerabilities
Date: Wed, 30 Aug 2006 16:54:00 -0600 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:157
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : musicbrainz
 Date    : August 30, 2006
 Affected: 2006.0
 _______________________________________________________________________
 
 Problem Description:
 
 Multiple buffer overflows in libmusicbrainz (aka mb_client or
 MusicBrainz Client Library) 2.1.2 and earlier, and SVN 8406 and
 earlier, allow remote attackers to cause a denial of service (crash)
 or execute arbitrary code via (1) a long Location header by the HTTP
 server, which triggers an overflow in the MBHttp::Download function in
 lib/http.cpp; and (2) a long URL in RDF data, as demonstrated by a URL
 in an rdf:resource field in an RDF XML document, which triggers
 overflows in many functions in lib/rdfparse.c.
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4197
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 7f958824f626937333164370204436a4  
2006.0/RPMS/libmusicbrainz4-2.1.1-3.2.20060mdk.i586.rpm
 2e46ed494e52fb2ef47274ffd8f89e9b  
2006.0/RPMS/libmusicbrainz4-devel-2.1.1-3.2.20060mdk.i586.rpm
 ed0c309b2d648ea55cadec0383ede538  
2006.0/SRPMS/musicbrainz-2.1.1-3.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 85270a120b6da2fdfe9e72e09394a479  
x86_64/2006.0/RPMS/lib64musicbrainz4-2.1.1-3.2.20060mdk.x86_64.rpm
 6555da767d22f9f65ee5726f458e001a  
x86_64/2006.0/RPMS/lib64musicbrainz4-devel-2.1.1-3.2.20060mdk.x86_64.rpm
 ed0c309b2d648ea55cadec0383ede538  
x86_64/2006.0/SRPMS/musicbrainz-2.1.1-3.2.20060mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFE9et5mqjQ0CJFipgRAh3XAKChOvajLTbHLyl0cFImOiCTnjADPwCg0igS
uy9EYU4HhQ59q7iI27036A8=
=QGeJ
-----END PGP SIGNATURE-----
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [ MDKSA-2006:157 ] - Updated musicbrainz packages fix buffer overflow vulnerabilities, security <=
Previous by Date:  [KAPDA]MyBB 1.1.7~ htmlspeacialchar_uni(), fixjavascript(), functions_post.php ~[url]XSS attack, addmimistrator
Next by Date:  Re: JetBox cms (search_function.php) Remote File Include, Steven M. Christey
Previous by Thread:  [KAPDA]MyBB 1.1.7~ htmlspeacialchar_uni(), fixjavascript(), functions_post.php ~[url]XSS attack, addmimistrator
Next by Thread:  [ECHO_ADV_46$2006] ExBB v1.9.1 (exbb[home_path]) Multiple Remote File Inclusion, erdc
Indexes:  [Date] [Thread] [Top] [All Lists]