-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:163 http://www.mandriva.com/security/ _______________________________________________________________________ Package : python Date : August 7, 2008 Affected: 2007.1, 2008.0, 2008.1 _______________________________________________________________________ Problem Description: Multiple integer overflows in the imageop module in Python prior to 2.5.3 allowed context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted images that trigger heap-based buffer overflows (CVE-2008-1679). This was due to an incomplete fix for CVE-2007-4965. David Remahl of Apple Product Security reported several integer overflows in a number of core modules (CVE-2008-2315). He also reported an integer overflow in the hashlib module on Python 2.5 that lead to unreliable cryptographic digest results (CVE-2008-2316). Justin Ferguson reported multiple buffer overflows in unicode string processing that affected 32bit systems (CVE-2008-3142). Multiple integer overflows were reported by the Google Security Team that had been fixed in Python 2.5.2 (CVE-2008-3143). Justin Ferguson reported a number of integer overflows and underflows in the PyOS_vsnprintf() function, as well as an off-by-one error when passing zero-length strings, that led to memory corruption (CVE-2008-3144). The updated packages have been patched to correct these issues. As well, Python packages on Mandriva Linux 2007.1 and 2008.0 have been updated to version 2.5.2. Due to slight packaging changes on Mandriva Linux 2007.1, a new package is available (tkinter-apps) that contains binary files (such as /usr/bin/idle) that were previously in the tkinter package. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1679 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2315 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2316 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3142 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3143 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3144 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.1: 3f7113a6a5d490df6f85e0c0cda33f7d 2007.1/i586/libpython2.5-2.5.2-2.2mdv2007.1.i586.rpm e549b7461f58d893ff2551817753b957 2007.1/i586/libpython2.5-devel-2.5.2-2.2mdv2007.1.i586.rpm 63e6c2850a2dfae83143af927330bead 2007.1/i586/python-2.5.2-2.2mdv2007.1.i586.rpm 09abd3cca29e9fec2fe100cb9c3b76a0 2007.1/i586/python-base-2.5.2-2.2mdv2007.1.i586.rpm 7451141640a0dc4addedd0e233de7443 2007.1/i586/python-docs-2.5.2-2.2mdv2007.1.i586.rpm eca0b6a144b5ec40371d894fd3f5529e 2007.1/i586/tkinter-2.5.2-2.2mdv2007.1.i586.rpm 119b4933f27a3b61da1d2c2903c452bb 2007.1/i586/tkinter-apps-2.5.2-2.2mdv2007.1.i586.rpm c89404feb6ef4b19e66a3d3604fe0a60 2007.1/SRPMS/python-2.5.2-2.2mdv2007.1.src.rpm Mandriva Linux 2007.1/X86_64: fd913909f1168b57905b02bd61de5a61 2007.1/x86_64/lib64python2.5-2.5.2-2.2mdv2007.1.x86_64.rpm 95f373cdcefb6eda6e04e9be2b88d0a0 2007.1/x86_64/lib64python2.5-devel-2.5.2-2.2mdv2007.1.x86_64.rpm f9e30868d33e7599bfe9e28e9eed9640 2007.1/x86_64/python-2.5.2-2.2mdv2007.1.x86_64.rpm f4bb24e89d56e2809b9a2eaa5d55492b 2007.1/x86_64/python-base-2.5.2-2.2mdv2007.1.x86_64.rpm 8a5d0198ef4c70199de88ba6a269017d 2007.1/x86_64/python-docs-2.5.2-2.2mdv2007.1.x86_64.rpm c7df1a1050d150998177b238955780d7 2007.1/x86_64/tkinter-2.5.2-2.2mdv2007.1.x86_64.rpm 07ebd022a054fe3f9635b190745dc9f7 2007.1/x86_64/tkinter-apps-2.5.2-2.2mdv2007.1.x86_64.rpm c89404feb6ef4b19e66a3d3604fe0a60 2007.1/SRPMS/python-2.5.2-2.2mdv2007.1.src.rpm Mandriva Linux 2008.0: 99f4eef4f5163f11f9067659c42f811b 2008.0/i586/libpython2.5-2.5.2-2.2mdv2008.0.i586.rpm 6f8409426cc9ed88bc8785ef4d07ed96 2008.0/i586/libpython2.5-devel-2.5.2-2.2mdv2008.0.i586.rpm fcbf1b20aec5de9a5f7f96594976e542 2008.0/i586/python-2.5.2-2.2mdv2008.0.i586.rpm e3efa64ed03f11d19785e46d66e623ea 2008.0/i586/python-base-2.5.2-2.2mdv2008.0.i586.rpm 35e89e01c2c563c4dcfd0744b34f5111 2008.0/i586/python-docs-2.5.2-2.2mdv2008.0.i586.rpm 54229dcb6cab48f55341b7b40978c67a 2008.0/i586/tkinter-2.5.2-2.2mdv2008.0.i586.rpm 0d0e64c81294dc857b3bffd20d07670d 2008.0/i586/tkinter-apps-2.5.2-2.2mdv2008.0.i586.rpm 185f9596bb1f04d6a5beadc6d2810c47 2008.0/SRPMS/python-2.5.2-2.2mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 9e64bc3895709a9979e627ecba57f5b9 2008.0/x86_64/lib64python2.5-2.5.2-2.2mdv2008.0.x86_64.rpm cbe2920e5490565b997906339f4da2ea 2008.0/x86_64/lib64python2.5-devel-2.5.2-2.2mdv2008.0.x86_64.rpm 648d967823423618d5c6f2c5a65168b9 2008.0/x86_64/python-2.5.2-2.2mdv2008.0.x86_64.rpm 0f2f499ed3bc343d9ecaa5720f424b49 2008.0/x86_64/python-base-2.5.2-2.2mdv2008.0.x86_64.rpm 35688339d010308c5913811bcbb34766 2008.0/x86_64/python-docs-2.5.2-2.2mdv2008.0.x86_64.rpm d54ab3f45ff8adad3094c215434f2f67 2008.0/x86_64/tkinter-2.5.2-2.2mdv2008.0.x86_64.rpm 83c24eab63935f9a1a7c5243de0b0561 2008.0/x86_64/tkinter-apps-2.5.2-2.2mdv2008.0.x86_64.rpm 185f9596bb1f04d6a5beadc6d2810c47 2008.0/SRPMS/python-2.5.2-2.2mdv2008.0.src.rpm Mandriva Linux 2008.1: 210e4d43dd8f86fad41940826c8d37ca 2008.1/i586/libpython2.5-2.5.2-2.2mdv2008.1.i586.rpm 555f12cf8dcb4200feac0faf0a75eb43 2008.1/i586/libpython2.5-devel-2.5.2-2.2mdv2008.1.i586.rpm 2ba6a7df13618057bcc8a9af3e67f102 2008.1/i586/python-2.5.2-2.2mdv2008.1.i586.rpm 2ab608650d4f4209442a573c77e3dc22 2008.1/i586/python-base-2.5.2-2.2mdv2008.1.i586.rpm 5ce8d1853d7a0cb460b9fc999eb2d39c 2008.1/i586/python-docs-2.5.2-2.2mdv2008.1.i586.rpm b90c8279714770b6d8c1f2fbb64cc02b 2008.1/i586/tkinter-2.5.2-2.2mdv2008.1.i586.rpm dee30de58133025857e3234c7b127488 2008.1/i586/tkinter-apps-2.5.2-2.2mdv2008.1.i586.rpm 201dd1a84310d932a9af8f71adecba52 2008.1/SRPMS/python-2.5.2-2.2mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: 1ee0a473977bbbbadb468aff7b687f98 2008.1/x86_64/lib64python2.5-2.5.2-2.2mdv2008.1.x86_64.rpm 3239b7f40e43014dd4ab804ffd6bd41b 2008.1/x86_64/lib64python2.5-devel-2.5.2-2.2mdv2008.1.x86_64.rpm 15dd487627ed7aec1c865a168e231dac 2008.1/x86_64/python-2.5.2-2.2mdv2008.1.x86_64.rpm a967cd7ef1a7359702bde99e6fb3ad62 2008.1/x86_64/python-base-2.5.2-2.2mdv2008.1.x86_64.rpm 0738899657e59356e83dedbd5af7057d 2008.1/x86_64/python-docs-2.5.2-2.2mdv2008.1.x86_64.rpm cc5fa54fcc28a977ee5172ede0059e47 2008.1/x86_64/tkinter-2.5.2-2.2mdv2008.1.x86_64.rpm 3fbb51d424beb86daaa3c55907069c86 2008.1/x86_64/tkinter-apps-2.5.2-2.2mdv2008.1.x86_64.rpm 201dd1a84310d932a9af8f71adecba52 2008.1/SRPMS/python-2.5.2-2.2mdv2008.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFIm3M8mqjQ0CJFipgRAuzeAKD0+Cp/pPYbpmZ7LDOp4lwbrbR1oACgtVRI kzgNPYafPfQCZMGkyqFN8b4= =lFBZ -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
