Paketname
mono
Datum
2009-12-07
Advisory ID
MDVSA-2009:322
Betroffene Versionen
2008.0 i586 , 2008.0 x86_64

Problembeschreibung

Multiple vulnerabilities has been found and corrected in mono:

IOActive Inc. found a buffer overflow in Mono.Math.BigInteger class
in Mono 1.2.5.1 and previous versions, which allows arbitrary code
execution by context-dependent attackers (CVE-2007-5197).

Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net
class libraries in Mono 2.0 and earlier allow remote attackers to
inject arbitrary web script or HTML via crafted attributes related to
(1) HtmlControl.cs (PreProcessRelativeReference), (2) HtmlForm.cs
(RenderAttributes), (3) HtmlInputButton (RenderAttributes),
(4) HtmlInputRadioButton (RenderAttributes), and (5) HtmlSelect
(RenderChildren) (CVE-2008-3422).

CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows
remote attackers to inject arbitrary HTTP headers and conduct HTTP
response splitting attacks via CRLF sequences in the query string
(CVE-2008-3906).

The XML HMAC signature system did not correctly check certain
lengths. If an attacker sent a truncated HMAC, it could bypass
authentication, leading to potential privilege escalation
(CVE-2009-0217).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The updated packages have been patched to fix these issues.

Aktualisierte Pakete

2008.0 i586

 e5c940429fe7037f4f221b9ff9b620a8  2008.0/i586/jay-1.2.5-2.1mdv2008.0.i586.rpm
 83bfd0d6029b4516368760355f9a3fae  2008.0/i586/libmono0-1.2.5-2.1mdv2008.0.i586.rpm
 c697f55883457b7c5dda12e8dedc4c23  2008.0/i586/libmono-devel-1.2.5-2.1mdv2008.0.i586.rpm
 cbd608614df82586614b206f9709de9d  2008.0/i586/mono-1.2.5-2.1mdv2008.0.i586.rpm
 8b4ef19f16d5679883d9c91417082432  2008.0/i586/mono-bytefx-data-mysql-1.2.5-2.1mdv2008.0.i586.rpm
 43b5b8085bbdebae15c5bb661f24d571  2008.0/i586/mono-data-1.2.5-2.1mdv2008.0.i586.rpm
 6589c6caed4e5bd51c1c57e2a83fa44e  2008.0/i586/mono-data-firebird-1.2.5-2.1mdv2008.0.i586.rpm
 61d214672724f684167ca8925f91eb14  2008.0/i586/mono-data-oracle-1.2.5-2.1mdv2008.0.i586.rpm
 d519b2cc63be3a76a4d93c058ef86d7e  2008.0/i586/mono-data-postgresql-1.2.5-2.1mdv2008.0.i586.rpm
 805e1400678166f533b68ad0a71463b7  2008.0/i586/mono-data-sqlite-1.2.5-2.1mdv2008.0.i586.rpm
 b63a15e023653794d41995d3428b6def  2008.0/i586/mono-data-sybase-1.2.5-2.1mdv2008.0.i586.rpm
 4a6f56fd50bcab6a8f1cbecd461b2096  2008.0/i586/mono-doc-1.2.5-2.1mdv2008.0.i586.rpm
 db36927b07892c1c3e9241685ed1eb72  2008.0/i586/mono-extras-1.2.5-2.1mdv2008.0.i586.rpm
 6d97a27aea0d59926f202830d6be327b  2008.0/i586/mono-ibm-data-db2-1.2.5-2.1mdv2008.0.i586.rpm
 c52e7a85ad7540b6972d7b1f6eb44f66  2008.0/i586/mono-jscript-1.2.5-2.1mdv2008.0.i586.rpm
 5e3266cd728afc4e0e093677bf0d6f06  2008.0/i586/mono-locale-extras-1.2.5-2.1mdv2008.0.i586.rpm
 5b535b4ad9940b60249db9f0b3248d30  2008.0/i586/mono-nunit-1.2.5-2.1mdv2008.0.i586.rpm
 e170547fede941d174523b3f7a56a77c  2008.0/i586/mono-web-1.2.5-2.1mdv2008.0.i586.rpm
 5966cfb191906c938c493e04d05ef6eb  2008.0/i586/mono-winforms-1.2.5-2.1mdv2008.0.i586.rpm 
 00960df0d4057913baeca6ee30d262f7  2008.0/SRPMS/mono-1.2.5-2.1mdv2008.0.src.rpm

2008.0 x86_64

 7bdcf980d29e32a1c3d3108ad07a05b5  2008.0/x86_64/jay-1.2.5-2.1mdv2008.0.x86_64.rpm
 dd6ba52cdb6aa3a8d9ee384622f0ab7d  2008.0/x86_64/lib64mono0-1.2.5-2.1mdv2008.0.x86_64.rpm
 2d166512a5a4fecb1512142cc3a1161c  2008.0/x86_64/lib64mono-devel-1.2.5-2.1mdv2008.0.x86_64.rpm
 a5082a80792cb6d7b50edd0313abebb4  2008.0/x86_64/mono-1.2.5-2.1mdv2008.0.x86_64.rpm
 6199637cffce64193730e1a6fa6a97e7  2008.0/x86_64/mono-bytefx-data-mysql-1.2.5-2.1mdv2008.0.x86_64.rpm
 bc9665adbb048a4c2bc1f094b46ce7e0  2008.0/x86_64/mono-data-1.2.5-2.1mdv2008.0.x86_64.rpm
 26f805cadf4af5527f65802b17649288  2008.0/x86_64/mono-data-firebird-1.2.5-2.1mdv2008.0.x86_64.rpm
 a4efe31e57602a183650084f00eef262  2008.0/x86_64/mono-data-oracle-1.2.5-2.1mdv2008.0.x86_64.rpm
 864309bb2442e9bd916e23297e092e5b  2008.0/x86_64/mono-data-postgresql-1.2.5-2.1mdv2008.0.x86_64.rpm
 55f04a44471401385ce1dc9228c6655a  2008.0/x86_64/mono-data-sqlite-1.2.5-2.1mdv2008.0.x86_64.rpm
 566e4409cfdd23f02f39b01a93eb8bc9  2008.0/x86_64/mono-data-sybase-1.2.5-2.1mdv2008.0.x86_64.rpm
 d092d711a298a5578c5e9f285cede2df  2008.0/x86_64/mono-doc-1.2.5-2.1mdv2008.0.x86_64.rpm
 7e61c5cc2a4f08e5d0654072279e6061  2008.0/x86_64/mono-extras-1.2.5-2.1mdv2008.0.x86_64.rpm
 ea7a03fd1821ee8ab48887ba5a14d555  2008.0/x86_64/mono-ibm-data-db2-1.2.5-2.1mdv2008.0.x86_64.rpm
 ca24a0f2765bdc76077659549029f2ef  2008.0/x86_64/mono-jscript-1.2.5-2.1mdv2008.0.x86_64.rpm
 e19f5600eba7bc7e12404c39bb9e9203  2008.0/x86_64/mono-locale-extras-1.2.5-2.1mdv2008.0.x86_64.rpm
 3f63d60a6b2c1a3a2a9a524496643a6d  2008.0/x86_64/mono-nunit-1.2.5-2.1mdv2008.0.x86_64.rpm
 d24d7c55ba6d5dd845b20d2d526dfa7a  2008.0/x86_64/mono-web-1.2.5-2.1mdv2008.0.x86_64.rpm
 08846051c6dc2411f9c6535d2ad9e7eb  2008.0/x86_64/mono-winforms-1.2.5-2.1mdv2008.0.x86_64.rpm 
 00960df0d4057913baeca6ee30d262f7  2008.0/SRPMS/mono-1.2.5-2.1mdv2008.0.src.rpm

Referenzen