[Full-disclosure] [ MDVSA-2010:010 ] libthai




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2010:010
http://www.mandriva.com/security/
_______________________________________________________________________

Package : libthai
Date : January 16, 2010
Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been found and corrected in libthai:

Tim Starling discovered that libthai, a set of Thai language support
routines, is vulnerable of integer/heap overflow. This vulnerability
could allow an attacker to run arbitrary code by sending a very long
string (CVE-2009-4012).

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4012
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2008.0:
39f2a5152fa1a24e61b44e3d3457b510 2008.0/i586/libthai0-0.1.9-3.1mdv2008.0.i586.rpm
668b0599c98e9276276e40288f52e7f6 2008.0/i586/libthai-devel-0.1.9-3.1mdv2008.0.i586.rpm
e76932108fd20cbfed5b1cd604ac8d3f 2008.0/i586/thai-data-0.1.9-3.1mdv2008.0.i586.rpm
280dc7e1d2c4bef4b0570cc75b2a0fe5 2008.0/SRPMS/libthai-0.1.9-3.1mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
6a916d184752f18ad6e1653f60ef3b8b 2008.0/x86_64/lib64thai0-0.1.9-3.1mdv2008.0.x86_64.rpm
b2c32c7291bac1d7ba16054ccf61b1d5 2008.0/x86_64/lib64thai-devel-0.1.9-3.1mdv2008.0.x86_64.rpm
01b4a1988713860149b8b0a7123e449e 2008.0/x86_64/thai-data-0.1.9-3.1mdv2008.0.x86_64.rpm
280dc7e1d2c4bef4b0570cc75b2a0fe5 2008.0/SRPMS/libthai-0.1.9-3.1mdv2008.0.src.rpm

Mandriva Linux 2009.0:
267484277b5d45549f2cea9f1f7e8c47 2009.0/i586/libthai0-0.1.9-7.1mdv2009.0.i586.rpm
a452e05c9fed0a0c5b78eb2e4ee1116f 2009.0/i586/libthai-devel-0.1.9-7.1mdv2009.0.i586.rpm
990e5e25dfa94ff7337c9afac5638f55 2009.0/i586/thai-data-0.1.9-7.1mdv2009.0.i586.rpm
f0eca7369c6fcc3470a0cb731199b213 2009.0/SRPMS/libthai-0.1.9-7.1mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
00a932b3b0c47dfb9a7bd6182faf5ccf 2009.0/x86_64/lib64thai0-0.1.9-7.1mdv2009.0.x86_64.rpm
18e91e2868d69065686100a28ad5245c 2009.0/x86_64/lib64thai-devel-0.1.9-7.1mdv2009.0.x86_64.rpm
e6399cd45aea4759e43b754481989b3c 2009.0/x86_64/thai-data-0.1.9-7.1mdv2009.0.x86_64.rpm
f0eca7369c6fcc3470a0cb731199b213 2009.0/SRPMS/libthai-0.1.9-7.1mdv2009.0.src.rpm

Mandriva Linux 2009.1:
5a3d827f4163a4fb6ad32844d3e48ee7 2009.1/i586/libthai0-0.1.9-7.1mdv2009.1.i586.rpm
1ce758f78a981035d519c2271ae4dc57 2009.1/i586/libthai-devel-0.1.9-7.1mdv2009.1.i586.rpm
6316a2ec579ed0a47f9685e81e39ae0e 2009.1/i586/thai-data-0.1.9-7.1mdv2009.1.i586.rpm
04f1d7876194ccd6c60b6d5172f5f75b 2009.1/SRPMS/libthai-0.1.9-7.1mdv2009.1.src.rpm

Mandriva Linux 2009.1/X86_64:
58576cc35c244938a016c0b1b960e470 2009.1/x86_64/lib64thai0-0.1.9-7.1mdv2009.1.x86_64.rpm
8594f489e881e44563d0b4cae4bb750a 2009.1/x86_64/lib64thai-devel-0.1.9-7.1mdv2009.1.x86_64.rpm
beacf0f81e20a1e2ee62a1b50359c8f3 2009.1/x86_64/thai-data-0.1.9-7.1mdv2009.1.x86_64.rpm
04f1d7876194ccd6c60b6d5172f5f75b 2009.1/SRPMS/libthai-0.1.9-7.1mdv2009.1.src.rpm

Mandriva Linux 2010.0:
7fd54b41bd433d389cd59ea8ec5cb173 2010.0/i586/libthai0-0.1.12-1.1mdv2010.0.i586.rpm
a8aaf23e6d18970c370213c153cfd2bc 2010.0/i586/libthai-devel-0.1.12-1.1mdv2010.0.i586.rpm
e536c09d71c741b4d049739ecb505e92 2010.0/i586/thai-data-0.1.12-1.1mdv2010.0.i586.rpm
6458f44615eae24d0fc3c5bd927b9d18 2010.0/SRPMS/libthai-0.1.12-1.1mdv2010.0.src.rpm

Mandriva Linux 2010.0/X86_64:
8b491ac2da204f6c7c2de6b2bf36bb51 2010.0/x86_64/lib64thai0-0.1.12-1.1mdv2010.0.x86_64.rpm
84170ddf9a4e60f268f22f63f5e74f1b 2010.0/x86_64/lib64thai-devel-0.1.12-1.1mdv2010.0.x86_64.rpm
af1ad9b477584e08d4704f6d14ba9ac2 2010.0/x86_64/thai-data-0.1.12-1.1mdv2010.0.x86_64.rpm
6458f44615eae24d0fc3c5bd927b9d18 2010.0/SRPMS/libthai-0.1.12-1.1mdv2010.0.src.rpm

Mandriva Enterprise Server 5:
21ddb50029b70668887b69d507b73d43 mes5/i586/libthai0-0.1.9-7.1mdvmes5.i586.rpm
aea0d9de14b4ff8fa3dc3e7f012a20cb mes5/i586/libthai-devel-0.1.9-7.1mdvmes5.i586.rpm
2ce60260dad17cb053829d792e405438 mes5/i586/thai-data-0.1.9-7.1mdvmes5.i586.rpm
a2ed4567812490c59dbc04419d8cb9e1 mes5/SRPMS/libthai-0.1.9-7.1mdvmes5.src.rpm

Mandriva Enterprise Server 5/X86_64:
9b4a9aed337bb0261f3b9658214452f4 mes5/x86_64/lib64thai0-0.1.9-7.1mdvmes5.x86_64.rpm
23154601bc0d50d6cb7d552e1a72b468 mes5/x86_64/lib64thai-devel-0.1.9-7.1mdvmes5.x86_64.rpm
1423bdd32a12965d140785313ebc73be mes5/x86_64/thai-data-0.1.9-7.1mdvmes5.x86_64.rpm
a2ed4567812490c59dbc04419d8cb9e1 mes5/SRPMS/libthai-0.1.9-7.1mdvmes5.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLUdkimqjQ0CJFipgRAsAGAKD0P+rDjLcoQ/LHn3uWG74WYJrxZgCdEVWc
EjSXLG9kOIMOyzbhe7dsMBQ=
=o8VG
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • [Full-disclosure] [ MDVSA-2011:027 ] openoffice.org
    ... Multiple directory traversal vulnerabilities allow remote attackers ... OpenOffice.org packages have been updated in order to fix these ... Mandriva Linux 2009.0/X86_64: ...
    (Full-Disclosure)
  • [ MDVSA-2011:027 ] openoffice.org
    ... Multiple directory traversal vulnerabilities allow remote attackers ... OpenOffice.org packages have been updated in order to fix these ... Mandriva Linux 2009.0/X86_64: ...
    (Bugtraq)
  • [Full-disclosure] [ MDVSA-2011:031 ] python-django
    ... Multiple vulnerabilities has been found and corrected in python-django: ... and 1.2.x before 1.2.5 might allow remote attackers to inject ... Updated Packages: ... Mandriva Linux 2010.0/X86_64: ...
    (Full-Disclosure)
  • [ MDVSA-2011:031 ] python-django
    ... Multiple vulnerabilities has been found and corrected in python-django: ... and 1.2.x before 1.2.5 might allow remote attackers to inject ... Updated Packages: ... Mandriva Linux 2010.0/X86_64: ...
    (Bugtraq)
  • [Full-disclosure] [ MDVSA-2008:101 ] - Updated rdesktop packages fix vulnerabilities
    ... Several vulnerabilities were discovered in rdesktop, ... code with the privileges of the logged-in user. ... The updated packages have been patched to correct these issues. ... Mandriva Linux 2007.1/X86_64: ...
    (Full-Disclosure)