—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:073
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : file
Date : April 9, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated file packages fix security vulnerabilities:

The BEGIN regular expression in the awk script detector in
magic/Magdir/commands in file before 5.15 uses multiple wildcards
with unlimited repetitions, which allows context-dependent attackers
to cause a denial of service (CPU consumption) via a crafted ASCII
file that triggers a large amount of backtracking, as demonstrated
via a file with many newline characters (CVE-2013-7345).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7345
http://advisories.mageia.org/MGASA-2014-0142.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
4b4561e9f1573586faf3e776a8f4fe74 mbs1/x86_64/file-5.12-1.1.mbs1.x86_64.rpm
a0fe4f9fdc9139483ff2646c457457d0 mbs1/x86_64/lib64magic1-5.12-1.1.mbs1.x86_64.rpm
23d2709d6591a1bf152803f31435d36a mbs1/x86_64/lib64magic-devel-5.12-1.1.mbs1.x86_64.rpm
69dc8737c1c20341a2f062ee382cfdf1 mbs1/x86_64/lib64magic-static-devel-5.12-1.1.mbs1.x86_64.rpm
b73482de9b5c0d944c558ac4db1f26f9 mbs1/x86_64/python-magic-5.12-1.1.mbs1.noarch.rpm
436b242b459fa885153668f6cae2056f mbs1/SRPMS/file-5.12-1.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTRUPamqjQ0CJFipgRAlI1AKDbGsuPUDuBLEObQHXwP7OpO0jHhgCfYGrn
YRR4xBW2cZ0XFAUpzAV8yz0=
=UhvO
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________