|
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVA-2009:158
http://www.mandriva.com/security/
_______________________________________________________________________
Package : pango
Date : July 23, 2009
Affected: 2008.1, 2009.0, Corporate 3.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
Integer overflow in the pango_glyph_string_set_size function in
pango/glyphstring.c in Pango before 1.24 allows context-dependent
attackers to cause a denial of service (application crash) or possibly
execute arbitrary code via a long glyph string that triggers a
heap-based buffer overflow. This update corrects the issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1194
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
8ed2ac52ac18fa8debe4cf0d19e497c7 2008.1/i586/libpango1.0_0-1.20.0-1.1mdv2008.1.i586.rpm
430718c1ceb4b769a64aef5bd95a60b0 2008.1/i586/libpango1.0_0-modules-1.20.0-1.1mdv2008.1.i586.rpm
90e14f60562814605b6884021ae4e8eb 2008.1/i586/libpango1.0-devel-1.20.0-1.1mdv2008.1.i586.rpm
86f789f5f599d31da2dba3f5a4d457eb 2008.1/i586/pango-1.20.0-1.1mdv2008.1.i586.rpm
c7f57b7106f2affcfa9833f90a11edfb 2008.1/i586/pango-doc-1.20.0-1.1mdv2008.1.i586.rpm
1f6ea21816580571f4404a5b49b843ea 2008.1/SRPMS/pango-1.20.0-1.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
67b5cc0b18d59f082cf2fbb9a4cf2153 2008.1/x86_64/lib64pango1.0_0-1.20.0-1.1mdv2008.1.x86_64.rpm
3a9e41e784c5807196ea290aa14458c6 2008.1/x86_64/lib64pango1.0_0-modules-1.20.0-1.1mdv2008.1.x86_64.rpm
8a2dbf2550af4653900562b368d84415 2008.1/x86_64/lib64pango1.0-devel-1.20.0-1.1mdv2008.1.x86_64.rpm
fc58e14c4df213c0bf693558782216d3 2008.1/x86_64/pango-1.20.0-1.1mdv2008.1.x86_64.rpm
69b9d122c29a07261bf12dd96d34acd5 2008.1/x86_64/pango-doc-1.20.0-1.1mdv2008.1.x86_64.rpm
1f6ea21816580571f4404a5b49b843ea 2008.1/SRPMS/pango-1.20.0-1.1mdv2008.1.src.rpm
Mandriva Linux 2009.0:
f220768c739dc9cae9f71de3cb43996e 2009.0/i586/libpango1.0_0-1.22.0-1.1mdv2009.0.i586.rpm
013fc29cec91e9b215394d00db29b1e7 2009.0/i586/libpango1.0_0-modules-1.22.0-1.1mdv2009.0.i586.rpm
b0bcd8e080aafd56a8e1f79f4fff96fe 2009.0/i586/libpango1.0-devel-1.22.0-1.1mdv2009.0.i586.rpm
b5d939dfca4c10eab1c1f9b2fb20f4a1 2009.0/i586/pango-1.22.0-1.1mdv2009.0.i586.rpm
d969812c6a1ad44513f0d6b7d65633c5 2009.0/i586/pango-doc-1.22.0-1.1mdv2009.0.i586.rpm
9babd2521bb72bd3db9020ebf3468a23 2009.0/SRPMS/pango-1.22.0-1.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
7b0fe4350cd4eaf9721c5ef651a3a7f7 2009.0/x86_64/lib64pango1.0_0-1.22.0-1.1mdv2009.0.x86_64.rpm
4a4705192e1c5c52b7ad38bd3fe8bdbb 2009.0/x86_64/lib64pango1.0_0-modules-1.22.0-1.1mdv2009.0.x86_64.rpm
09f7b36c23d737eb664b002940759285 2009.0/x86_64/lib64pango1.0-devel-1.22.0-1.1mdv2009.0.x86_64.rpm
770f30616e2b5347cb2fdcfeedc4a9e2 2009.0/x86_64/pango-1.22.0-1.1mdv2009.0.x86_64.rpm
e018b02b91e86cfb5dee7956a8cedf73 2009.0/x86_64/pango-doc-1.22.0-1.1mdv2009.0.x86_64.rpm
9babd2521bb72bd3db9020ebf3468a23 2009.0/SRPMS/pango-1.22.0-1.1mdv2009.0.src.rpm
Corporate 3.0:
fe6b828f9488f85f080869c42d380803 corporate/3.0/i586/libpango1.0_0-1.2.5-3.1.C30mdk.i586.rpm
67cf76c4f817b91e985053093ec0fc8a corporate/3.0/i586/libpango1.0_0-devel-1.2.5-3.1.C30mdk.i586.rpm
ef94bdec5331c62a74567633278bce54 corporate/3.0/i586/pango-1.2.5-3.1.C30mdk.i586.rpm
567cb4d9dd07d90ec17f736fcc3acb16 corporate/3.0/SRPMS/pango-1.2.5-3.1.C30mdk.src.rpm
Corporate 3.0/X86_64:
f0fb3f936e0d42cbb8bf4dd9113d7832 corporate/3.0/x86_64/lib64pango1.0_0-1.2.5-3.1.C30mdk.x86_64.rpm
51004f18ca85021b81671ccd0b0f0e43 corporate/3.0/x86_64/lib64pango1.0_0-devel-1.2.5-3.1.C30mdk.x86_64.rpm
bc25d953caf5c64455d6b9f21407eb5c corporate/3.0/x86_64/pango-1.2.5-3.1.C30mdk.x86_64.rpm
567cb4d9dd07d90ec17f736fcc3acb16 corporate/3.0/SRPMS/pango-1.2.5-3.1.C30mdk.src.rpm
Corporate 4.0:
d05ac0d15b5f6aa0ccae2e9138cbd32a corporate/4.0/i586/libpango1.0_0-1.10.0-3.1.20060mlcs4.i586.rpm
ecbc51723ca7d5ca22873589e6540d0e corporate/4.0/i586/libpango1.0_0-devel-1.10.0-3.1.20060mlcs4.i586.rpm
6c95ac70dddcca56dec35ffcbe4adde8 corporate/4.0/i586/libpango1.0_0-modules-1.10.0-3.1.20060mlcs4.i586.rpm
94bb1b067bf1f8b0afb5a019f6f83597 corporate/4.0/i586/pango-1.10.0-3.1.20060mlcs4.i586.rpm
7572845f90416d883d47b3681ccf5451 corporate/4.0/SRPMS/pango-1.10.0-3.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
ab4a921995dd9c8833e78448e7ef43c4 corporate/4.0/x86_64/lib64pango1.0_0-1.10.0-3.1.20060mlcs4.x86_64.rpm
dee3544eb5186529e4d4029acd027281 corporate/4.0/x86_64/lib64pango1.0_0-devel-1.10.0-3.1.20060mlcs4.x86_64.rpm
f4393cfae3d426fe0338c54ef6efef87 corporate/4.0/x86_64/lib64pango1.0_0-modules-1.10.0-3.1.20060mlcs4.x86_64.rpm
d159dc502f3b50ac6d3cbb6445e6bfdb corporate/4.0/x86_64/pango-1.10.0-3.1.20060mlcs4.x86_64.rpm
7572845f90416d883d47b3681ccf5451 corporate/4.0/SRPMS/pango-1.10.0-3.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team