Full Disclosure: [ MDKSA-2006:065 ] - Updated kaffeine packages fix remote buffer overflow vulnerability

From: <security_at_mandriva.com>
Date: Wed, 5 Apr 2006 11:50:00 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:065
http://www.mandriva.com/security/
_______________________________________________________________________

Package : kaffeine
Date : April 5, 2006
Affected: 2006.0
_______________________________________________________________________

Problem Description:

Marcus Meissner discovered Kaffeine contains an unchecked buffer while
creating HTTP request headers for fetching remote RAM playlists, which
allows overflowing a heap allocated buffer. As a result, remotely
supplied RAM playlists can be used to execute arbitrary code on the
client machine.

Updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0051
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2006.0:
221dc2b4b5a7c83d2071c076ee3493ec 2006.0/RPMS/kaffeine-0.7-6.1.20060mdk.i586.rpm
2c7e274246e1dc740f8697c0f210925d 2006.0/RPMS/libkaffeine0-0.7-6.1.20060mdk.i586.rpm
9b5bb05954386af7505784a955243b25 2006.0/RPMS/libkaffeine0-devel-0.7-6.1.20060mdk.i586.rpm
7b313e26ca91b6f306b28be4fb9f5aa2 2006.0/SRPMS/kaffeine-0.7-6.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
8f4271cab6ec4670ed8e76d6c1711ec9 x86_64/2006.0/RPMS/kaffeine-0.7-6.1.20060mdk.x86_64.rpm
fadb3df8afb1d523946fa59298287185 x86_64/2006.0/RPMS/lib64kaffeine0-0.7-6.1.20060mdk.x86_64.rpm
6ed84efb236fb8e0aeccb42bbb00b57b x86_64/2006.0/RPMS/lib64kaffeine0-devel-0.7-6.1.20060mdk.x86_64.rpm
7b313e26ca91b6f306b28be4fb9f5aa2 x86_64/2006.0/SRPMS/kaffeine-0.7-6.1.20060mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEM9h0mqjQ0CJFipgRAmkFAJ9UlKXHZ8geXu9clxUPI1JzokKcqgCfenWD
IKy9b4oDlt49DTdaFSX8b1A=
=o2Jq
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Apr 05 2006