Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in libtasn1
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in libtasn1
ID: MDVSA-2015:116
Distribution: Mandriva
Plattformen: Mandriva Business Server 2.0
Datum: So, 29. März 2015, 14:06
Referenzen: http://advisories.mageia.org/MGASA-2014-0247.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469
Applikationen: GNU Libtasn1

Originalnachricht

This is a multi-part message in MIME format...

------------=_1427621610-10360-16

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:116
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : libtasn1
Date : March 29, 2015
Affected: Business Server 2.0
_______________________________________________________________________

Problem Description:

Updated libtasn1 packages fix security vulnerabilities:

Multiple buffer boundary check issues were discovered in libtasn1
library, causing it to read beyond the boundary of an allocated buffer.
An untrusted ASN.1 input could cause an application using the library
to crash (CVE-2014-3467).

It was discovered that libtasn1 library function asn1_get_bit_der()
could incorrectly report negative bit length of the value read from
ASN.1 input. This could possibly lead to an out of bounds access in
an application using libtasn1, for example in case if application
tried to terminate read value with NUL byte (CVE-2014-3468).

A NULL pointer dereference flaw was found in libtasn1's
asn1_read_value_type() / asn1_read_value() function. If an application
called the function with a NULL value for an ivalue argument to
determine the amount of memory needed to store data to be read from
the ASN.1 input, libtasn1 could incorrectly attempt to dereference
the NULL pointer, causing an application using the library to crash
(CVE-2014-3469).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469
http://advisories.mageia.org/MGASA-2014-0247.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 2/X86_64:
de6bb1c43cf66acc391b0866c78acc9d
mbs2/x86_64/lib64tasn1_6-3.6-1.mbs2.x86_64.rpm
7190acef1aaac85573ade2ff1f25921e
mbs2/x86_64/lib64tasn1-devel-3.6-1.mbs2.x86_64.rpm
5d87f79d7d3f3abb3d1b08e594eb5112
mbs2/x86_64/libtasn1-tools-3.6-1.mbs2.x86_64.rpm
67339ddfd49a0693dd664309fe47b351 mbs2/SRPMS/libtasn1-3.6-1.mbs2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVF7hQmqjQ0CJFipgRAsOhAJ4i3LBbQrVk+SQcbOz4w0m15f0yQgCgjADw
jh8cZSlUEuElsAbYnL80Ewg=
=S9im
-----END PGP SIGNATURE-----


------------=_1427621610-10360-16
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1427621610-10360-16--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung