The Mandriva Security Team published a new security update: MDKSA-2005:198 - Updated uim packages fix suid linking vulnerabilities. for Mandriva Linux. Here the announcement:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:198
http://www.mandriva.com/security/
_______________________________________________________________________
Package : uim
Date : October 26, 2005
Affected: 10.2, 2006.0
_______________________________________________________________________
Problem Description:
Masanari Yamamoto discovered that Uim uses environment variables
incorrectly. This bug causes a privilege escalation if setuid/setgid
applications are linked to libuim.
The updated packages have been patched to address this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?nameÊN-2005-3149
_______________________________________________________________________
Updated Packages:
Mandriva Linux 10.2:
0b40b2bf269eebdb578b7ccad6376ee7 10.2/RPMS/libuim0-0.4.6-6.1.102mdk.i586.rpm
0fa0b1b530cbe088168575f93e27af16 10.2/RPMS/libuim0-devel-0.4.6-6.1.102mdk.i586.rpm
ff9d291ec6260b7b8dbcb7ffff44723c 10.2/RPMS/uim-0.4.6-6.1.102mdk.i586.rpm
58748280b6409a8ad303d373af08f095 10.2/RPMS/uim-anthy-0.4.6-6.1.102mdk.i586.rpm
de4817e89863e467f60f0bdfc8e367ee 10.2/RPMS/uim-gtk-0.4.6-6.1.102mdk.i586.rpm
9f604d7675aac699f2415a251ecea3c8 10.2/RPMS/uim-m17nlib-0.4.6-6.1.102mdk.i586.rpm
39ecbe0eba6a0e577fb4964eb056f1be 10.2/RPMS/uim-prime-0.4.6-6.1.102mdk.i586.rpm
ba70ceeadff24ddf3116ca7ca896bc29 10.2/RPMS/uim-qt-0.4.6-6.1.102mdk.i586.rpm
a4724afdb7fd954d0a5e4cbfe76da9ea 10.2/RPMS/uim-skk-0.4.6-6.1.102mdk.i586.rpm
1aaae40c2eb11aeb27894f0adad90c78 10.2/SRPMS/uim-0.4.6-6.1.102mdk.src.rpm
Mandriva Linux 10.2/X86_64:
a4577bc46ee837064e90d76de15dc0d8 x86_64/10.2/RPMS/lib64uim0-0.4.6-6.1.102mdk.x86_64.rpm
4f5481e87619492b66b872189b64a746 x86_64/10.2/RPMS/lib64uim0-devel-0.4.6-6.1.102mdk.x86_64.rpm
b0136005ec97560c3b69f1afe866858c x86_64/10.2/RPMS/uim-0.4.6-6.1.102mdk.x86_64.rpm
ec86c03dbc8931b1fafd3afa0ab1076c x86_64/10.2/RPMS/uim-anthy-0.4.6-6.1.102mdk.x86_64.rpm
16eafc984239f9cca8ac8b11ca6add5c x86_64/10.2/RPMS/uim-gtk-0.4.6-6.1.102mdk.x86_64.rpm
ff44a9d79f64c4ddf016808c82676248 x86_64/10.2/RPMS/uim-m17nlib-0.4.6-6.1.102mdk.x86_64.rpm
cc12102858c03a110123750217e4fe98 x86_64/10.2/RPMS/uim-prime-0.4.6-6.1.102mdk.x86_64.rpm
61e11d3562720bb2899e0847786c61c0 x86_64/10.2/RPMS/uim-qt-0.4.6-6.1.102mdk.x86_64.rpm
72b234c251423aaa12958b726af54e9c x86_64/10.2/RPMS/uim-skk-0.4.6-6.1.102mdk.x86_64.rpm
1aaae40c2eb11aeb27894f0adad90c78 x86_64/10.2/SRPMS/uim-0.4.6-6.1.102mdk.src.rpm
Mandriva Linux 2006.0:
13f254622cce2b61e252b85f2b3b89df 2006.0/RPMS/libuim0-0.4.8-4.1.20060mdk.i586.rpm
093f761ec0406e72463d0318cc58484a 2006.0/RPMS/libuim0-devel-0.4.8-4.1.20060mdk.i586.rpm
97bb193739679b4b20312c26e63f750f 2006.0/RPMS/uim-0.4.8-4.1.20060mdk.i586.rpm
eef6b766c1283e770d872d440f1ab8dc 2006.0/RPMS/uim-gtk-0.4.8-4.1.20060mdk.i586.rpm
1c2a7bb3cb25ba173289098c3ce80b07 2006.0/RPMS/uim-qt-0.4.8-4.1.20060mdk.i586.rpm
ad441f9127511a1e5b0d83472ae54862 2006.0/RPMS/uim-qtimmodule-0.4.8-4.1.20060mdk.i586.rpm
58946cffcb345bbaaae8a3b2e5192a8f 2006.0/SRPMS/uim-0.4.8-4.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
6ccb325145baeed7ea30b78a367941dd x86_64/2006.0/RPMS/lib64uim0-0.4.8-4.1.20060mdk.x86_64.rpm
21465e1d5bb3a169053e5930ef03074d x86_64/2006.0/RPMS/lib64uim0-devel-0.4.8-4.1.20060mdk.x86_64.rpm
f0e752e8177553041fefa013ce4598df x86_64/2006.0/RPMS/uim-0.4.8-4.1.20060mdk.x86_64.rpm
3056648cfdbcfdb715106531dda70700 x86_64/2006.0/RPMS/uim-gtk-0.4.8-4.1.20060mdk.x86_64.rpm
3f5264d09059fadc77229b696cbea267 x86_64/2006.0/RPMS/uim-qt-0.4.8-4.1.20060mdk.x86_64.rpm
9d586985de4c10e879bcd699af023cae x86_64/2006.0/RPMS/uim-qtimmodule-0.4.8-4.1.20060mdk.x86_64.rpm
58946cffcb345bbaaae8a3b2e5192a8f x86_64/2006.0/SRPMS/uim-0.4.8-4.1.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDX/cbmqjQ0CJFipgRAmtUAJ9uoYAcWo7lpfRjWo2Ak+rTEMx+EACfdO5R
ejHcUW3I/0IxlAoZNN+4qzo=
=YxAm
-----END PGP SIGNATURE-----
