-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2014:039
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : libgadu
Date : February 18, 2014
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
Updated libgadu packages fix security vulnerability:
A malicious server or man-in-the-middle could send a large value for
Content-Length and cause an integer overflow which could lead to a
buffer overflow in Gadu-Gadu HTTP parsing (CVE-2013-6487).
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6487
http://advisories.mageia.org/MGASA-2014-0074.html
_______________________________________________________________________
Updated Packages:
Mandriva Enterprise Server 5:
65640d78caeb724856896f6ac5f6ccbf mes5/i586/libgadu3-1.8.1-2.2mdvmes5.2.i586.rpm
23e13f92896af06860593ece27a3a2e5 mes5/i586/libgadu-devel-1.8.1-2.2mdvmes5.2.i586.rpm
2c454d07d7d9abb15fddefe39360c38a mes5/SRPMS/libgadu-1.8.1-2.2mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64:
4230f0fb619aeccc503dc95ac9e90798 mes5/x86_64/lib64gadu3-1.8.1-2.2mdvmes5.2.x86_64.rpm
69effc40493fd6a8d8bd9c8b6bb560ef mes5/x86_64/lib64gadu-devel-1.8.1-2.2mdvmes5.2.x86_64.rpm
2c454d07d7d9abb15fddefe39360c38a mes5/SRPMS/libgadu-1.8.1-2.2mdvmes5.2.src.rpm
Mandriva Business Server 1/X86_64:
16f19b3210caefdcb38653f2c8684792 mbs1/x86_64/lib64gadu3-1.11.3-1.mbs1.x86_64.rpm
9301c10131e11e8ea6ff25f3c804acec mbs1/x86_64/lib64gadu-devel-1.11.3-1.mbs1.x86_64.rpm
07ae07079d369cb322c2af5c254bdc66 mbs1/SRPMS/libgadu-1.11.3-1.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFTAzMwmqjQ0CJFipgRAgx7AKC97Rp24wtYVDJF8WS+euFGuxn7AgCgv4Iu
vqtuOjddAPUAm08Wd2GVxBE=
=0QwI
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2014:039
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : libgadu
Date : February 18, 2014
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
Updated libgadu packages fix security vulnerability:
A malicious server or man-in-the-middle could send a large value for
Content-Length and cause an integer overflow which could lead to a
buffer overflow in Gadu-Gadu HTTP parsing (CVE-2013-6487).
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6487
http://advisories.mageia.org/MGASA-2014-0074.html
_______________________________________________________________________
Updated Packages:
Mandriva Enterprise Server 5:
65640d78caeb724856896f6ac5f6ccbf mes5/i586/libgadu3-1.8.1-2.2mdvmes5.2.i586.rpm
23e13f92896af06860593ece27a3a2e5 mes5/i586/libgadu-devel-1.8.1-2.2mdvmes5.2.i586.rpm
2c454d07d7d9abb15fddefe39360c38a mes5/SRPMS/libgadu-1.8.1-2.2mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64:
4230f0fb619aeccc503dc95ac9e90798 mes5/x86_64/lib64gadu3-1.8.1-2.2mdvmes5.2.x86_64.rpm
69effc40493fd6a8d8bd9c8b6bb560ef mes5/x86_64/lib64gadu-devel-1.8.1-2.2mdvmes5.2.x86_64.rpm
2c454d07d7d9abb15fddefe39360c38a mes5/SRPMS/libgadu-1.8.1-2.2mdvmes5.2.src.rpm
Mandriva Business Server 1/X86_64:
16f19b3210caefdcb38653f2c8684792 mbs1/x86_64/lib64gadu3-1.11.3-1.mbs1.x86_64.rpm
9301c10131e11e8ea6ff25f3c804acec mbs1/x86_64/lib64gadu-devel-1.11.3-1.mbs1.x86_64.rpm
07ae07079d369cb322c2af5c254bdc66 mbs1/SRPMS/libgadu-1.11.3-1.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFTAzMwmqjQ0CJFipgRAgx7AKC97Rp24wtYVDJF8WS+euFGuxn7AgCgv4Iu
vqtuOjddAPUAm08Wd2GVxBE=
=0QwI
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/