[Security-Discuss] RE: [Security Announce] MDKSA-2005:002 - Updated wxGTK2 packages fix vulnerabilities

REMOVE 

-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of Mandrake Linux Security Team
Sent: Thursday, January 06, 2005 2:52 PM
To: security-announce-J4tZAbal8pkzaQFa27Lw39BPR1lH4CV8@public.gmane.org
Subject: [Security Announce] MDKSA-2005:002 - Updated wxGTK2 packages fix
vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
_______________________________________________________________________

 Package name:           wxGTK2
 Advisory ID:            MDKSA-2005:002
 Date:                   January 6th, 2005

 Affected versions:	 10.0, 10.1
 ______________________________________________________________________

 Problem Description:

 Several vulnerabilities have been discovered in the libtiff package;
 wxGTK2 uses a libtiff code tree, so it may have the same
 vulnerabilities:
 
 iDefense reported the possibility of remote exploitation of an integer
overflow in libtiff that may allow for the execution of arbitrary code.
 
 The overflow occurs in the parsing of TIFF files set with the  STRIPOFFSETS
flag.
 
 iDefense also reported a heap-based buffer overflow vulnerability  within
the LibTIFF package could allow attackers to execute arbitrary  code.
(CAN-2004-1308)
 
 The vulnerability specifically exists due to insufficient validation of
user-supplied data when calculating the size of a directory entry.
 
 The updated packages are patched to protect against these  vulnerabilities.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1183
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1308
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 ba9d5780d05078247a92f6cd0884a642
10.0/RPMS/libwxgtk2.5-2.5.0-0.cvs20030817.1.5.100mdk.i586.rpm
 369c1190bf5ff19a89728a633a2243bb
10.0/RPMS/libwxgtk2.5-devel-2.5.0-0.cvs20030817.1.5.100mdk.i586.rpm
 81878a529f380d3edac2d35427820a40
10.0/RPMS/libwxgtkgl2.5-2.5.0-0.cvs20030817.1.5.100mdk.i586.rpm
 d457c6001ae548eed3f74fece216538c
10.0/RPMS/wxGTK2.5-2.5.0-0.cvs20030817.1.5.100mdk.i586.rpm
 5e8b965e2f4d744b994ff4d33f76de40
10.0/SRPMS/wxGTK2.5-2.5.0-0.cvs20030817.1.5.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 618a8fe53ecade77de29e9a0c5c0ccde
amd64/10.0/RPMS/lib64wxgtk2.5-2.5.0-0.cvs20030817.1.5.100mdk.amd64.rpm
 c4a9b6e1c1340e38ff19a8bf15daa93e
amd64/10.0/RPMS/lib64wxgtk2.5-devel-2.5.0-0.cvs20030817.1.5.100mdk.amd64.rpm
 53f31674004696ef38f278481be554e7
amd64/10.0/RPMS/lib64wxgtkgl2.5-2.5.0-0.cvs20030817.1.5.100mdk.amd64.rpm
 f9e36ab6a1ed9d312ce5882308f91619
amd64/10.0/RPMS/wxGTK2.5-2.5.0-0.cvs20030817.1.5.100mdk.amd64.rpm
 5e8b965e2f4d744b994ff4d33f76de40
amd64/10.0/SRPMS/wxGTK2.5-2.5.0-0.cvs20030817.1.5.100mdk.src.rpm

 Mandrakelinux 10.1:
 9b9e61df2db9973b8f452acf61104f42
10.1/RPMS/libwxgtk2.5_1-2.5.1-5.3.101mdk.i586.rpm
 c524f5fc3392651e1cbecde322eaa1a0
10.1/RPMS/libwxgtk2.5_1-devel-2.5.1-5.3.101mdk.i586.rpm
 c82c706931183f2c18bbdf3e52fed787
10.1/RPMS/libwxgtkgl2.5_1-2.5.1-5.3.101mdk.i586.rpm
 8c8e53e3b50fb2bd335d16e0ca7f6fd8
10.1/RPMS/wxGTK2.5-2.5.1-5.3.101mdk.i586.rpm
 c5a574a7031028f589d77f4254997d6f
10.1/SRPMS/wxGTK2.5-2.5.1-5.3.101mdk.src.rpm

 Mandrakelinux 10.1/X86_64:
 eba730a0d098c7d130423b8245a8f80b
x86_64/10.1/RPMS/lib64wxgtk2.5_1-2.5.1-5.3.101mdk.x86_64.rpm
 478acd8d9d1a34e44bc31adaab387e8a
x86_64/10.1/RPMS/lib64wxgtk2.5_1-devel-2.5.1-5.3.101mdk.x86_64.rpm
 c2fd48c6377ae03768a4cabe0f03c3f5
x86_64/10.1/RPMS/lib64wxgtkgl2.5_1-2.5.1-5.3.101mdk.x86_64.rpm
 afe966ca2449461e304c498d0873aace
x86_64/10.1/RPMS/wxGTK2.5-2.5.1-5.3.101mdk.x86_64.rpm
 c5a574a7031028f589d77f4254997d6f
x86_64/10.1/SRPMS/wxGTK2.5-2.5.1-5.3.101mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification  of
md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain  the
GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB3aUBmqjQ0CJFipgRAvJFAJ9d5XaOR+GOiAzExvBrfTtRD+56mwCeI06S
5wZTm9MOdhQLxjV3NskMxao=
=Aneh
-----END PGP SIGNATURE-----

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________