sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] SECURITY UPDATE for utils/file

From: Seth Alan Woolley <seth AT positivism.org>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] SECURITY UPDATE for utils/file
Date: Wed, 15 Dec 2004 12:25:32 -0800

ELF file parsing has a buffer overflow. file is used before md5sum
checking of source files in sorcery, so MITM attacks on all sorcery
installs are possible with versions of file < 4.12

Updated in devel/test earlier. This alert notes the release to stable
grimoire has been made.

The following files are attached for spell utils/file:
BUILD
DEPENDS
DETAILS
HISTORY
INSTALL
PRE_BUILD
zisofs.patch

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A
Security Team Leader Source Mage GNU/Linux http://www.sourcemage.org

Attachment: securityupdate.10178.tar.bz2
Description: Binary data

Attachment: pgpJR8Tl9oJFi.pgp
Description: PGP signature

[SM-Security] SECURITY UPDATE for utils/file, Seth Alan Woolley, 12/15/2004