:Red Hat Security Advisory: New netscape packages available to fix JPEG problem
Red Hat Security Advisory: New netscape packages available to fix JPEG problem Jul 31, 2000, 20 :59 UTC (0 Talkback[s]) (2255 reads)
Date: Mon, 31 Jul 2000 11:08:00 -0400
From: bugzilla@REDHAT.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: [RHSA-2000:046-02] New netscape packages available to fix JPEG problem
Red Hat, Inc. Security Advisory
Synopsis: New netscape packages available to fix JPEG problem
Advisory ID: RHSA-2000:046-02
Issue date: 2000-07-28
Updated on: 2000-07-28
Product: Red Hat Linux
Keywords: netscpae JPEG
Cross references: N/A
1. Topic:
New netscape packages are available that fix a potential
overflow due to improper input verification in netscape's JPEG
processing code. It is recommended that users of netscape update
to the fixed packages. Users of Red Hat Linux 6.0 and 6.1
should use the packages for Red Hat Linux 6.2.
2. Relevant releases/architectures:
Red Hat Linux 5.2 - i386
Red Hat Linux 6.0 - i386
Red Hat Linux 6.1 - i386
Red Hat Linux 6.2 - i386, alpha
3. Problem description:
Netscape's processing of JPEG comments trusted the length parameter
for comment fields; by manipulating this value, it would be possible
to cause netscape to read in an excessive amount of data, overwriting
memory. Specially designed data could allow a remote site to execute
arbitrary code as the user of netscape.
This vulnerability is fixed in Netscape 4.74.
4. Solution:
For each RPM for your particular architecture, run:
10165 - Netscape mail client does not compact folders anymore
13695 - Small glitch in German translation
14506 - Upgrade of netscape-common fails
14657 - /usr/lib/netscape/de_DE: cpio: unlinkfailed
You can verify each package with the following command:
rpm --checksig
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg
