BugTraq
[USN-1015-1] libvpx vulnerability Nov 10 2010 05:45PM
Jamie Strandboge (jamie canonical com)
===========================================================
Ubuntu Security Notice USN-1015-1 November 10, 2010
libvpx vulnerability
CVE-2010-4203
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 10.10:
libvpx0 0.9.2-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

Details follow:

Christoph Diehl discovered that libvpx did not properly perform bounds
checking. If an application using libvpx opened a specially crafted
WebM file, an attacker could cause a denial of service or possibly execute
code as the user invoking the program.

Updated packages for Ubuntu 10.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx_0.9.2-1ub
untu0.1.debian.tar.gz
Size/MD5: 11216 71651eb86d66635c6762bfbd09fc2dbe
http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx_0.9.2-1ub
untu0.1.dsc
Size/MD5: 1915 acc3a3df81a1d44128642b82efd87500
http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx_0.9.2.ori
g.tar.bz2
Size/MD5: 1197094 609370925b274aeaa29e94fc34c74957

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx-doc_0.9.2
-1ubuntu0.1_all.deb
Size/MD5: 213800 643f6dec01f57f032e3b0569fd740aea

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx-dev_0.9.2
-1ubuntu0.1_amd64.deb
Size/MD5: 317232 2bba15922882c45e09e00734cba97992
http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx0-dbg_0.9.
2-1ubuntu0.1_amd64.deb
Size/MD5: 513174 e7e4950eaeb1451d3b65877ee6160740
http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx0_0.9.2-1u
buntu0.1_amd64.deb
Size/MD5: 242484 29757fcd05cb208a7417c80c0e1480be

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx-dev_0.9.2
-1ubuntu0.1_i386.deb
Size/MD5: 295092 ad95c819c44989c1dffe857e8f5d7756
http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx0-dbg_0.9.
2-1ubuntu0.1_i386.deb
Size/MD5: 482832 47d4ef6d2a62ee070301fe4b5872acd2
http://security.ubuntu.com/ubuntu/pool/main/libv/libvpx/libvpx0_0.9.2-1u
buntu0.1_i386.deb
Size/MD5: 221952 7ff75df2f1410385b6231d633eceeaec

armel architecture (ARM Architecture):

http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx-dev_0.9.2-1ubuntu0.
1_armel.deb
Size/MD5: 303772 a28b374676f0b28fb74cabea30cca822
http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx0-dbg_0.9.2-1ubuntu0
.1_armel.deb
Size/MD5: 462142 a59e1096f88f18a844e37fabc99d1d7f
http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx0_0.9.2-1ubuntu0.1_a
rmel.deb
Size/MD5: 244498 5bc6ca696e39ddc9af21a30856ff2177

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx-dev_0.9.2-1ubuntu0.
1_powerpc.deb
Size/MD5: 279168 25295c9264836bdace7133836a634afb
http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx0-dbg_0.9.2-1ubuntu0
.1_powerpc.deb
Size/MD5: 452792 c9c51d0c479379b19e77022992eb76ac
http://ports.ubuntu.com/pool/main/libv/libvpx/libvpx0_0.9.2-1ubuntu0.1_p
owerpc.deb
Size/MD5: 218026 e4618be5cbce6571eae4810c9e80990f

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAABAgAGBQJM2tokAAoJEFHb3FjMVZVzXp8P+gIKrzfQ3BLZ0Bm14jg2m9vt
pZbHfX8P3fuTvz5VWEpFY8jEGajuK5wpqHqxhKfq7XomD+f56hnQogmHAaKiUYCk
BK/eOQg2SMWrgPqmcivXnPmBnnEN1z2cb6ACLER/LIerblgJGZr9IwUpWN+72LFs
lrazDUaFvEpVfb/8YgwTx60cHOP4K5O4ty4x/pvqF4PQ8Pefbg7G5zp0Cmj6JEqn
sQfpRlk7Q+6NRkgV5ddTXvjAPBhd4BerNJhZUAojdlRmdY+D9zU6zc9VJslzRih4
Y7OsuR96JORaT7h5S7cfIbz97kvGGYHn0CH8/z24SKzJyrsyjkt8y4cvIp0gxUjP
ni3WAmsR9a7GHkN3q+1WMJTF7PSKiV/4ajYx/x/SbJh1l7w4/7wG+4snVZDIH+fW
5XDsz1Iru+AOfY8Do4kjxFrei1T7DnQYzvYz8j/+VZ9XH58UnyCgG8GR0qXmZoDd
cNiJHuFVztg8npoCXAB1vSHe27b0vFZI6QlccyoSUPHEo3ntH0QRpAgXQ9z2KNsM
tkDt0yLlz1pcpkIHYDgZzTEZXJSmZrRIlU0WQfY5xmLkwiSK9ti13lI8tZY1ZZjo
8UIWSPYzxFSnXqBUEYy5uMREyU6uEw+UDViAmEpn+OEBC+iX+2A6VYXda4zo3ks+
n+ciMD8SoP6Xi3plvIxn
=8H7i
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus