From security@mandriva.com Fri Feb 24 19:07:52 2006 From: security@mandriva.com To: full-disclosure@lists.grok.org.uk Date: Fri, 24 Feb 2006 17:10:00 -0700 Reply-To: xsecurity@mandriva.com Subject: [Full-disclosure] [ MDKSA-2005:048 ] - Updated mplayer packages fix integer overflow vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2005:048 http://www.mandriva.com/security/ _______________________________________________________________________ Package : mplayer Date : February 24, 2005 Affected: 2006.0, Corporate 3.0 _______________________________________________________________________ Problem Description: Multiple integer overflows in (1) the new_demux_packet function in demuxer.h and (2) the demux_asf_read_packet function in demux_asf.c in MPlayer 1.0pre7try2 and earlier allow remote attackers to execute arbitrary code via an ASF file with a large packet length value. The updated packages have been patched to prevent this problem. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0579 _______________________________________________________________________ Updated Packages: Mandriva Linux 2006.0: 6a9787d26d2b82697525ea3ce1a42528 2006.0/RPMS/libdha1.0-1.0-1.pre7.12.2.20060mdk.i586.rpm 2cee96ab48d748bd5c218c6b72762a69 2006.0/RPMS/libpostproc0-1.0-1.pre7.12.2.20060mdk.i586.rpm 7d85bd28f30c98b00002c4da1fb27935 2006.0/RPMS/libpostproc0-devel-1.0-1.pre7.12.2.20060mdk.i586.rpm eeaae4efea7c733946468504c0847c6e 2006.0/RPMS/mencoder-1.0-1.pre7.12.2.20060mdk.i586.rpm a3e1114604c50095b4a00e3e2546fad4 2006.0/RPMS/mplayer-1.0-1.pre7.12.2.20060mdk.i586.rpm 7c1d40d98a7c63b84836f17742424572 2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.2.20060mdk.i586.rpm 0ae9253d37d09e4e015c0dbea3e3238b 2006.0/SRPMS/mplayer-1.0-1.pre7.12.2.20060mdk.src.rpm Mandriva Linux 2006.0/X86_64: 083cd368b22c862c3ad4e3c6809373ba x86_64/2006.0/RPMS/lib64postproc0-1.0-1.pre7.12.2.20060mdk.x86_64.rpm f6764f327bc34aea319211a1ba848d46 x86_64/2006.0/RPMS/lib64postproc0-devel-1.0-1.pre7.12.2.20060mdk.x86_64.rpm 7cd2b81fe303956e07ead2be2ce40d01 x86_64/2006.0/RPMS/mencoder-1.0-1.pre7.12.2.20060mdk.x86_64.rpm 9962424187f6d7f99f91d65b22e62eea x86_64/2006.0/RPMS/mplayer-1.0-1.pre7.12.2.20060mdk.x86_64.rpm fc4d22d72852405516379f36249626ae x86_64/2006.0/RPMS/mplayer-gui-1.0-1.pre7.12.2.20060mdk.x86_64.rpm 0ae9253d37d09e4e015c0dbea3e3238b x86_64/2006.0/SRPMS/mplayer-1.0-1.pre7.12.2.20060mdk.src.rpm Corporate 3.0: 79227923f532fd0d481b6a8999a48fb6 corporate/3.0/RPMS/libdha0.1-1.0-0.pre3.14.6.C30mdk.i586.rpm 8239e565804440e9b5f33dab590825c4 corporate/3.0/RPMS/libpostproc0-1.0-0.pre3.14.6.C30mdk.i586.rpm b92ecaf616a975c840fd2d8d1640141b corporate/3.0/RPMS/libpostproc0-devel-1.0-0.pre3.14.6.C30mdk.i586.rpm 1a5c6dba5378d086e76ec1c05f5fe416 corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.6.C30mdk.i586.rpm 5d264152c0c2934f45c14576e3094a9d corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.6.C30mdk.i586.rpm 74c1e627dd747a52181e49502fa404b6 corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.6.C30mdk.i586.rpm 7ea541987b4b2285112e6c822704b797 corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.6.C30mdk.src.rpm Corporate 3.0/X86_64: 49ab3887057e1a407e85b09cea56d977 x86_64/corporate/3.0/RPMS/lib64postproc0-1.0-0.pre3.14.6.C30mdk.x86_64.rpm 3e8fdbfc03ba3bdbba4a31c52b8a6770 x86_64/corporate/3.0/RPMS/lib64postproc0-devel-1.0-0.pre3.14.6.C30mdk.x86_64.rpm 8d45d891ed90b1576acbc512f035f9bf x86_64/corporate/3.0/RPMS/mencoder-1.0-0.pre3.14.6.C30mdk.x86_64.rpm 2236312827cad9d6490340a9e7c66f6d x86_64/corporate/3.0/RPMS/mplayer-1.0-0.pre3.14.6.C30mdk.x86_64.rpm 803888f3129e969e1351ce6ce8a88d59 x86_64/corporate/3.0/RPMS/mplayer-gui-1.0-0.pre3.14.6.C30mdk.x86_64.rpm 7ea541987b4b2285112e6c822704b797 x86_64/corporate/3.0/SRPMS/mplayer-1.0-0.pre3.14.6.C30mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFD/3SJmqjQ0CJFipgRAppdAJwMKNiyvLVH+QXkX5IOMRvGzhA8iACfawcl 4MpPnK4igEjRxRY2ODPNZdg= =LcLq -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/