Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=homepage-ng.git;a=commitdiff;h=fcdbe0728e067bcd3a41d334c764f3fe68ada35f
commit fcdbe0728e067bcd3a41d334c764f3fe68ada35f Author: Miklos Vajna <[EMAIL PROTECTED]> Date: Fri Jun 13 16:19:02 2008 +0200 FSA453-libvorbis diff --git a/frugalware/xml/security.xml b/frugalware/xml/security.xml index 5ad0de6..b624c2e 100644 --- a/frugalware/xml/security.xml +++ b/frugalware/xml/security.xml @@ -26,6 +26,22 @@ <fsas> <fsa> + <id>453</id> + <date>2008-06-13</date> + <package>libvorbis</package> + <vulnerable>1.2.0-1</vulnerable> + <unaffected>1.2.0-2kalgan1</unaffected> + <bts>http://bugs.frugalware.org/task/3093</bts> + <cve>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1419 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1420 + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1423</cve> + <desc>Some vulnerabilities have been reported in libvorbis, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise an application using the library. + 1) An input validation error can be exploited to crash an application, cause an infinite loop, or to cause a heap overflow via a specially crafted OGG file containing a codebook dimension of "0". + 2) An integer overflow error in the processing of residue partition values can be exploited to cause a heap-based buffer overflow via a specially crafted OGG file. + 3) An integer overflow error exists in the computation of "quantvals" and of required space for "quantlist". This can be exploited to cause a heap-based buffer overflow via a specially crafted OGG file. + Successful exploitation may allow execution of arbitrary code.</desc> + </fsa> + <fsa> <id>452</id> <date>2008-06-13</date> <package>emacs</package> _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
