BugTraq
[ MDVSA-2010:225-1 ] libmbfl Nov 10 2010 11:32AM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2010:225-1
http://www.mandriva.com/security/
_______________________________________________________________________

Package : libmbfl
Date : November 10, 2010
Affected: 2010.0, 2010.1
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in libmbfl (php):

* Fix bug #53273 (mb_strcut() returns garbage with the excessive
length parameter) (CVE-2010-4156).

The updated packages have been patched to correct these issues.

Update:

The MDVSA-2010:225 advisory used the wrong patch to address the
problem, however it did fix the issue. This advisory provides the
correct upstream patch.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4156
http://bugs.php.net/bug.php?id=49354
http://bugs.php.net/bug.php?id=53273
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.0:
78dd51cd031e9ec143e4bbe8461b4bd5 2010.0/i586/libmbfl1-1.1.0-0.3mdv2010.0.i586.rpm
9d563d63a8e1718c5c8fd9cd6157aec6 2010.0/i586/libmbfl-devel-1.1.0-0.3mdv2010.0.i586.rpm
6d64c52b17d268a7361b4e2b84ba68dd 2010.0/SRPMS/libmbfl-1.1.0-0.3mdv2010.0.src.rpm

Mandriva Linux 2010.0/X86_64:
5cc948f64a74d0be4e1c93d19f4699eb 2010.0/x86_64/lib64mbfl1-1.1.0-0.3mdv2010.0.x86_64.rpm
85bc8266cbb3594ae01d8dfe7698dc85 2010.0/x86_64/lib64mbfl-devel-1.1.0-0.3mdv2010.0.x86_64.rpm
6d64c52b17d268a7361b4e2b84ba68dd 2010.0/SRPMS/libmbfl-1.1.0-0.3mdv2010.0.src.rpm

Mandriva Linux 2010.1:
46e5a0ede89a00c1d853d83f8b3e4cd9 2010.1/i586/libmbfl1-1.1.0-0.3mdv2010.1.i586.rpm
3697bab667857726176e305ccfe67af9 2010.1/i586/libmbfl-devel-1.1.0-0.3mdv2010.1.i586.rpm
d2342d41d387636e4279f21375afad9d 2010.1/SRPMS/libmbfl-1.1.0-0.3mdv2010.1.src.rpm

Mandriva Linux 2010.1/X86_64:
d94a733a8caa5d715037f7520a9bcf6c 2010.1/x86_64/lib64mbfl1-1.1.0-0.3mdv2010.1.x86_64.rpm
a20db60b6211f97d0c49b4f00f7c9222 2010.1/x86_64/lib64mbfl-devel-1.1.0-0.3mdv2010.1.x86_64.rpm
d2342d41d387636e4279f21375afad9d 2010.1/SRPMS/libmbfl-1.1.0-0.3mdv2010.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFM2mgxmqjQ0CJFipgRAmprAKCxBRbVtysXteKNnAh8JEDH0tMHbACg10yB
JZw5hP5+6Qxq3Ttwe6w4/rk=
=bK+b
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus