—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:039
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : libgadu
Date : February 18, 2014
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Updated libgadu packages fix security vulnerability:

A malicious server or man-in-the-middle could send a large value for
Content-Length and cause an integer overflow which could lead to a
buffer overflow in Gadu-Gadu HTTP parsing (CVE-2013-6487).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6487
http://advisories.mageia.org/MGASA-2014-0074.html
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
65640d78caeb724856896f6ac5f6ccbf mes5/i586/libgadu3-1.8.1-2.2mdvmes5.2.i586.rpm
23e13f92896af06860593ece27a3a2e5 mes5/i586/libgadu-devel-1.8.1-2.2mdvmes5.2.i586.rpm
2c454d07d7d9abb15fddefe39360c38a mes5/SRPMS/libgadu-1.8.1-2.2mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
4230f0fb619aeccc503dc95ac9e90798 mes5/x86_64/lib64gadu3-1.8.1-2.2mdvmes5.2.x86_64.rpm
69effc40493fd6a8d8bd9c8b6bb560ef mes5/x86_64/lib64gadu-devel-1.8.1-2.2mdvmes5.2.x86_64.rpm
2c454d07d7d9abb15fddefe39360c38a mes5/SRPMS/libgadu-1.8.1-2.2mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
16f19b3210caefdcb38653f2c8684792 mbs1/x86_64/lib64gadu3-1.11.3-1.mbs1.x86_64.rpm
9301c10131e11e8ea6ff25f3c804acec mbs1/x86_64/lib64gadu-devel-1.11.3-1.mbs1.x86_64.rpm
07ae07079d369cb322c2af5c254bdc66 mbs1/SRPMS/libgadu-1.11.3-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTAzMwmqjQ0CJFipgRAgx7AKC97Rp24wtYVDJF8WS+euFGuxn7AgCgv4Iu
vqtuOjddAPUAm08Wd2GVxBE=
=0QwI
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________