[ MDVSA-2014:192 ] perl-Email-Address

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2014:192
http://www.mandriva.com/en/support/security/

Package : perl-Email-Address
Date : October 1, 2014
Affected: Business Server 1.0

Problem Description:

Updated perl-Email-Address package fixes security vulnerability:

The parse function in Email::Address module before 1.905 for Perl
uses an inefficient regular expression, which allows remote attackers
to cause a denial of service (CPU consumption) via an empty quoted
string in an RFC 2822 address (CVE-2014-0477).

The Email::Address module before 1.904 for Perl uses an inefficient
regular expression, which allows remote attackers to cause a denial
of service (CPU consumption) via vectors related to backtracking into
the phrase (CVE-2014-4720).

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0477
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4720
http://advisories.mageia.org/MGASA-2014-0389.html

Updated Packages:

Mandriva Business Server 1/X86_64:
f45326dac151e5154f2f13a6942d4f16 mbs1/x86_64/perl-Email-Address-1.895.0-2.1.mbs1.noarch.rpm
a889b50000a684108955b439e4ca02db mbs1/SRPMS/perl-Email-Address-1.895.0-2.1.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUK/fNmqjQ0CJFipgRAtWrAJ9CmAobU9TL5x0+jFEhhDwbvIalRwCfTPn6
C57L8lqxJPqP/vkUCCzshN4=
=S0uC
-----END PGP SIGNATURE-----