sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities]

From: Thomas Houssin <thomas.houssin AT gmail.com>
To: Andrew <afrayedknot AT thefrayedknot.armory.com>
Cc: sm-security AT lists.ibiblio.org
Subject: Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities]
Date: Thu, 21 Apr 2005 23:59:14 +0200

Andrew wrote:
> Not sure if we got this or not, forwarding anyway.
>
>
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> Gentoo Linux Security Advisory GLSA 200504-17
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> http://security.gentoo.org/
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>
> Severity: Normal
> Title: XV: Multiple vulnerabilities
> Date: April 19, 2005
> Bugs: #88742
> ID: 200504-17
>
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>
> Synopsis
> ========
>
> Multiple vulnerabilities have been discovered in XV, potentially
> resulting in the execution of arbitrary code.
>
> Background
> ==========
>
> XV is an interactive image manipulation program for the X Window
> System.
>
> Affected packages
> =================
>
> -------------------------------------------------------------------
> Package / Vulnerable / Unaffected
> -------------------------------------------------------------------
> 1 media-gfx/xv < 3.10a-r11 >= 3.10a-r11
>

Apparently some places needs to be fixed.
Is this ok to use the jumbo patches
http://www.sonic.net/~roelofs/greg_xv.html) instead of the megapatch we
use ?

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature

[SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Andrew, 04/21/2005
- Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Thomas Houssin, 04/21/2005
  - Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Seth Alan Woolley, 04/21/2005
    - Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Thomas Houssin, 04/21/2005
      - Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Thomas Houssin, 04/22/2005