The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:180
http://www.mandriva.com/security/
_______________________________________________________________________

Package : id3lib
Date : September 12, 2007
Affected: 2007.0, 2007.1, Corporate 3.0
_______________________________________________________________________

Problem Description:

A programming error was found in id3lib by Nikolaus Schulz that could
lead to a denial of service through symlink attacks.

Updated packages have been patched to prevent these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4460
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
89ededb20e4a560dc4a15bc028bde937 2007.0/i586/id3lib-3.8.3-10.1mdv2007.0.i586.rpm
911e99bcbd3adc8d49175fa12297d6dd 2007.0/i586/libid3_3.8_3-3.8.3-10.1mdv2007.0.i586.rpm
d792ca59dcbfbba0ec75742383dd0740 2007.0/i586/libid3_3.8_3-devel-3.8.3-10.1mdv2007.0.i586.rpm
b5263e43bcc2c3e52cb96ce70769d663 2007.0/i586/libid3_3.8_3-static-devel-3.8.3-10.1mdv2007.0.i586.rpm
8046c1d4ed9191e1ea40caf4b7ba20f5 2007.0/SRPMS/id3lib-3.8.3-10.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
330799502bac0ea9cdf3e87a89836b61 2007.0/x86_64/id3lib-3.8.3-10.1mdv2007.0.x86_64.rpm
1be980ac246eee399e840933912c38dd 2007.0/x86_64/lib64id3_3.8_3-3.8.3-10.1mdv2007.0.x86_64.rpm
9c89408b8df0db6e0525818d72179b28 2007.0/x86_64/lib64id3_3.8_3-devel-3.8.3-10.1mdv2007.0.x86_64.rpm
a46d3015c2b8281d89adcd6463b74fd0 2007.0/x86_64/lib64id3_3.8_3-static-devel-3.8.3-10.1mdv2007.0.x86_64.rpm
8046c1d4ed9191e1ea40caf4b7ba20f5 2007.0/SRPMS/id3lib-3.8.3-10.1mdv2007.0.src.rpm

Mandriva Linux 2007.1:
012881ba00ae7a43fdda8daede5094ef 2007.1/i586/id3lib-3.8.3-10.1mdv2007.1.i586.rpm
0bb593e49f8c41552d27e4e663b56273 2007.1/i586/libid3_3.8_3-3.8.3-10.1mdv2007.1.i586.rpm
1a91fab14f81fb583f7acea0486220d7 2007.1/i586/libid3_3.8_3-devel-3.8.3-10.1mdv2007.1.i586.rpm
ec3ec3f058a7aa84e19870bd11f3949f 2007.1/i586/libid3_3.8_3-static-devel-3.8.3-10.1mdv2007.1.i586.rpm
eff155d8383d433ef3b6cee13fa3c0c4 2007.1/SRPMS/id3lib-3.8.3-10.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
7e6e147491fce23225e257049ea54231 2007.1/x86_64/id3lib-3.8.3-10.1mdv2007.1.x86_64.rpm
6e958567c9dcdd32cca5908af3d3d230 2007.1/x86_64/lib64id3_3.8_3-3.8.3-10.1mdv2007.1.x86_64.rpm
65dc5829f1df5aa29e16a7208f78efa0 2007.1/x86_64/lib64id3_3.8_3-devel-3.8.3-10.1mdv2007.1.x86_64.rpm
0cffc56e63ae5ed9bc0f6ac5143f225a 2007.1/x86_64/lib64id3_3.8_3-static-devel-3.8.3-10.1mdv2007.1.x86_64.rpm
eff155d8383d433ef3b6cee13fa3c0c4 2007.1/SRPMS/id3lib-3.8.3-10.1mdv2007.1.src.rpm

Corporate 3.0:
490549e67ef6b52bd06eaaf6dbff508a corporate/3.0/i586/libid3_3.8_3-3.8.3-6.1.C30mdk.i586.rpm
4647513ebae5dc1355d3e7f9b7ee51a5 corporate/3.0/i586/libid3_3.8_3-devel-3.8.3-6.1.C30mdk.i586.rpm
2339afded61377eff9f912bed1218cd1 corporate/3.0/i586/libid3_3.8_3-static-devel-3.8.3-6.1.C30mdk.i586.rpm
3c659b0444946057c77a019af1678810 corporate/3.0/SRPMS/id3lib-3.8.3-6.1.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFG6EwOmqjQ0CJFipgRAodMAKC5yfiviupxANt/gXfqY6zdaVMf9ACeN5u+
S+u0izuqWpkjKrkVecA359k=
=ysgi
-----END PGP SIGNATURE-----