Home / vulnerabilities MDVSA-2008-160.txt
Posted on 01 August 2008
Source : packetstormsecurity.org Link
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:160
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libxslt
Date : August 1, 2008
Affected: 2007.1, 2008.0, 2008.1, Corporate 4.0
_______________________________________________________________________
Problem Description:
Chris Evans of the Google Security Team found a vulnerability in the
RC4 processing code in libxslt that did not properly handle corrupted
key information. A remote attacker able to make an application
linked against libxslt process malicious XML input could cause the
application to crash or possibly execute arbitrary code with the
privileges of the application in question (CVE-2008-2935).
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2935
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.1:
9582b6a5a85d8a4fde0be6113565cd9d 2007.1/i586/libxslt1-1.1.20-2.2mdv2007.1.i586.rpm
5205ec749db53b73cbec782d507686df 2007.1/i586/libxslt1-devel-1.1.20-2.2mdv2007.1.i586.rpm
64a810f8ac91b49c80c38e33f2750f85 2007.1/i586/libxslt-proc-1.1.20-2.2mdv2007.1.i586.rpm
bb9f876808ec910122977f7166112245 2007.1/i586/python-libxslt-1.1.20-2.2mdv2007.1.i586.rpm
fa2168576c9baedb55b2577f913fbdec 2007.1/SRPMS/libxslt-1.1.20-2.2mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
1bd1a4df038c3c4a5b753537854afd17 2007.1/x86_64/lib64xslt1-1.1.20-2.2mdv2007.1.x86_64.rpm
aaecaefb1c25c1838199058ffbec4bf9 2007.1/x86_64/lib64xslt1-devel-1.1.20-2.2mdv2007.1.x86_64.rpm
e39afe30c9f38113fde7e1fd060de05b 2007.1/x86_64/libxslt-proc-1.1.20-2.2mdv2007.1.x86_64.rpm
dfa8806c560c888f225b557622f3e10c 2007.1/x86_64/python-libxslt-1.1.20-2.2mdv2007.1.x86_64.rpm
fa2168576c9baedb55b2577f913fbdec 2007.1/SRPMS/libxslt-1.1.20-2.2mdv2007.1.src.rpm
Mandriva Linux 2008.0:
01d8d7608c3c74e8aa862f79907e07cc 2008.0/i586/libxslt1-1.1.22-2.2mdv2008.0.i586.rpm
4da832fd851d55b48b80341d7c3bc4ee 2008.0/i586/libxslt-devel-1.1.22-2.2mdv2008.0.i586.rpm
58e5f582472d1e28dce386c2bd5d9de4 2008.0/i586/libxslt-proc-1.1.22-2.2mdv2008.0.i586.rpm
74141e240b0e2a3b19790cb9addc0151 2008.0/i586/python-libxslt-1.1.22-2.2mdv2008.0.i586.rpm
85c0d64608fb55944316a2ac46096d13 2008.0/SRPMS/libxslt-1.1.22-2.2mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
7ff6d48c755e2907846f9a6b6378b5b9 2008.0/x86_64/lib64xslt1-1.1.22-2.2mdv2008.0.x86_64.rpm
f026cc563722e6847d58b0e1e6f0f6ce 2008.0/x86_64/lib64xslt-devel-1.1.22-2.2mdv2008.0.x86_64.rpm
bc530cb61a211a50155c59c52de543c3 2008.0/x86_64/libxslt-proc-1.1.22-2.2mdv2008.0.x86_64.rpm
458c1d9d588b4a3a435eb26dcf23e2f5 2008.0/x86_64/python-libxslt-1.1.22-2.2mdv2008.0.x86_64.rpm
85c0d64608fb55944316a2ac46096d13 2008.0/SRPMS/libxslt-1.1.22-2.2mdv2008.0.src.rpm
Mandriva Linux 2008.1:
c8cab87e462864b9d575613630500965 2008.1/i586/libxslt1-1.1.22-2.2mdv2008.1.i586.rpm
2fb2120f868e093a73c766537eca4c4c 2008.1/i586/libxslt-devel-1.1.22-2.2mdv2008.1.i586.rpm
c9322ae81ff3e2bcbadef36a1d3f29ec 2008.1/i586/libxslt-proc-1.1.22-2.2mdv2008.1.i586.rpm
fa11c933fa71ffe7dffd869454809523 2008.1/i586/python-libxslt-1.1.22-2.2mdv2008.1.i586.rpm
126fa9767b486afdddd09ead4b9f5841 2008.1/SRPMS/libxslt-1.1.22-2.2mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
d7eeca6bfa273ff8d3995144272825e8 2008.1/x86_64/lib64xslt1-1.1.22-2.2mdv2008.1.x86_64.rpm
cf74a4e8440e324e776d00162784da57 2008.1/x86_64/lib64xslt-devel-1.1.22-2.2mdv2008.1.x86_64.rpm
b6ff1bbf9fc5c56421b4cd2c60515c21 2008.1/x86_64/libxslt-proc-1.1.22-2.2mdv2008.1.x86_64.rpm
9507d84c1b2338ac8a06a76efd9cd94d 2008.1/x86_64/python-libxslt-1.1.22-2.2mdv2008.1.x86_64.rpm
126fa9767b486afdddd09ead4b9f5841 2008.1/SRPMS/libxslt-1.1.22-2.2mdv2008.1.src.rpm
Corporate 4.0:
6fddddda1818a68ea24d52e6e181f095 corporate/4.0/i586/libxslt1-1.1.15-1.2.20060mlcs4.i586.rpm
1679fdbdfb7020be4622fae157a2a2b5 corporate/4.0/i586/libxslt1-devel-1.1.15-1.2.20060mlcs4.i586.rpm
3a030cdd0fbadaf26b4871d371fe6f54 corporate/4.0/i586/libxslt-proc-1.1.15-1.2.20060mlcs4.i586.rpm
ecaa9e0beff76328b236a87870274b1d corporate/4.0/i586/libxslt-python-1.1.15-1.2.20060mlcs4.i586.rpm
bf4154eaf3cff4b487a71c9f9edcb60c corporate/4.0/SRPMS/libxslt-1.1.15-1.2.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
953ce3b7b6f9f5be7c2a24d2aef92bbe corporate/4.0/x86_64/lib64xslt1-1.1.15-1.2.20060mlcs4.x86_64.rpm
4ae0c85ebc4d13552b6db13a2067dea4 corporate/4.0/x86_64/lib64xslt1-devel-1.1.15-1.2.20060mlcs4.x86_64.rpm
65d3b3a21d5165b0eb256db4c57d946d corporate/4.0/x86_64/libxslt-proc-1.1.15-1.2.20060mlcs4.x86_64.rpm
645272c4f3c51b3e28a19ff14be17a36 corporate/4.0/x86_64/libxslt-python-1.1.15-1.2.20060mlcs4.x86_64.rpm
bf4154eaf3cff4b487a71c9f9edcb60c corporate/4.0/SRPMS/libxslt-1.1.15-1.2.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFIk0h+mqjQ0CJFipgRAh4bAJ0ZFnPrAmi0ZCs+VmIS3FNbrVq6BQCgmZDa
daQ2pWT0o/xjJuwNSVBtcSI=
=YYmK
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
