Mageia alert MGASA-2012-0335 (gegl)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2012-0335: gegl-0.1.2-3.1.mga1 (1/core),
 gegl-0.2.0-2.1.mga2 (2/core) 
Date:
    	     
 
Wed, 21 Nov 2012 20:57:36 +0100
Message-ID:
    	     
 
<20121121195736.GA2027@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2012-0335
Date: 	November 21st, 2012
Affected releases: 	1, 2


Description:
Updated gegl packages fix security vulnerability:

An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the way the gegl utility processed .ppm (Portable Pixel Map)
image files. An attacker could create a specially-crafted .ppm file
that, when opened in gegl, would cause gegl to crash or, potentially,
execute arbitrary code (CVE-2012-4433).


Updated Packages:
Mageia 1:
gegl-0.1.2-3.1.mga1
lib(64)gegl0.1_0-0.1.2-3.1.mga1
lib(64)gegl0.1-devel-0.1.2-3.1.mga1

Mageia 2:
gegl-0.2.0-2.1.mga2
lib(64)gegl0.2_0-0.2.0-2.1.mga2
lib(64)gegl-devel-0.2.0-2.1.mga2


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4433
https://rhn.redhat.com/errata/RHSA-2012-1455.html
https://bugs.mageia.org/show_bug.cgi?id=8070
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-...