USN-309-1: libmms vulnerability

Posted by Bob on: 07/05/2006 11:52 PM [ Print | 0 comment(s) ]

A new libmms vulnerability update is available for Ubuntu Linux. Here the announcement:

Ubuntu Security Notice USN-309-1 July 05, 2006
libmms vulnerability
CVE-2006-2200
==========================
==========================
=========

A security issue affects the following Ubuntu releases:

Ubuntu 5.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.10:
libmms0 0.1-0ubuntu1.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Several buffer overflows were found in libmms. By tricking a user into
opening a specially crafted remote multimedia stream with an
application using libmms, a remote attacker could overwrite an
arbitrary memory portion with zeros, thereby crashing the program.

In Ubuntu 5.10, this affects the GStreamer MMS plugin
(gstreamer0.8-mms). Other Ubuntu releases do not support this library.

Updated packages for Ubuntu 5.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms_0.1-0ubu=
ntu1.1.diff.gz
Size/MD5: 4933 76da674c4ce46f604acb09b473f72f1d
http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms_0.1-0ubu=
ntu1.1.dsc
Size/MD5: 607 3f7b2613ed4bda8a5d943141aa85d2d5
http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms_0.1.orig=
.tar.gz
Size/MD5: 317089 ebd88537af9875265e41ee65603ecd1a

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms-dev_0.1-=
0ubuntu1.1_amd64.deb
Size/MD5: 19656 5f4757ce0808238ce09df147b0a16251
http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms0_0.1-0ub=
untu1.1_amd64.deb
Size/MD5: 16042 bd2e57f384bad19a121b3d93c6ff7ec8

i386 architecture (x86 compatible Intel/AMD)

http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms-dev_0.1-=
0ubuntu1.1_i386.deb
Size/MD5: 18078 30ea92c953e77a62cea90060c5ffe195
http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms0_0.1-0ub=
untu1.1_i386.deb
Size/MD5: 14840 645668e9bf1b15cd3e7993bc8e66c6bd

powerpc architecture (Apple Macintosh G3/G4/G5)

http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms-dev_0.1-=
0ubuntu1.1_powerpc.deb
Size/MD5: 20206 ee2b12725fcaaaae1f2eb94a4fbf6e10
http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms0_0.1-0ub=
untu1.1_powerpc.deb
Size/MD5: 17700 013e1564d0aa094eddf28ae0723e264b

sparc architecture (Sun SPARC/UltraSPARC)

http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms-dev_0.1-=
0ubuntu1.1_sparc.deb
Size/MD5: 19894 b0e5d23a750dad2a0e2fa528e4ba9e02
http://security.ubuntu.com/ubuntu/pool/main/libm/libmms/libmms0_0.1-0ub=
untu1.1_sparc.deb
Size/MD5: 16176 3246a55286c83b1ff2b3a6fc47ee4241

--ZfOjI3PrQbgiZnxM
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFErD1ODecnbV4Fd/IRAkgfAJ9qUmCLe8XP0EVmJskwC/0VC0s4SQCg80rY
bK9qXHCW/mCYlOgYGoHbXms=
=pLIN
-----END PGP SIGNATURE-----