| Summary: | blender missing update for security issue CVE-2009-3850 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Normal | CC: | sysadmin-bugs, tmb |
| Version: | 1 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/451501/ | ||
| Whiteboard: | MGA1-64-OK, MGA1-32-OK | ||
| Source RPM: | blender-2.49b-11.3.mga1.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2012-08-14 23:52:15 CEST
Patched package uploaded for Mageia 1. Advisory: ======================== Updated blender package fixes security vulnerability: Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA (CVE-2009-3850). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3850 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062616.html ======================== Updated packages in {core,tainted}/updates_testing: ======================== blender-2.49b-11.4.mga1 from blender-2.49b-11.4.mga1.src.rpm Assignee:
fundawang =>
qa-bugs Correction: we're only shipping the core (not tainted) blender package. Advisory: ======================== Updated blender package fixes security vulnerability: Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA (CVE-2009-3850). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3850 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062616.html ======================== Updated packages in core/updates_testing: ======================== blender-2.49b-11.4.mga1 from blender-2.49b-11.4.mga1.src.rpm tested successfully on mga1 x86_64 using PoC from Comment 3: inserting import os os.system("/usr/bin/lxterminal") as described opens a new terminal directly after loading .bend file after update nothing happens anymore. Will repeat it with i586 shortly. CC:
(none) =>
marc.lattemann same test performed on mga1 i586 with same results. validate updates. Advisory: ======================== Updated blender package fixes security vulnerability: Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA (CVE-2009-3850). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3850 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062616.html ======================== Updated packages in core/updates_testing: ======================== blender-2.49b-11.4.mga1 from blender-2.49b-11.4.mga1.src.rpm Could someone from the sysadmins push it to Updates? Thanks. Keywords:
(none) =>
validated_update Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0319 Status:
NEW =>
RESOLVED |