[sflack-security] xine-lib (SFSA:2007-109-02)
New xine-lib packages are available for Sflack 11.0,
and -current to fix security issues.
More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1246
Here are the details from the Sflack 11.0 ChangeLog:
+--------------------------+
Upgraded to xine-lib-1.1.6.
This fixes overflows in xine-lib in some little-used media formats in
xine-lib < 1.1.5 and other bugs in xine-lib < 1.1.6. The overflows in
xine-lib < 1.1.5 could definitely cause an application using xine-lib to
crash, and it is theorized that a malicious media file could be made to run
arbitrary code in the context of the user running the application.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1246
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Also see the "Get Sflack" section on http://sflack.com for
additional mirror sites near you.
Updated package for Sflack 11.0:
ftp://ftp.sflack.com/pub/sflack/sflack-11.0/patches/packages/xine-lib-1.1.6-x86_64-1_sflack11.0.tgz
Updated package for Sflack -current:
ftp://ftp.sflack.com/pub/sflack/sflack-current/slackware/xap/xine-lib-1.1.6-x86_64-2.tgz
MD5 signatures:
+-------------+
Sflack 11.0 package:
f762c063da1efa8b3868304331f6f508 xine-lib-1.1.6-x86_64-1_sflack11.0.tgz
Sflack -current package:
ad3fa3c169074d83abf65d63d8dca095 xine-lib-1.1.6-x86_64-2.tgz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg xine-lib-1.1.6-x86_64-1_sflack11.0.tgz
+-----+
Sflack Linux Security Team
http://sflack.com/gpg-key
security at sflack.com
Correlati
