Mageia alert MGASA-2013-0060 (openconnect)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0060: openconnect-3.15-2.2.mga2
 (2/core) 
Date:
    	     
 
Thu, 21 Feb 2013 22:02:11 +0100
Message-ID:
    	     
 
<20130221210211.GA8453@valstar.mageia.org>
Archive-link:
    	     
 
Article, Thread
              
MGASA-2013-0060
Date: 	February 21st, 2013
Affected releases: 	2
Media: 	Core


Description:
Updated openconnect packages fix security vulnerability:

A stack-based buffer overflow flaw was found in the way OpenConnect, a
client for Cisco's "AnyConnect" VPN, performed processing of certain
host names, paths, or cookie lists, received from the VPN gateway.
A remote VPN gateway could provide a specially-crafted host name, path
or cookie list that, when processed by the openconnect client would lead
to openconnect executable crash (CVE-2012-6128).


Updated Packages:
i586:
libopenconnect1-3.15-2.2.mga2.i586.rpm
libopenconnect-devel-3.15-2.2.mga2.i586.rpm
openconnect-3.15-2.2.mga2.i586.rpm
openconnect-debug-3.15-2.2.mga2.i586.rpm

x86_64:
lib64openconnect1-3.15-2.2.mga2.x86_64.rpm
lib64openconnect-devel-3.15-2.2.mga2.x86_64.rpm
openconnect-3.15-2.2.mga2.x86_64.rpm
openconnect-debug-3.15-2.2.mga2.x86_64.rpm

SRPMS:
openconnect-3.15-2.2.mga2.src.rpm


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6128
https://bugzilla.redhat.com/show_bug.cgi?id=910330
http://www.debian.org/security/2013/dsa-2623
https://bugs.mageia.org/show_bug.cgi?id=9083
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-...