Mageia alert MGASA-2015-0176 (directfb)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2015-0176: Updated directfb packages fix security vulnerabilities 
Date:
    	     
 
Sun, 3 May 2015 02:19:41 +0200
Message-ID:
    	     
 
<20150503001941.45A4E4193B@valstar.mageia.org>
MGASA-2015-0176 - Updated directfb packages fix security vulnerabilities

Publication date: 03 May 2015
URL: http://advisories.mageia.org/MGASA-2015-0176.html
Type: security
Affected Mageia releases: 4
CVE: CVE-2014-2977,
     CVE-2014-2978

Description:
Updated directfb packages fix security vulnerabilities:

Multiple integer signedness errors in the Dispatch_Write function in
proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allow remote
attackers to cause a denial of service (crash) and possibly execute arbitrary
code via the Voodoo interface, which triggers a stack-based buffer overflow
(CVE-2014-2977).

The Dispatch_Write function in proxy/dispatcher/idirectfbsurface_dispatcher.c
in DirectFB allows remote attackers to cause a denial of service (crash) and
possibly execute arbitrary code via the Voodoo interface, which triggers an
out-of-bounds write (CVE-2014-2978).

References:
- https://bugs.mageia.org/show_bug.cgi?id=13391
- http://lists.opensuse.org/opensuse-updates/2015-04/msg000...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2977
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2978

SRPMS:
- 4/core/directfb-1.7.0-2.1.mga4