sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities]

From: Seth Alan Woolley <seth AT positivism.org>
To: Thomas Houssin <thomas.houssin AT gmail.com>
Cc: sm-security AT lists.ibiblio.org
Subject: Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities]
Date: Thu, 21 Apr 2005 15:03:42 -0700

On Thu, Apr 21, 2005 at 11:59:14PM +0200, Thomas Houssin wrote:
> Andrew wrote:
> > Not sure if we got this or not, forwarding anyway.
> >
> >
> > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> > Gentoo Linux Security Advisory GLSA 200504-17
> > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> > http://security.gentoo.org/
> > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> >
> > Severity: Normal
> > Title: XV: Multiple vulnerabilities
> > Date: April 19, 2005
> > Bugs: #88742
> > ID: 200504-17
> >
> > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> >
> > Synopsis
> > ========
> >
> > Multiple vulnerabilities have been discovered in XV, potentially
> > resulting in the execution of arbitrary code.
> >
> > Background
> > ==========
> >
> > XV is an interactive image manipulation program for the X Window
> > System.
> >
> > Affected packages
> > =================
> >
> > -------------------------------------------------------------------
> > Package / Vulnerable / Unaffected
> > -------------------------------------------------------------------
> > 1 media-gfx/xv < 3.10a-r11 >= 3.10a-r11
> >
>
> Apparently some places needs to be fixed.
> Is this ok to use the jumbo patches
> http://www.sonic.net/~roelofs/greg_xv.html) instead of the megapatch we
> use ?

Whatever gets the bug out -- if features need to be disabled or other
non-security bugs left in to do that, you don't have much of a choice --
the security fix goes in regardless. (IMHO now that I'm not team leader
;) ).

Seth

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Key id 00BA3AF3 = 8BE0 A72E A47E A92A 0737 F2FF 7A3F 6D3C 00BA 3AF3
Security Team Member Source Mage GNU/Linux http://www.sourcemage.org
Elected Coordinating Committee Member, Pacific Green Party of Oregon

Attachment: pgp5REVOruKec.pgp
Description: PGP signature

[SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Andrew, 04/21/2005
- Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Thomas Houssin, 04/21/2005
  - Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Seth Alan Woolley, 04/21/2005
    - Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Thomas Houssin, 04/21/2005
      - Re: [SM-Security] [jaervosz AT gentoo.org: [Full-disclosure] [ GLSA 200504-17 ] XV: Multiple vulnerabilities], Thomas Houssin, 04/22/2005