[ MDVSA-2008:233-1 ] libcdaudio

[dude67]

_______________________________________________________________________

Package : libcdaudio
Date : December 7, 2008
Affected: 2008.0
_______________________________________________________________________

Problem Description:

A heap overflow was found in the CDDB retrieval code of libcdaudio,
which could result in the execution of arbitrary code (CVE-2008-5030).

In addition, the fixes for CVE-2005-0706 were not applied to newer
libcdaudio packages as shipped with Mandriva Linux, so the patch to fix
that issue has been applied to 2008.1 and 2009.0 (this was originally
fixed in MDKSA-2005:075). This issue is a buffer overflow flaw found
by Joseph VanAndel. Corporate 3.0 has this fix already applied.

The updated packages have been patched to prevent these issues.

Update:

Packages for 2008.0 are being provided due to extended support for
Corporate products.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2005-0706
http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-5030
_______________________________________________________________________