Mandriva has issued this advisory today (March 29): http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:044 Cauldron was vulnerable, but I just fixed it (or will have if it finishes building). Patched package for 1 is uploaded. Advisory: ======================== Updated cvs package fixes security vulnerability: A heap-based buffer overflow flaw was found in the way the CVS client handled responses from HTTP proxies. A malicious HTTP proxy could use this flaw to cause the CVS client to crash or, possibly, execute arbitrary code with the privileges of the user running the CVS client (CVE-2012-0804). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0804 https://bugzilla.redhat.com/show_bug.cgi?id=773699 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:044 ======================== Updated packages in core/updates_testing: ======================== cvs-1.12.13-18.1.mga1 from cvs-1.12.13-18.1.mga1.src.rpm
Testing complete on i586 for the srpm cvs-1.12.13-18.1.mga1.src.rpm Just testing basic functions work, following the first 6 steps of http://mrsrl.stanford.edu/~brian/cvstutorial/ (using mcedit instead of emacs)
CC: (none) => davidwhodgins
Ping. We still need x86-64 bit testing for this security update.
Testing complete on x86_64 using Dave's procedure. Suggested Advisory: ------------- Updated cvs package fixes security vulnerability: A heap-based buffer overflow flaw was found in the way the CVS client handled responses from HTTP proxies. A malicious HTTP proxy could use this flaw to cause the CVS client to crash or, possibly, execute arbitrary code with the privileges of the user running the CVS client (CVE-2012-0804). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0804 https://bugzilla.redhat.com/show_bug.cgi?id=773699 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:044 https://bugs.mageia.org/show_bug.cgi?id=5158 ------------- SRPM: cvs-1.12.13-18.1.mga1.src.rpm Could sysadmin please push from core/updates_testing to core/updates Thankyou!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Update pushed
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED