Technical Description

A vulnerability has been identified in Mandriva, which could be exploited by attackers to cause a denial of service or execute arbitrary code. This issue is caused by an error in GD. For additional information, see : VUPEN/ADV-2006-3318

Affected Products

Mandriva Linux 2007.0
Mandriva Corporate 4.0

Solution

Upgrade the affected packages :

Mandriva Linux 2007.0:
5d27c4f586379090e4931a21d33fd7b4 2007.0/i586/gd-utils-2.0.33-5.4mdv2007.0.i586.rpm
9224f8e7e3592e7002bf7e52ab11c03f 2007.0/i586/libgd2-2.0.33-5.4mdv2007.0.i586.rpm
1d703d7be910a24975b4ebe18aeb7dd3 2007.0/i586/libgd2-devel-2.0.33-5.4mdv2007.0.i586.rpm
9f2a55d0b08203ea04d1a7ef9350f193 2007.0/i586/libgd2-static-devel-2.0.33-5.4mdv2007.0.i586.rpm
c3d0c5fcdd6c91952dc9c26941806b4f 2007.0/SRPMS/gd-2.0.33-5.4mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
4415599217e596438138f1d38d569b2e 2007.0/x86_64/gd-utils-2.0.33-5.4mdv2007.0.x86_64.rpm
b80f2b86c307a423f4c5da9db8740498 2007.0/x86_64/lib64gd2-2.0.33-5.4mdv2007.0.x86_64.rpm
b25700d218143ab19630a273859ca8cf 2007.0/x86_64/lib64gd2-devel-2.0.33-5.4mdv2007.0.x86_64.rpm
edc68e77faefc49c3f003fe16f7456a1 2007.0/x86_64/lib64gd2-static-devel-2.0.33-5.4mdv2007.0.x86_64.rpm
c3d0c5fcdd6c91952dc9c26941806b4f 2007.0/SRPMS/gd-2.0.33-5.4mdv2007.0.src.rpm

Corporate 4.0:
dd213d40ce5d217db62bba839f38228b corporate/4.0/i586/gd-utils-2.0.33-3.5.20060mlcs4.i586.rpm
e3ce9ac16ccebcd9e974191766851d73 corporate/4.0/i586/libgd2-2.0.33-3.5.20060mlcs4.i586.rpm
974858ee8531fa339fd54f7ad435bbd1 corporate/4.0/i586/libgd2-devel-2.0.33-3.5.20060mlcs4.i586.rpm
4651b8752a4631e9d4139d59c6f423f5 corporate/4.0/i586/libgd2-static-devel-2.0.33-3.5.20060mlcs4.i586.rpm
638e3d6d0cad46ec00cd8005356fe96f corporate/4.0/SRPMS/gd-2.0.33-3.5.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
26e334153150600c8e21426b6c89fc0d corporate/4.0/x86_64/gd-utils-2.0.33-3.5.20060mlcs4.x86_64.rpm
85d6fb1d0e366fc02eea92d87f002775 corporate/4.0/x86_64/lib64gd2-2.0.33-3.5.20060mlcs4.x86_64.rpm
0f3986d317e0e6e4923bee69763d4d2a corporate/4.0/x86_64/lib64gd2-devel-2.0.33-3.5.20060mlcs4.x86_64.rpm
551c1c5d3bf54340241cbfa1a7f0d5e2 corporate/4.0/x86_64/lib64gd2-static-devel-2.0.33-3.5.20060mlcs4.x86_64.rpm
638e3d6d0cad46ec00cd8005356fe96f corporate/4.0/SRPMS/gd-2.0.33-3.5.20060mlcs4.src.rpm

References

http://www.vupen.com/english/advisories/2008/0456
http://archives.mandrivalinux.com/security-announce/2008-02/msg00011.php

ChangeLog

2008-02-08 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.