Patched package uploaded. Advisory: ======================== Updated taglib packages fix security vulnerabilities: When parsing an Ogg file, a specially crafted Ogg file with control over the "vendorLength" field could cause a string allocation with that size. Control over the "commentFields", which is the number of times that "commentLength" is read, would allocate a string of size "commandLength", which could cause an application linked to taglib to crash (CVE-2012-1108). Taglib suffers from an integer overflow flaw when parsing file header fields. A file with a crafted header could cause a large allocation and crash the application (CVE-2012-1584). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1108 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1584 https://bugzilla.redhat.com/show_bug.cgi?id=800559 https://bugzilla.redhat.com/show_bug.cgi?id=810009 ======================== Updated packages in core/updates_testing: ======================== libtaglib1-1.6.3-2.1.mga1 libtaglib_c0-1.6.3-2.1.mga1 libtaglib-devel-1.6.3-2.1.mga1 from taglib-1.6.3-2.1.mga1.src.rpm
Testing complete on i586 for the srpm taglib-1.6.3-2.1.mga1.src.rpm Tested using parole and amarok with a ogg file.
CC: (none) => davidwhodgins
Testing with using rhythmbox on x86_64 Suggested Advisory: ------------- Updated taglib packages fix security vulnerabilities: When parsing an Ogg file, a specially crafted Ogg file with control over the "vendorLength" field could cause a string allocation with that size. Control over the "commentFields", which is the number of times that "commentLength" is read, would allocate a string of size "commandLength", which could cause an application linked to taglib to crash (CVE-2012-1108). Taglib suffers from an integer overflow flaw when parsing file header fields. A file with a crafted header could cause a large allocation and crash the application (CVE-2012-1584). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1108 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1584 https://bugzilla.redhat.com/show_bug.cgi?id=800559 https://bugzilla.redhat.com/show_bug.cgi?id=810009 https://bugs.mageia.org/show_bug.cgi?id=5297 ------------- SRPM: taglib-1.6.3-2.1.mga1.src.rpm Could sysadmin please push from core/updates_testing to core/updates Thankyou!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Update pushed
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED