Get the LinuxSecurity news you want faster with RSS
Powered By
Mandriva: Updated lzma packages fix possible data loss issue
Posted by Benjamin D. Thomas
The lzma program did not properly check that the closing of output
succeeded, which could lead to rare, but possible, data loss.
Another issue with liblzmadec was also discovered where programs
could crash if decoding of a stream was not properly initialized.
This update ensures that output is properly closed so as to avoid
silent data loss, and adds consistency checks to liblzmadec so that
programs will no longer crash if a stream isn't properly initialized.
_______________________________________________________________________
Mandriva Linux Advisory MDVA-2008:012
http://www.mandriva.com/security/
_______________________________________________________________________
Package : lzma
Date : January 17, 2008
Affected: 2008.0
_______________________________________________________________________
Problem Description:
The lzma program did not properly check that the closing of output
succeeded, which could lead to rare, but possible, data loss.
Another issue with liblzmadec was also discovered where programs
could crash if decoding of a stream was not properly initialized.
This update ensures that output is properly closed so as to avoid
silent data loss, and adds consistency checks to liblzmadec so that
programs will no longer crash if a stream isn't properly initialized.
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0:
4f0e82d096561bf25fec268d43990a43 2008.0/i586/dkms-lzma-4.43-17.1mdv2008.0.i586.rpm
35c278d3854d0c894369787c51fca11a 2008.0/i586/liblzma0-4.43-17.1mdv2008.0.i586.rpm
fbdeffc055eac2abecc063cc6b9fd162 2008.0/i586/liblzma0-devel-4.43-17.1mdv2008.0.i586.rpm
014ecdae0b866bd57f9033f206b6348e 2008.0/i586/lzma-4.43-17.1mdv2008.0.i586.rpm
4e63267629faffbf153734c27fd105f6 2008.0/SRPMS/lzma-4.43-17.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
40250f544c19f2505e58916e5b769b8e 2008.0/x86_64/dkms-lzma-4.43-17.1mdv2008.0.x86_64.rpm
beedc795d3656b09b7aa9fe435abeac2 2008.0/x86_64/lib64lzma0-4.43-17.1mdv2008.0.x86_64.rpm
3aeee2cb7c31da5f1d413e8d7d51fe3d 2008.0/x86_64/lib64lzma0-devel-4.43-17.1mdv2008.0.x86_64.rpm
0cc3f63a7b82e9927be2957532b97d1f 2008.0/x86_64/lzma-4.43-17.1mdv2008.0.x86_64.rpm
4e63267629faffbf153734c27fd105f6 2008.0/SRPMS/lzma-4.43-17.1mdv2008.0.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team