Debian GNU/Linux
Debian Security Advisory DSA 711-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
April 19th, 2005 http://www.debian.org/security/faq
Package : info2www
Vulnerability : missing input sanitising
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2004-1341
Debian Bug : 281655
Nicolas Gregoire discovered a cross-site scripting vulnerability
in info2www, a converter for info files to HTML. A malicious person
could place a harmless looking link on the web that could cause
arbitrary commands to be executed in the browser of the victim
user.
For the stable distribution (woody) this problem has been fixed
in version 1.2.2.9-20woody1.
For the unstable distribution (sid) this problem has been fixed
in version 1.2.2.9-23.
We recommend that you upgrade your info2www package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/i/info2www/info2www_1.2.2.9-20woody1.dsc
Size/MD5 checksum: 600 68a3d62f9ff13abaf1cd2b2ca479c8e9
http://security.debian.org/pool/updates/main/i/info2www/info2www_1.2.2.9-20woody1.diff.gz
Size/MD5 checksum: 27216 d4bf5b04bfcaa304bbe18969346a281e
http://security.debian.org/pool/updates/main/i/info2www/info2www_1.2.2.9.orig.tar.gz
Size/MD5 checksum: 12407 2d79050502b938fae36d6d38e1d5084b
Architecture independent components:
http://security.debian.org/pool/updates/main/i/info2www/info2www_1.2.2.9-20woody1_all.deb
Size/MD5 checksum: 34006 93914a2ed64150b8682e8e419f7878ed
These files will probably be moved into the stable distribution
on its next update.
For apt-get: deb http://security.debian.org/
stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>;
Debian Security Advisory DSA 712-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
April 19th, 2005 http://www.debian.org/security/faq
Package : geneweb
Vulnerability : insecure file operations
Problem-Type : local
Debian-specific: yes
CVE ID : CAN-2005-0391
Debian Bug : 304405
Tim Dijkstra discovered a problem during the upgrade of geneweb,
a genealogy software with web interface. The maintainer scripts
automatically converted files without checking their permissions
and content, which could lead to the modification of arbitrary
files.
For the stable distribution (woody) this problem has been fixed
in version 4.06-2woody1.
For the unstable distribution (sid) this problem has been fixed
in version 4.10-7.
We recommend that you upgrade your geneweb package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1.dsc
Size/MD5 checksum: 622 42f4904be438272ef8cdc58c209bf69e
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1.diff.gz
Size/MD5 checksum: 23312 8a6772692840aaa3a8190f3c620a93c7
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06.orig.tar.gz
Size/MD5 checksum: 832896 a64a4373cb82d6a3044718c7345e45f7
Alpha architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_alpha.deb
Size/MD5 checksum: 2337090 858feee271e9273832c88d48ba328a12
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_alpha.deb
Size/MD5 checksum: 208060 f7307a991ec6bc392921d90abdc81ca2
ARM architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_arm.deb
Size/MD5 checksum: 1944856 82b8aebab5bb58d37d15b999a4335f2a
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_arm.deb
Size/MD5 checksum: 169726 7839aa9156ee97f9d1f3c4f86dd550c3
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_i386.deb
Size/MD5 checksum: 1684856 2a1bc1f0ec1fc6c3f7ef7c52fd1e94d8
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_i386.deb
Size/MD5 checksum: 144654 6894d141467665242c11498ad8d19c7e
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_ia64.deb
Size/MD5 checksum: 985874 1ab07405b51d714f67947bbdb2b75556
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_ia64.deb
Size/MD5 checksum: 108438 4885192511533339a3f4bbac1f46e3af
HP Precision architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_hppa.deb
Size/MD5 checksum: 865514 2e9ac4cb55344f560c09305d8e5ff69a
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_hppa.deb
Size/MD5 checksum: 88544 f9bb191412501d5bb0af4f1e3ad3da8d
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_m68k.deb
Size/MD5 checksum: 769174 160c16c3ec87483ea98bf2d27d21791d
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_m68k.deb
Size/MD5 checksum: 72536 91fb0ee658037ed95eacf536d4a85066
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_mips.deb
Size/MD5 checksum: 830996 744a10d4b0b6274130243f20b5fd61b8
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_mips.deb
Size/MD5 checksum: 82986 e0ad1d6ec21c6e3d3c05f3d415dc7464
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_mipsel.deb
Size/MD5 checksum: 828712 f662f4bfd37628765ff6ed5f84db1ced
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_mipsel.deb
Size/MD5 checksum: 82488 f59385de1518114ca79d4fafdd671c70
PowerPC architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_powerpc.deb
Size/MD5 checksum: 1974276 6f7b75c7a7110573a60e23ee148ad08e
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_powerpc.deb
Size/MD5 checksum: 172650 722401a02a51b2e0e56cb3192fd0112c
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_s390.deb
Size/MD5 checksum: 806318 9050118b04fd2ac2191a42626a0f475e
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_s390.deb
Size/MD5 checksum: 78592 ef1d41ec105bff3fb06d7666ba1a5088
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/g/geneweb/geneweb_4.06-2woody1_sparc.deb
Size/MD5 checksum: 2014300 a419b10c08cf4612a5acba067f4adc3f
http://security.debian.org/pool/updates/main/g/geneweb/gwtp_4.06-2woody1_sparc.deb
Size/MD5 checksum: 176650 8e4c69e79adc7df3de7464981c8e8d31
These files will probably be moved into the stable distribution
on its next update.
For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>
Gentoo Linux
Gentoo Linux Security Advisory GLSA 200504-17
http://security.gentoo.org/
Severity: Normal
Title: XV: Multiple vulnerabilities
Date: April 19, 2005
Bugs: #88742
ID: 200504-17
Multiple vulnerabilities have been discovered in XV, potentially
resulting in the execution of arbitrary code.
XV is an interactive image manipulation program for the X Window
System.
Package / Vulnerable / Unaffected
1 media-gfx/xv < 3.10a-r11 >= 3.10a-r11
Greg Roelofs has reported multiple input validation errors in XV
image decoders. Tavis Ormandy of the Gentoo Linux Security Audit
Team has reported insufficient validation in the PDS (Planetary
Data System) image decoder, format string vulnerabilities in the
TIFF and PDS decoders, and insufficient protection from shell
meta-characters in malformed filenames.
Successful exploitation would require a victim to view a
specially created image file using XV, potentially resulting in the
execution of arbitrary code.
There is no known workaround at this time.
All XV users should upgrade to the latest version:
--
-- -- -->--.-
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200504-17.xml
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
Copyright 2005 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
Gentoo Linux Security Advisory GLSA 200504-18
http://security.gentoo.org/
Severity: Normal
Title: Mozilla Firefox, Mozilla Suite: Multiple vulnerabilities
Date: April 19, 2005
Bugs: #89303, #89305
ID: 200504-18
New Mozilla Firefox and Mozilla Suite releases fix new security
vulnerabilities, including memory disclosure and various ways of
executing JavaScript code with elevated privileges.
The Mozilla Suite is a popular all-in-one web browser that
includes a mail and news reader. Mozilla Firefox is the
next-generation browser from the Mozilla project.
Package / Vulnerable / Unaffected
1 www-client/mozilla-firefox < 1.0.3 >= 1.0.3
2 www-client/mozilla-firefox-bin < 1.0.3 >= 1.0.3
3 www-client/mozilla < 1.7.7 >= 1.7.7
4 www-client/mozilla-bin < 1.7.7 >= 1.7.7
-------------------------------------------------------------------
4 affected packages on all of their supported architectures.
The following vulnerabilities were found and fixed in the
Mozilla Suite and Mozilla Firefox:
- Vladimir V. Perepelitsa reported a memory disclosure bug in
JavaScript’s regular expression string replacement when using an
anonymous function as the replacement argument
(CAN-2005-0989).
- moz_bug_r_a4 discovered that Chrome UI code was overly trusting
DOM nodes from the content window, allowing privilege escalation
via DOM property overrides.
- Michael Krax reported a possibility to run JavaScript code with
elevated privileges through the use of javascript: favicons.
- Michael Krax also discovered that malicious Search plugins
could run JavaScript in the context of the displayed page or
stealthily replace existing search plugins.
- shutdown discovered a technique to pollute the global scope of
a window in a way that persists from page to page.
- Doron Rosenberg discovered a possibility to run JavaScript with
elevated privileges when the user asks to “Show” a blocked popup
that contains a JavaScript URL.
- Finally, Georgi Guninski reported missing Install object
instance checks in the native implementations of XPInstall-related
JavaScript objects.
The following Firefox-specific vulnerabilities have also been
discovered:
- Kohei Yoshino discovered a new way to abuse the sidebar panel
to execute JavaScript with elevated privileges.
- Omar Khan reported that the Plugin Finder Service can be
tricked to open javascript: URLs with elevated privileges.
The various JavaScript execution with elevated privileges issues
can be exploited by a remote attacker to install malicious code or
steal data. The memory disclosure issue can be used to reveal
potentially sensitive information. Finally, the cache pollution
issue and search plugin abuse can be leveraged in
cross-site-scripting attacks.
There is no known workaround at this time.
All Mozilla Firefox users should upgrade to the latest
version:
--
-- -- -->---..
All Mozilla Firefox binary users should upgrade to the latest
version:
--
-- -- -->----..
All Mozilla Suite users should upgrade to the latest
version:
--
-- -- -->--..
All Mozilla Suite binary users should upgrade to the latest
version:
--
-- -- -->---..
[ 1 ] Mozilla Security Advisories
http://www.mozilla.org/projects/security/known-vulnerabilities.html
[ 2 ] CAN-2005-0989
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0989
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200504-18.xml
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
Copyright 2005 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
Mandriva Linux
Mandriva Linux Security Update Advisory
Package name: php
Advisory ID: MDKSA-2005:072
Date: April 18th, 2005
Affected versions: 10.0, 10.1, 10.2, Corporate 3.0, Corporate
Server 2.1
Problem Description:
A number of vulnerabilities are addressed in this PHP
update:
Stefano Di Paolo discovered integer overflows in PHP’s pack(),
unpack(), and shmop_write() functions which could allow a malicious
script to break out of safe mode and execute arbitray code with
privileges of the PHP interpreter (CAN-2004-1018; this was
previously fixed in Mandrakelinux >= 10.0 in
MDKSA-2004:151).
Stefan Esser discovered two safe mode bypasses which would allow
malicious scripts to circumvent path restrictions by using
virtual_popen() with a current directory containing shell
metacharacters (CAN-2004-1063) or by creating a specially crafted
directory whose length exceeded the capacity of realpath()
(CAN-2004-1064; both of these were previously fixed in
Mandrakelinux >= 10.0 in MDKSA-2004:151).
Two Denial of Service vulnerabilities were found in the
getimagesize() function which uses the format-specific internal
functions php_handle_iff() and php_handle_jpeg() which would get
stuck in infinite loops when certain (invalid) size parameters are
read from the image (CAN-2005-0524 and CAN-2005-0525).
An integer overflow was discovered in the exif_process_IFD_TAG()
function in PHP’s EXIF module. EXIF tags with a specially crafted
“Image File Directory” (IFD) tag would cause a buffer overflow
which could be exploited to execute arbitrary code with the
privileges of the PHP server (CAN-2005-1042).
Another vulnerability in the EXIF module was also discovered
where headers with a large IFD nesting level would cause an unbound
recursion which would eventually overflow the stack and cause the
executed program to crash (CAN-2004-1043).
All of these issues are addressed in the Corporate Server 2.1
packages and the last three issues for all other platforms, which
had previously included the first two issues but had not been
mentioned in MDKSA-2004:151.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0524
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0525
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1043
Updated Packages:
Mandrakelinux 10.0:
f7d974aa23e07a33ffc28d24d57ae6d1
10.0/RPMS/libphp_common432-4.3.4-4.5.100mdk.i586.rpm
345a78284dee2a035f627e348e73923b
10.0/RPMS/php-cgi-4.3.4-4.5.100mdk.i586.rpm
14a9a57cb05438a2b95ac47fa68755be
10.0/RPMS/php-cli-4.3.4-4.5.100mdk.i586.rpm
1d43beb4125253db8a9bdaaffec6abce
10.0/RPMS/php432-devel-4.3.4-4.5.100mdk.i586.rpm
44a1aa8be7f1f56120568028d3cce0a0
10.0/SRPMS/php-4.3.4-4.5.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
9651a95c09fef8db80f8d0455f1d4aae
amd64/10.0/RPMS/lib64php_common432-4.3.4-4.5.100mdk.amd64.rpm
d883ef32f7f60531cf2be850d5e9dcba
amd64/10.0/RPMS/php-cgi-4.3.4-4.5.100mdk.amd64.rpm
21f487c746312c589115e12b9ed0d13e
amd64/10.0/RPMS/php-cli-4.3.4-4.5.100mdk.amd64.rpm
0a9e996779cc13cfa458c39aa6bf6472
amd64/10.0/RPMS/php432-devel-4.3.4-4.5.100mdk.amd64.rpm
44a1aa8be7f1f56120568028d3cce0a0
amd64/10.0/SRPMS/php-4.3.4-4.5.100mdk.src.rpm
Mandrakelinux 10.1:
f75cb008b1eafcce1167f487fd0742ef
10.1/RPMS/libphp_common432-4.3.8-3.3.101mdk.i586.rpm
6522017c3e097f22a37f293d765f4141
10.1/RPMS/php-cgi-4.3.8-3.3.101mdk.i586.rpm
4ba9ade6db11e4035f73ede36e361ad7
10.1/RPMS/php-cli-4.3.8-3.3.101mdk.i586.rpm
63d4d58bbc3a01b89c688660be399af0
10.1/RPMS/php432-devel-4.3.8-3.3.101mdk.i586.rpm
f4fe82b93cf84987b0787e297d5189de
10.1/SRPMS/php-4.3.8-3.3.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
fb08286032f45020ecd96e07b0da51af
x86_64/10.1/RPMS/lib64php_common432-4.3.8-3.3.101mdk.x86_64.rpm
e1ae8214e11a7e62e987cde10e53c609
x86_64/10.1/RPMS/php-cgi-4.3.8-3.3.101mdk.x86_64.rpm
44c080a9d90e282da95b5d809e90df52
x86_64/10.1/RPMS/php-cli-4.3.8-3.3.101mdk.x86_64.rpm
d23e51652be1cb62f4704a5c4fe4a7a9
x86_64/10.1/RPMS/php432-devel-4.3.8-3.3.101mdk.x86_64.rpm
f4fe82b93cf84987b0787e297d5189de
x86_64/10.1/SRPMS/php-4.3.8-3.3.101mdk.src.rpm
Mandrakelinux 10.2:
cc1f7f17fdcaf8dc87efcad94a241eca
10.2/RPMS/libphp_common432-4.3.10-7.1.102mdk.i586.rpm
3655f4254ca1ee329462e1f744533ed2
10.2/RPMS/php-cgi-4.3.10-7.1.102mdk.i586.rpm
a6084914e21c0a5873d5b94bb914411f
10.2/RPMS/php-cli-4.3.10-7.1.102mdk.i586.rpm
41a0168e7a2fdb581b59e5550c02418f
10.2/RPMS/php432-devel-4.3.10-7.1.102mdk.i586.rpm
2e3bf475cc0a73a2402d487e1bcaa741
10.2/SRPMS/php-4.3.10-7.1.102mdk.src.rpm
Mandrakelinux 10.2/X86_64:
17130ea081a475bebce9ef1f4ea89c22
x86_64/10.2/RPMS/lib64php_common432-4.3.10-7.1.102mdk.x86_64.rpm
5b9712e9d2b3709243080eefe5f36037
x86_64/10.2/RPMS/php-cgi-4.3.10-7.1.102mdk.x86_64.rpm
6e77ec1f4a00e757e9144c798f86b465
x86_64/10.2/RPMS/php-cli-4.3.10-7.1.102mdk.x86_64.rpm
f55fc2c228f012266c55e830cc858698
x86_64/10.2/RPMS/php432-devel-4.3.10-7.1.102mdk.x86_64.rpm
2e3bf475cc0a73a2402d487e1bcaa741
x86_64/10.2/SRPMS/php-4.3.10-7.1.102mdk.src.rpm
Corporate Server 2.1:
f418349daa18087f1b2bd2d06d07a7d7
corporate/2.1/RPMS/php-4.2.3-4.4.C21mdk.i586.rpm
f55f290333af492f34104d1821ece93d
corporate/2.1/RPMS/php-common-4.2.3-4.4.C21mdk.i586.rpm
ff25be7d53aa1f8efa1ac7ea06935c60
corporate/2.1/RPMS/php-devel-4.2.3-4.4.C21mdk.i586.rpm
38a6771932090c0b49a495caa244047f
corporate/2.1/RPMS/php-pear-4.2.3-4.4.C21mdk.i586.rpm
57a79e60657b372524d7b8af3535cfe6
corporate/2.1/SRPMS/php-4.2.3-4.4.C21mdk.src.rpm
Corporate Server 2.1/X86_64:
0459cb20800a58b6ee41fc6ac2dc55b2
x86_64/corporate/2.1/RPMS/php-4.2.3-4.4.C21mdk.x86_64.rpm
462186f5005cafbfe66dd99cb9110e30
x86_64/corporate/2.1/RPMS/php-common-4.2.3-4.4.C21mdk.x86_64.rpm
5f6c49093da250595d27917455fff5bd
x86_64/corporate/2.1/RPMS/php-devel-4.2.3-4.4.C21mdk.x86_64.rpm
5fb114b6761fcd231cbbbfde6e41252d
x86_64/corporate/2.1/RPMS/php-pear-4.2.3-4.4.C21mdk.x86_64.rpm
57a79e60657b372524d7b8af3535cfe6
x86_64/corporate/2.1/SRPMS/php-4.2.3-4.4.C21mdk.src.rpm
Corporate 3.0:
eab4aa42fbd404630d0eb350ea17efd1
corporate/3.0/RPMS/libphp_common432-4.3.4-4.5.C30mdk.i586.rpm
3138545d861d0c28acc81f77424e95c5
corporate/3.0/RPMS/php-cgi-4.3.4-4.5.C30mdk.i586.rpm
b26d65545512c6698cfb5d3280961677
corporate/3.0/RPMS/php-cli-4.3.4-4.5.C30mdk.i586.rpm
6bfa6303f2f8a52c963f9df4bf59c639
corporate/3.0/RPMS/php432-devel-4.3.4-4.5.C30mdk.i586.rpm
9f017d501ff162d276b0e2832468a5c8
corporate/3.0/SRPMS/php-4.3.4-4.5.C30mdk.src.rpm
Corporate 3.0/X86_64:
eab4aa42fbd404630d0eb350ea17efd1
x86_64/corporate/3.0/RPMS/libphp_common432-4.3.4-4.5.C30mdk.i586.rpm
3138545d861d0c28acc81f77424e95c5
x86_64/corporate/3.0/RPMS/php-cgi-4.3.4-4.5.C30mdk.i586.rpm
b26d65545512c6698cfb5d3280961677
x86_64/corporate/3.0/RPMS/php-cli-4.3.4-4.5.C30mdk.i586.rpm
6bfa6303f2f8a52c963f9df4bf59c639
x86_64/corporate/3.0/RPMS/php432-devel-4.3.4-4.5.C30mdk.i586.rpm
9f017d501ff162d276b0e2832468a5c8
x86_64/corporate/3.0/SRPMS/php-4.3.4-4.5.C30mdk.src.rpm
To upgrade automatically use MandrakeUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>