| Summary: | libsoup new security issue CVE-2011-2524 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, dmorganec, sysadmin-bugs, tmb |
| Version: | 1 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Source RPM: | libsoup-2.32.2-4.mga1.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2012-03-23 14:29:50 CET
Looks like dmorgan added a patch for this in SVN 7 months ago, but didn't submit it to the build system. CC:
(none) =>
dmorganec I've confirmed Cauldron is not vulnerable. Looks like it was built afterall, but schedbot hadn't marked it in SVN for some reason. No bug had been filed, so here we go. (Confirmed with dmorgan on IRC that this is ready to go.) Advisory: ======================== Updated libsoup packages fix security vulnerability: Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI (CVE-2011-2524). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2524 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:036 ======================== Updated packages in core/updates_testing: ======================== libsoup-2.4-devel-2.32.2-4.1.mga1 libsoup-2.4_1-2.32.2-4.1.mga1 from libsoup-2.32.2-4.1.mga1.src.rpm Assignee:
bugsquad =>
qa-bugs Testing complete on i586 for the srpm
libsoup-2.32.2-4.1.mga1.src.rpm
Just testing using hardinfo under strace, which shows
19734 open("/usr/lib/libsoup-2.4.so.1", O_RDONLY) = 3CC:
(none) =>
davidwhodgins Testing for some weeks the lib without issue. Suggested Advisory: ------------- Updated libsoup packages fix security vulnerability: Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI (CVE-2011-2524). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2524 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:036 https://bugs.mageia.org/show_bug.cgi?id=5075 ------------- SRPM: libsoup-2.32.2-4.1.mga1.src.rpm Could sysadmin please push from core/updates_testing to core/updates Thankyou! Keywords:
(none) =>
validated_update Update pushed. Status:
NEW =>
RESOLVED |