dcsimg
Linux Today: Linux News On Internet Time.





More on LinuxToday


Mandrake Linux Advisories: gaim, cdrecord

Sep 06, 2002, 17:26 (0 Talkback[s])

WEBINAR:
On-Demand

Re-Imagining Linux Platforms to Meet the Needs of Cloud Service Providers



______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           gaim
Advisory ID:            MDKSA-2002:054-1
Date:                   September 5th, 2002
Original Advisory Date: August 29th, 2002
Affected versions:      8.1
______________________________________________________________________

Problem Description:

 Versions of Gaim (an AOL instant message client) prior to 0.58 contain a
 buffer overflow in the Jabber plug-in module.  As well, a vulnerability
 was discovered in the URL-handling code, where the "manual" browser
 command passes an untrusted string to the shell without reliable
 quoting or escaping.  This allows an attacker to execute arbitrary
 commands on the user's machine with the user's permissions.  Those
 using the built-in browser commands are not vulnerable.

Update:

 The 8.1 package had an incorrect dependency on perl.  This package
 has been replaced with a proper package.  Please note the differing
 md5 sums.
______________________________________________________________________

References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0384
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0989
  http://gaim.sourceforge.net/ChangeLog
______________________________________________________________________

Updated Packages:

 Mandrake Linux 8.1:
 b6438c115a3cfa04c891e082c0795956  8.1/RPMS/gaim-0.59.1-1.1mdk.i586.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  8.1/SRPMS/gaim-0.59.1-1.1mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.  The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one 
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".  A list of
FTP mirrors can be obtained from:

  http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:

  rpm --checksig <filename>

All packages are signed by MandrakeSoft for security.  You can obtain
the GPG public key of the Mandrake Linux Security Team from:

  https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours to 
update.

You can view other update advisories for Mandrake Linux at:

  http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to.  Information on these lists can be obtained by
visiting:

  http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security@linux-mandrake.com>


______________________________________________________________________

                    Mandrake Linux Update Advisory
______________________________________________________________________

Package name:           cdrecord
Advisory ID:            MDKA-2002:011-1
Date:                   September 5th, 2002
Original Advisory Date: August 29th, 2002
Affected versions:      8.2
______________________________________________________________________

Problem Description:

 In some situations, noteably with xcdroast, the mkisofs utility creates
 pseudo-empty filesystems.  The filesystem is the proper size, but the
 contents of the filesystem are not available.  This update corrects
 this problem.

Update:

 New xcdroast packages are available that are compatible with this
 version of cdrecord.
______________________________________________________________________

Updated Packages:

 Mandrake Linux 8.2:
 4cf544fe01bc5cec08a0cd2f71f76875  8.2/RPMS/cdrecord-1.11-0.a31.1.1mdk.i586.rpm
 d854a732383dca0593d11e91af71e855  8.2/RPMS/cdrecord-cdda2wav-1.11-0.a31.1.1mdk.i586.rpm
 1e1fd02e7a8b3d10ba90af18d255fa6e  8.2/RPMS/cdrecord-devel-1.11-0.a31.1.1mdk.i586.rpm
 63ea91889d3cc830f06d8f0d5c5307ca  8.2/RPMS/cdrecord-dvdhack-1.11-0.a31.1.1mdk.i586.rpm
 e76d3cf32268392ede822bb3a7c6b9a2  8.2/RPMS/mkisofs-1.15-0.a31.1.1mdk.i586.rpm
 bd3ed5c1a4aa4080a689ae43a46c0a0e  8.2/RPMS/xcdroast-0.98-18.2mdk.i586.rpm
 16df8e5b09fe919fc838f5a30acb28d9  8.2/SRPMS/cdrecord-1.11-0.a31.1.1mdk.src.rpm
 83b6ec9bdba5f1abaebb2ef9efdb8f33  8.2/SRPMS/xcdroast-0.98-18.2mdk.src.rpm

 Mandrake Linux 8.2/PPC:
 4d04926db385eda37ce8aea01d7f896b  ppc/8.2/RPMS/cdrecord-1.11-0.a31.1.1mdk.ppc.rpm
 04f3ec259072977688105cf808b45705  ppc/8.2/RPMS/cdrecord-cdda2wav-1.11-0.a31.1.1mdk.ppc.rpm
 a640b87277926438c30bd2423a4d6e5b  ppc/8.2/RPMS/cdrecord-devel-1.11-0.a31.1.1mdk.ppc.rpm
 fb9f630f8e12a440063fdad2f85fe0b6  ppc/8.2/RPMS/cdrecord-dvdhack-1.11-0.a31.1.1mdk.ppc.rpm
 eed9d40e98ea13671a5f7e4e1b559807  ppc/8.2/RPMS/mkisofs-1.15-0.a31.1.1mdk.ppc.rpm
 0441c6f8e4fca71ac097851120010b3e  ppc/8.2/RPMS/xcdroast-0.98-18.2mdk.ppc.rpm
 16df8e5b09fe919fc838f5a30acb28d9  ppc/8.2/SRPMS/cdrecord-1.11-0.a31.1.1mdk.src.rpm
 83b6ec9bdba5f1abaebb2ef9efdb8f33  ppc/8.2/SRPMS/xcdroast-0.98-18.2mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

 160 - problem with mkisofs-1.15-0.a20 - empty filesystem?
______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.  The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one 
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".  A list of
FTP mirrors can be obtained from:

  http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:

  rpm --checksig <filename>

You can obtain the GPG public key of the Mandrake Linux Security Team
from:

  https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours to 
update.

You can view other update advisories for Mandrake Linux at:

  http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to.  Information on these lists can be obtained by
visiting:

  http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security@linux-mandrake.com>