Three security issues fixed upstream in memcached have been assigned CVEs: http://openwall.com/lists/oss-security/2016/11/01/3 The issues are fixed in 1.4.33: https://github.com/memcached/memcached/wiki/ReleaseNotes1433 Mageia 5 is also affected.
Whiteboard: (none) => MGA5TOO
URL: (none) => http://lwn.net/Vulnerabilities/705214/
Ubuntu has issued an advisory on November 2: https://www.ubuntu.com/usn/usn-3120-1/
Fixed in cauldron pushed in mga 5 updates_testing SRPMS: memcached-1.4.25-1.mga5
Assignee: mageia => qa-bugs
CC: (none) => mageiaVersion: Cauldron => 5Whiteboard: MGA5TOO => (none)
Advisory: ======================== Updated memcached packages fix security vulnerabilities: Aleksandar Nikolic discovered that Memcached incorrectly handled certain malformed commands. A remote attacker could use this issue to cause Memcached to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2016-8704, CVE-2016-8705, CVE-2016-8706). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8704 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8705 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8706 https://www.ubuntu.com/usn/usn-3120-1/ ======================== Updated packages in core/updates_testing: ======================== memcached-1.4.25-1.mga5 memcached-devel-1.4.25-1.mga5 from memcached-1.4.25-1.mga5.src.rpm
Severity: normal => critical
Testing on mga5-32 Package installed cleanly $ rpm -q memcached memcached-1.4.25-1.mga5 Following the simple test described in https://bugs.mageia.org/show_bug.cgi?id=12156#c8 Resulted in SUCCESS OK for mga5-32
CC: (none) => jimWhiteboard: (none) => MGA5-32-OK
Testing on mga5-64 Package installed cleanly $ rpm -q memcached memcached-1.4.25-1.mga5 Following the simple test described in https://bugs.mageia.org/show_bug.cgi?id=12156#c8 Running the test file returned my test data : SUCCESS OK for mga5-64
Whiteboard: MGA5-32-OK => MGA5-32-OK MGA5-64-OK
This update is now validated The advisory in comment#3 needs to be uploaded to SVN The packages can then be pushed to updates
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Advisory from Comment 3 uploaded.
CC: (none) => lewyssmithWhiteboard: MGA5-32-OK MGA5-64-OK => MGA5-32-OK MGA5-64-OK advisory
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0381.html
Status: NEW => RESOLVEDResolution: (none) => FIXED