Support / Security / Advisories / Mandriva Linux 2008.1 / MDVSA-2008:103

Package name: libid3tag
Date: 2008-05-19
Advisory ID: MDVSA-2008:103
Affected versions: 2008.0 i586 , CS3.0 x86_64 , 2008.0 x86_64 , CS3.0 i586 , 2008.1 x86_64 , 2008.1 i586

Problem description

field.c in the libid3tag 0.15.0b library allows context-dependent
attackers to cause a denial of service (CPU and memory consumption)
via an ID3_FIELD_TYPE_STRINGLIST field that ends in '\0', which
triggers an infinite loop.

The updated packages have been patched to correct this.

Updated packages

2008.0 i586

 c966d62d99a0dde1ef4459207ebf96a6  2008.0/i586/libid3tag0-0.15.1b-6.1mdv2008.0.i586.rpm
 51f789bcd85a6e5ccb06971fa2d96544  2008.0/i586/libid3tag0-devel-0.15.1b-6.1mdv2008.0.i586.rpm 
 1a386848ee38714c2fc7355ccc39f776  2008.0/SRPMS/libid3tag-0.15.1b-6.1mdv2008.0.src.rpm

CS3.0 x86_64

 03afcc9fbe978d730a7a3a5fa37ae47e  corporate/3.0/x86_64/lib64id3tag0-0.15.0b-4.1.C30mdk.x86_64.rpm
 45a71992ec286bf0ef9ce9b7cf512e15  corporate/3.0/x86_64/lib64id3tag0-devel-0.15.0b-4.1.C30mdk.x86_64.rpm 
 ac404779738ac24428e65958ded87217  corporate/3.0/SRPMS/libid3tag-0.15.0b-4.1.C30mdk.src.rpm

2008.0 x86_64

 795bb73cf042b79518d8993a64e04b83  2008.0/x86_64/lib64id3tag0-0.15.1b-6.1mdv2008.0.x86_64.rpm
 3a2d70c80c1c4b1154ca1247262b56a8  2008.0/x86_64/lib64id3tag0-devel-0.15.1b-6.1mdv2008.0.x86_64.rpm 
 1a386848ee38714c2fc7355ccc39f776  2008.0/SRPMS/libid3tag-0.15.1b-6.1mdv2008.0.src.rpm

CS3.0 i586

 8156be863b8ee32a59e80a03df6e87dc  corporate/3.0/i586/libid3tag0-0.15.0b-4.1.C30mdk.i586.rpm
 539fcb317cadf1a2d94db9625362dfdb  corporate/3.0/i586/libid3tag0-devel-0.15.0b-4.1.C30mdk.i586.rpm 
 ac404779738ac24428e65958ded87217  corporate/3.0/SRPMS/libid3tag-0.15.0b-4.1.C30mdk.src.rpm

2008.1 x86_64

 0365ff6dd6dbe7bb3ebf20c82df4b776  2008.1/x86_64/lib64id3tag0-0.15.1b-6.1mdv2008.1.x86_64.rpm
 a22bb0d4fc72df47bc4b8f23db6c99ef  2008.1/x86_64/lib64id3tag-devel-0.15.1b-6.1mdv2008.1.x86_64.rpm 
 decf32af6b9559b7adecc609c8745451  2008.1/SRPMS/libid3tag-0.15.1b-6.1mdv2008.0.src.rpm

2008.1 i586

 3f153dbaa70e9edaaff49c04d5b7e19e  2008.1/i586/libid3tag0-0.15.1b-6.1mdv2008.1.i586.rpm
 7307c0a74c1da126195bf9ce33ce2a60  2008.1/i586/libid3tag-devel-0.15.1b-6.1mdv2008.1.i586.rpm 
 decf32af6b9559b7adecc609c8745451  2008.1/SRPMS/libid3tag-0.15.1b-6.1mdv2008.0.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2109