Mageia alert MGASA-2013-0017 (snack)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0017: snack-2.2.10-10.1.mga2 (2/core) 
Date:
    	     
 
Thu, 24 Jan 2013 23:31:50 +0100
Message-ID:
    	     
 
<20130124223150.GA10922@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2013-0017
Date: 	January 24th, 2013
Affected releases: 	2


Description:
Updated snack packages fix security vulnerability:

Two vulnerabilities have been discovered in Snack Sound Toolkit, which
are caused due to missing boundary checks in the "GetWavHeader()"
function (generic/jkSoundFile.c) when parsing either format sub-chunks
or unknown sub-chunks. This can be exploited to cause a heap-based
buffer overflow via specially crafted WAV files with overly large chunk
sizes specified (CVE-2012-6303).


Updated Packages:
i586:
python-snack-2.2.10-10.1.mga2.i586.rpm
tcl-snack-2.2.10-10.1.mga2.i586.rpm

x86_64:
python-snack-2.2.10-10.1.mga2.x86_64.rpm
tcl-snack-2.2.10-10.1.mga2.x86_64.rpm

SRPMS:
snack-2.2.10-10.1.mga2.src.rpm


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6303
http://secunia.com/advisories/49889/
http://lists.fedoraproject.org/pipermail/package-announce...
https://bugs.mageia.org/show_bug.cgi?id=8689
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-...