Package name libmms Date July 6th, 2006 Advisory ID MDKSA-2006:117 Affected versions 2006.0

Problem Description

Stack-based buffer overflow in MiMMS 0.0.9 allows remote attackers to cause
a denial of service (application crash) and possibly execute arbitrary code
via the (1) send_command, (2) string_utf16, (3) get_data, and (4)
get_media_packet functions, and possibly other functions. Libmms uses the
same vulnerable code.

The updated packages have been patched to correct this issue.

Updated Packages

Mandriva Linux 2006

 f1de59d4e17d078de50a6d0d2516a242  2006.0/RPMS/libmms0-0.1-1.1.20060mdk.i586.rpm
 6d813df73edfb2668ca8cd5e709a8baa  2006.0/RPMS/libmms0-devel-0.1-1.1.20060mdk.i586.rpm
 ea8211070adfa9bb74d3824d0cc1768c  2006.0/SRPMS/libmms-0.1-1.1.20060mdk.src.rpm

Mandriva Linux 2006/X86_64

 80fd5e12af39a8143eaa08176d2d75b3  x86_64/2006.0/RPMS/lib64mms0-0.1-1.1.20060mdk.x86_64.rpm
 4a7d9ed61fd2c31f94590a2690105e79  x86_64/2006.0/RPMS/lib64mms0-devel-0.1-1.1.20060mdk.x86_64.rpm
 ea8211070adfa9bb74d3824d0cc1768c  x86_64/2006.0/SRPMS/libmms-0.1-1.1.20060mdk.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2200

Upgrade

To upgrade automatically, use MandrivaUpdate.

Verification

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

		rpm --checksig package.rpm
		

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.