drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in jhead
Name: |
Mehrere Probleme in jhead |
|
ID: |
MDVSA-2009:041 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva 2008.0, Mandriva 2008.1, Mandriva 2009.0 |
|
Datum: |
Di, 17. Februar 2009, 20:57 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4575
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4639
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4640
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4641 |
|
Applikationen: |
Jhead |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1234900662-6173-897
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:041 http://www.mandriva.com/security/ _______________________________________________________________________
Package : jhead Date : February 17, 2009 Affected: 2008.0, 2008.1, 2009.0 _______________________________________________________________________
Problem Description:
Security vulnerabilies have been identified and fixed in jhead. Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) (CVE-2008-4575). Jhead before 2.84 allows local users to overwrite arbitrary files via a symlink attack on a temporary file (CVE-2008-4639). Jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename (CVE-2008-4640). jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input (CVE-2008-4641). This update provides the latest Jhead to correct these issues. _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4575 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4639 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4640 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4641 _______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0: 441d3119c29e74427f8c8a2c2589450b 2008.0/i586/jhead-2.86-0.1mdv2008.0.i586.rpm 8275bd4ad7ed0ebca8f3936f291846eb 2008.0/SRPMS/jhead-2.86-0.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64: 371d922e6244a289a1ef0848d0a92076 2008.0/x86_64/jhead-2.86-0.1mdv2008.0.x86_64.rpm 8275bd4ad7ed0ebca8f3936f291846eb 2008.0/SRPMS/jhead-2.86-0.1mdv2008.0.src.rpm
Mandriva Linux 2008.1: 2c8593b1c6ee841645f8052d2262a694 2008.1/i586/jhead-2.86-0.1mdv2008.1.i586.rpm 72ef0127cabb83a5bea9a293002f5e59 2008.1/SRPMS/jhead-2.86-0.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64: a62b13bfcfb21d59f3686ae93e9dcae8 2008.1/x86_64/jhead-2.86-0.1mdv2008.1.x86_64.rpm 72ef0127cabb83a5bea9a293002f5e59 2008.1/SRPMS/jhead-2.86-0.1mdv2008.1.src.rpm
Mandriva Linux 2009.0: c08f58d5cce3c286cc40f94039e9daf1 2009.0/i586/jhead-2.86-0.1mdv2009.0.i586.rpm da9d3f99a662ac543c837098e0648b46 2009.0/SRPMS/jhead-2.86-0.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64: c070d4670f4a0059c04cb8863cb4dfb4 2009.0/x86_64/jhead-2.86-0.1mdv2009.0.x86_64.rpm da9d3f99a662ac543c837098e0648b46 2009.0/SRPMS/jhead-2.86-0.1mdv2009.0.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJmtQBmqjQ0CJFipgRAideAJ9j4MRAHhsfB53neolPluMEpqjQvQCdE7nv uJ7pvbSTAj4qYoG6h6nbeno= =0qi7 -----END PGP SIGNATURE-----
------------=_1234900662-6173-897 Content-Type: text/plain; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________
------------=_1234900662-6173-897--
|
|
|
|