|
|
| Problem Description |
The update to correct CVE-2007-1536 (MDKSA-2007:067), a buffer overflow
in the file_printf() function, introduced a new integer overflow as
reported by Colin Percival. This flaw, if an atacker could trick a
user into running file on a specially crafted file, could possibly
lead to the execution of arbitrary code with the privileges of the
user running file (CVE-2007-2799).
As well, in file 4.20, flawed regular expressions to identify OS/2
REXX files could lead to a denial of service via CPU consumption
(CVE-2007-2026).
The updated packages have been patched to correct these issues.
| Updated Packages |
Corporate Server 3.0
1df48d0c9911aa0bb1ffd7cd6541841a corporate/3.0/i586/file-4.07-3.2.C30mdk.i586.rpm a874520fc37514088e859482cecc1e74 corporate/3.0/i586/libmagic1-4.07-3.2.C30mdk.i586.rpm 45f463521c4a48a6fe5a94af29c0bf08 corporate/3.0/i586/libmagic1-devel-4.07-3.2.C30mdk.i586.rpm 8d2c8f7eafc9a606913c0d4ec5e4398c corporate/3.0/i586/libmagic1-static-devel-4.07-3.2.C30mdk.i586.rpm f3f6d9560bd1ef14795abec51391e776 corporate/3.0/SRPMS/file-4.07-3.2.C30mdk.src.rpm
Corporate Server 3.0/X86_64
554baaf5942ac5e533e72812394fc6ec corporate/3.0/x86_64/file-4.07-3.2.C30mdk.x86_64.rpm 5880184431f8918886543337a43f19d5 corporate/3.0/x86_64/lib64magic1-4.07-3.2.C30mdk.x86_64.rpm a1c8b2cd7a721e1429f3a4cd855b0235 corporate/3.0/x86_64/lib64magic1-devel-4.07-3.2.C30mdk.x86_64.rpm b56eba4a34a18ea5df00a1bfbd103b91 corporate/3.0/x86_64/lib64magic1-static-devel-4.07-3.2.C30mdk.x86_64.rpm f3f6d9560bd1ef14795abec51391e776 corporate/3.0/SRPMS/file-4.07-3.2.C30mdk.src.rpm
Multi Network Firewall 2.0
9186aca370a3692ac9552e43e4eecc9f mnf/2.0/i586/file-4.07-3.2.M20mdk.i586.rpm 595a5d6433d2adbcb068de6c8076411b mnf/2.0/i586/libmagic1-4.07-3.2.M20mdk.i586.rpm 2197334faacdf1e24067cd02e8dec993 mnf/2.0/SRPMS/file-4.07-3.2.M20mdk.src.rpm
Mandriva Linux 2007
3da3923de6da550bab34801eef616c65 2007.0/i586/file-4.17-2.2mdv2007.0.i586.rpm cdda9efd3b6b29b3bd959c27b9b4ff45 2007.0/i586/libmagic1-4.17-2.2mdv2007.0.i586.rpm 7a7639ae8578d60800a3606ea7846046 2007.0/i586/libmagic1-devel-4.17-2.2mdv2007.0.i586.rpm b88d355059a7abaa684ca4ccd2902f5e 2007.0/i586/libmagic1-static-devel-4.17-2.2mdv2007.0.i586.rpm 8be4b2fc01aae6687cea3d32bf13adec 2007.0/i586/python-magic-4.17-2.2mdv2007.0.i586.rpm 0faac11bd3ceb07623dcc538259b4920 2007.0/SRPMS/file-4.17-2.2mdv2007.0.src.rpm
Mandriva Linux 2007/X86_64
7b236e74e29e7322a63db012508f4ff7 2007.0/x86_64/file-4.17-2.2mdv2007.0.x86_64.rpm c9ee191afb3c4f13989aecc4c0550a64 2007.0/x86_64/lib64magic1-4.17-2.2mdv2007.0.x86_64.rpm 895f9822301c950fa52b34a8f1e6458d 2007.0/x86_64/lib64magic1-devel-4.17-2.2mdv2007.0.x86_64.rpm a667f8207f61a7407ad3434e779cd2a3 2007.0/x86_64/lib64magic1-static-devel-4.17-2.2mdv2007.0.x86_64.rpm 87b499c21853acc87c968c6a24a5f0d4 2007.0/x86_64/python-magic-4.17-2.2mdv2007.0.x86_64.rpm 0faac11bd3ceb07623dcc538259b4920 2007.0/SRPMS/file-4.17-2.2mdv2007.0.src.rpm
Corporate Server 4.0
0a2f24f69b886df7c5439dd4726bae7a corporate/4.0/i586/file-4.14-2.3.20060mlcs4.i586.rpm cf7484c68d78b2888290ed83ca69b2f7 corporate/4.0/i586/libmagic1-4.14-2.3.20060mlcs4.i586.rpm 4f71702b0528d8cb8f3a999043a37b60 corporate/4.0/i586/libmagic1-devel-4.14-2.3.20060mlcs4.i586.rpm 05d475851788a7e2c1e2ff0ae1bf783e corporate/4.0/i586/libmagic1-static-devel-4.14-2.3.20060mlcs4.i586.rpm f23dc6744da226429ea647881c10e253 corporate/4.0/SRPMS/file-4.14-2.3.20060mlcs4.src.rpm
Corporate Server 4.0/X86_64
60519ec0a662cfd9501527b1476595d7 corporate/4.0/x86_64/file-4.14-2.3.20060mlcs4.x86_64.rpm 96b1ce3bf2e2b45ff51ab6c83f9e41c8 corporate/4.0/x86_64/lib64magic1-4.14-2.3.20060mlcs4.x86_64.rpm 5d167574eb45cdea383ce87ea933fa9e corporate/4.0/x86_64/lib64magic1-devel-4.14-2.3.20060mlcs4.x86_64.rpm bb4bba87454e9c9d098e68ededde68af corporate/4.0/x86_64/lib64magic1-static-devel-4.14-2.3.20060mlcs4.x86_64.rpm f23dc6744da226429ea647881c10e253 corporate/4.0/SRPMS/file-4.14-2.3.20060mlcs4.src.rpm
Mandriva Linux 2007.1
0f340f48900656e4d393c26f41cfd24a 2007.1/i586/file-4.20-1.1mdv2007.1.i586.rpm d690cf39a2b9d4bce78eb3ba76f89034 2007.1/i586/libmagic1-4.20-1.1mdv2007.1.i586.rpm adf38bdec1118a46cbc8063cd1c87bfd 2007.1/i586/libmagic1-devel-4.20-1.1mdv2007.1.i586.rpm 7f650e75b6bcbfee83f356e6a39f5d8b 2007.1/i586/libmagic1-static-devel-4.20-1.1mdv2007.1.i586.rpm d5556e8963b4f8e3750a8c2b4844f3cb 2007.1/i586/python-magic-4.20-1.1mdv2007.1.i586.rpm 4335066ac789ab04b344be24e80f26c7 2007.1/SRPMS/file-4.20-1.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64
649ff715c11ed4de3233ac50f1cf0773 2007.1/x86_64/file-4.20-1.1mdv2007.1.x86_64.rpm a5c7e2604290b2523288614191ecb153 2007.1/x86_64/lib64magic1-4.20-1.1mdv2007.1.x86_64.rpm 239042ad851510f9e66e3c03067e3129 2007.1/x86_64/lib64magic1-devel-4.20-1.1mdv2007.1.x86_64.rpm a8597d9708ea995c85ae640b468ed43a 2007.1/x86_64/lib64magic1-static-devel-4.20-1.1mdv2007.1.x86_64.rpm f13b9cb6c65c4247a66a18b32f02a253 2007.1/x86_64/python-magic-4.20-1.1mdv2007.1.x86_64.rpm 4335066ac789ab04b344be24e80f26c7 2007.1/SRPMS/file-4.20-1.1mdv2007.1.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2026
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2799
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.