Login


 
Newsletter
Werbung
Sicherheit: Ausführen beliebiger Kommandos in Raptor
Aktuelle Meldungen Distributionen
Name: Ausführen beliebiger Kommandos in Raptor
ID: MDVSA-2012:061
Distribution: Mandriva
Plattformen: Mandriva Enterprise Server 5.0, Mandriva 2010.1, Mandriva 2011
Datum: Sa, 21. April 2012, 19:14
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0037

Originalnachricht

This is a multi-part message in MIME format...

------------=_1335019513-3281-52

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2012:061
http://www.mandriva.com/security/
_______________________________________________________________________

Package : raptor
Date : April 21, 2012
Affected: 2010.1, 2011., Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

An XML External Entity expansion flaw was found in the way Raptor
processed RDF files. If an application linked against Raptor were to
open a specially-crafted RDF file, it could possibly allow a remote
attacker to obtain a copy of an arbitrary local file that the user
running the application had access to. A bug in the way Raptor handled
external entities could cause that application to crash or, possibly,
execute arbitrary code with the privileges of the user running the
application (CVE-2012-0037).

The updated packages have been patched to correct this issue.

raptor2 for Mandriva Linux 2011 has been upgraded to the 2.0.7 version
which is not vulnerable to this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0037
http://www.libreoffice.org/advisories/CVE-2012-0037/
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.1:
24ec3d87dd77462b556f86859840eae1
2010.1/i586/libraptor1-1.4.21-5.1mdv2010.2.i586.rpm
85d61e2cd9d054d9da9211f4fa342f69
2010.1/i586/libraptor-devel-1.4.21-5.1mdv2010.2.i586.rpm
e8b11b034af2de18b785e82cb4a30660
2010.1/i586/raptor-1.4.21-5.1mdv2010.2.i586.rpm
4379f2bfca9cfc03d297058d9635156a
2010.1/SRPMS/raptor-1.4.21-5.1mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
44aa890dd881c56e92f2b3983f4bc686
2010.1/x86_64/lib64raptor1-1.4.21-5.1mdv2010.2.x86_64.rpm
068c7d529fb465a3238f51179651ba2f
2010.1/x86_64/lib64raptor-devel-1.4.21-5.1mdv2010.2.x86_64.rpm
76bf6ce10c21fcc1c5f27e39d08b260d
2010.1/x86_64/raptor-1.4.21-5.1mdv2010.2.x86_64.rpm
4379f2bfca9cfc03d297058d9635156a
2010.1/SRPMS/raptor-1.4.21-5.1mdv2010.2.src.rpm

Mandriva Linux 2011:
e94c657f023e62cd238ea2f83ae0d88a
2011/i586/libraptor1-1.4.21-5.1-mdv2011.0.i586.rpm
79e92a9a81648805e7ae4cb28eb888f2
2011/i586/libraptor2_0-2.0.7-0.1-mdv2011.0.i586.rpm
11eef49d485d71baf0a11b66b48db345
2011/i586/libraptor2-devel-2.0.7-0.1-mdv2011.0.i586.rpm
ae76f3b8f48824daa66675f4fc007235
2011/i586/libraptor-devel-1.4.21-5.1-mdv2011.0.i586.rpm
9a42145d50101d1b3f8348808638240a
2011/i586/raptor-1.4.21-5.1-mdv2011.0.i586.rpm
6c528626b8a2602fdcb1761eac68e25e
2011/i586/raptor2-2.0.7-0.1-mdv2011.0.i586.rpm
7adcdbaed9ca771c734765e9ed92e8c4 2011/SRPMS/raptor-1.4.21-5.1.src.rpm
404f1edc446a93566026bbee0fbc8210 2011/SRPMS/raptor2-2.0.7-0.1.src.rpm

Mandriva Linux 2011/X86_64:
c4c7ac5bf156c0d3f9bb1fd5740f347f
2011/x86_64/lib64raptor1-1.4.21-5.1-mdv2011.0.x86_64.rpm
83b05b1707a083e7cf76c67d5f646320
2011/x86_64/lib64raptor2_0-2.0.7-0.1-mdv2011.0.x86_64.rpm
f6c697b5e8ee115eb4e318a886105c35
2011/x86_64/lib64raptor2-devel-2.0.7-0.1-mdv2011.0.x86_64.rpm
aba11394c42aed7d4f99200900723837
2011/x86_64/lib64raptor-devel-1.4.21-5.1-mdv2011.0.x86_64.rpm
f557b8057cb4b8aa371f48626d8e2c11
2011/x86_64/raptor-1.4.21-5.1-mdv2011.0.x86_64.rpm
f7b4e5e149fb3d338c85eef948e16b27
2011/x86_64/raptor2-2.0.7-0.1-mdv2011.0.x86_64.rpm
7adcdbaed9ca771c734765e9ed92e8c4 2011/SRPMS/raptor-1.4.21-5.1.src.rpm
404f1edc446a93566026bbee0fbc8210 2011/SRPMS/raptor2-2.0.7-0.1.src.rpm

Mandriva Enterprise Server 5:
5d0221fba67389461f2808a8c1cf93fd
mes5/i586/libraptor1-1.4.18-3.1mdvmes5.2.i586.rpm
777bcd9d7035fcec459c2b0848ccb660
mes5/i586/libraptor-devel-1.4.18-3.1mdvmes5.2.i586.rpm
56c867304527d1b6ba5980b7d5c6e354
mes5/i586/raptor-1.4.18-3.1mdvmes5.2.i586.rpm
5d90acb0be0fd63e90a5dec62a19dfdc
mes5/SRPMS/raptor-1.4.18-3.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
4680f20036dc383367955faab0ffb028
mes5/x86_64/lib64raptor1-1.4.18-3.1mdvmes5.2.x86_64.rpm
f40ea3da4964474fcf1acab58511d59b
mes5/x86_64/lib64raptor-devel-1.4.18-3.1mdvmes5.2.x86_64.rpm
593bb4d51e183ea45d416ff90ff4cb07
mes5/x86_64/raptor-1.4.18-3.1mdvmes5.2.x86_64.rpm
5d90acb0be0fd63e90a5dec62a19dfdc
mes5/SRPMS/raptor-1.4.18-3.1mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFPkp0nmqjQ0CJFipgRAvUfAKCOqVsQF5ZKvywfrhq83Sa0vBo7TwCfTD7R
M+UaIWCajC9axOQi1nshPRA=
=Sy3/
-----END PGP SIGNATURE-----


------------=_1335019513-3281-52
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1335019513-3281-52--
Pro-Linux
Frohe Weihnachten Fest!
Neue Nachrichten
Werbung