full-disclosure-uk January 2010 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: [Full-disclosure] [ MDVSA-2010:010 ] libthai

[Full-disclosure] [ MDVSA-2010:010 ] libthai

From: <security_at_nospam>
Date: Sat Jan 16 2010 - 18:39:00 GMT
To: full-disclosure@lists.grok.org.uk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2010:010  http://www.mandriva.com/security/
Package : libthai Date : January 16, 2010 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Enterprise Server 5.0
_______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in libthai:  

 Tim Starling discovered that libthai, a set of Thai language support  routines, is vulnerable of integer/heap overflow. This vulnerability  could allow an attacker to run arbitrary code by sending a very long  string (CVE-2009-4012).  

 Packages for 2008.0 are provided for Corporate Desktop 2008.0  customers.  

 The updated packages have been patched to correct these issues.


 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4012


 Updated Packages:

 Mandriva Linux 2008.0: 39f2a5152fa1a24e61b44e3d3457b510 2008.0/i586/libthai0-0.1.9-3.1mdv2008.0.i586.rpm 668b0599c98e9276276e40288f52e7f6 2008.0/i586/libthai-devel-0.1.9-3.1mdv2008.0.i586.rpm e76932108fd20cbfed5b1cd604ac8d3f 2008.0/i586/thai-data-0.1.9-3.1mdv2008.0.i586.rpm 280dc7e1d2c4bef4b0570cc75b2a0fe5 2008.0/SRPMS/libthai-0.1.9-3.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64: 6a916d184752f18ad6e1653f60ef3b8b 2008.0/x86_64/lib64thai0-0.1.9-3.1mdv2008.0.x86_64.rpm b2c32c7291bac1d7ba16054ccf61b1d5 2008.0/x86_64/lib64thai-devel-0.1.9-3.1mdv2008.0.x86_64.rpm 01b4a1988713860149b8b0a7123e449e 2008.0/x86_64/thai-data-0.1.9-3.1mdv2008.0.x86_64.rpm 280dc7e1d2c4bef4b0570cc75b2a0fe5 2008.0/SRPMS/libthai-0.1.9-3.1mdv2008.0.src.rpm

 Mandriva Linux 2009.0: 267484277b5d45549f2cea9f1f7e8c47 2009.0/i586/libthai0-0.1.9-7.1mdv2009.0.i586.rpm a452e05c9fed0a0c5b78eb2e4ee1116f 2009.0/i586/libthai-devel-0.1.9-7.1mdv2009.0.i586.rpm 990e5e25dfa94ff7337c9afac5638f55 2009.0/i586/thai-data-0.1.9-7.1mdv2009.0.i586.rpm f0eca7369c6fcc3470a0cb731199b213 2009.0/SRPMS/libthai-0.1.9-7.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64: 00a932b3b0c47dfb9a7bd6182faf5ccf 2009.0/x86_64/lib64thai0-0.1.9-7.1mdv2009.0.x86_64.rpm 18e91e2868d69065686100a28ad5245c 2009.0/x86_64/lib64thai-devel-0.1.9-7.1mdv2009.0.x86_64.rpm e6399cd45aea4759e43b754481989b3c 2009.0/x86_64/thai-data-0.1.9-7.1mdv2009.0.x86_64.rpm f0eca7369c6fcc3470a0cb731199b213 2009.0/SRPMS/libthai-0.1.9-7.1mdv2009.0.src.rpm

 Mandriva Linux 2009.1: 5a3d827f4163a4fb6ad32844d3e48ee7 2009.1/i586/libthai0-0.1.9-7.1mdv2009.1.i586.rpm 1ce758f78a981035d519c2271ae4dc57 2009.1/i586/libthai-devel-0.1.9-7.1mdv2009.1.i586.rpm 6316a2ec579ed0a47f9685e81e39ae0e 2009.1/i586/thai-data-0.1.9-7.1mdv2009.1.i586.rpm 04f1d7876194ccd6c60b6d5172f5f75b 2009.1/SRPMS/libthai-0.1.9-7.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64: 58576cc35c244938a016c0b1b960e470 2009.1/x86_64/lib64thai0-0.1.9-7.1mdv2009.1.x86_64.rpm 8594f489e881e44563d0b4cae4bb750a 2009.1/x86_64/lib64thai-devel-0.1.9-7.1mdv2009.1.x86_64.rpm beacf0f81e20a1e2ee62a1b50359c8f3 2009.1/x86_64/thai-data-0.1.9-7.1mdv2009.1.x86_64.rpm 04f1d7876194ccd6c60b6d5172f5f75b 2009.1/SRPMS/libthai-0.1.9-7.1mdv2009.1.src.rpm

 Mandriva Linux 2010.0: 7fd54b41bd433d389cd59ea8ec5cb173 2010.0/i586/libthai0-0.1.12-1.1mdv2010.0.i586.rpm a8aaf23e6d18970c370213c153cfd2bc 2010.0/i586/libthai-devel-0.1.12-1.1mdv2010.0.i586.rpm e536c09d71c741b4d049739ecb505e92 2010.0/i586/thai-data-0.1.12-1.1mdv2010.0.i586.rpm 6458f44615eae24d0fc3c5bd927b9d18 2010.0/SRPMS/libthai-0.1.12-1.1mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64: 8b491ac2da204f6c7c2de6b2bf36bb51 2010.0/x86_64/lib64thai0-0.1.12-1.1mdv2010.0.x86_64.rpm 84170ddf9a4e60f268f22f63f5e74f1b 2010.0/x86_64/lib64thai-devel-0.1.12-1.1mdv2010.0.x86_64.rpm af1ad9b477584e08d4704f6d14ba9ac2 2010.0/x86_64/thai-data-0.1.12-1.1mdv2010.0.x86_64.rpm 6458f44615eae24d0fc3c5bd927b9d18 2010.0/SRPMS/libthai-0.1.12-1.1mdv2010.0.src.rpm

 Mandriva Enterprise Server 5: 21ddb50029b70668887b69d507b73d43 mes5/i586/libthai0-0.1.9-7.1mdvmes5.i586.rpm aea0d9de14b4ff8fa3dc3e7f012a20cb mes5/i586/libthai-devel-0.1.9-7.1mdvmes5.i586.rpm 2ce60260dad17cb053829d792e405438 mes5/i586/thai-data-0.1.9-7.1mdvmes5.i586.rpm a2ed4567812490c59dbc04419d8cb9e1 mes5/SRPMS/libthai-0.1.9-7.1mdvmes5.src.rpm

 Mandriva Enterprise Server 5/X86_64: 9b4a9aed337bb0261f3b9658214452f4 mes5/x86_64/lib64thai0-0.1.9-7.1mdvmes5.x86_64.rpm 23154601bc0d50d6cb7d552e1a72b468 mes5/x86_64/lib64thai-devel-0.1.9-7.1mdvmes5.x86_64.rpm 1423bdd32a12965d140785313ebc73be mes5/x86_64/thai-data-0.1.9-7.1mdvmes5.x86_64.rpm a2ed4567812490c59dbc04419d8cb9e1 mes5/SRPMS/libthai-0.1.9-7.1mdvmes5.src.rpm
_______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi. The verification  of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security. You can obtain the  GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com


 Type Bits/KeyID Date User ID
 pub 1024D/22458A98 2000-07-10 Mandriva Security Team   <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLUdkimqjQ0CJFipgRAsAGAKD0P+rDjLcoQ/LHn3uWG74WYJrxZgCdEVWc EjSXLG9kOIMOyzbhe7dsMBQ=
=o8VG
-----END PGP SIGNATURE-----



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/