[ MDVSA-2015:223 ] directfb

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2015:223
http://www.mandriva.com/en/support/security/

Package : directfb
Date : May 4, 2015
Affected: Business Server 1.0, Business Server 2.0

Problem Description:

Updated directfb packages fix security vulnerabilities:

Multiple integer signedness errors in the Dispatch_Write function
in proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allow
remote attackers to cause a denial of service (crash) and possibly
execute arbitrary code via the Voodoo interface, which triggers a
stack-based buffer overflow (CVE-2014-2977).

The Dispatch_Write function in
proxy/dispatcher/idirectfbsurface_dispatcher.c in DirectFB allows
remote attackers to cause a denial of service (crash) and possibly
execute arbitrary code via the Voodoo interface, which triggers an
out-of-bounds write (CVE-2014-2978).

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2977
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2978
http://advisories.mageia.org/MGASA-2015-0176.html

Updated Packages:

Mandriva Business Server 1/X86_64:
70c334338e4a0d84c6ff26c3be6ebea4 mbs1/x86_64/directfb-doc-1.5.3-5.1.mbs1.x86_64.rpm
d59dd695baa38c90c008176b8983ff31 mbs1/x86_64/lib64directfb1.5_0-1.5.3-5.1.mbs1.x86_64.rpm
f77efe14dd081e7742665c969f47c2f1 mbs1/x86_64/lib64directfb-devel-1.5.3-5.1.mbs1.x86_64.rpm
bcdcdd485566adf64c4e15fb5dbaeb1a mbs1/SRPMS/directfb-1.5.3-5.1.mbs1.src.rpm

Mandriva Business Server 2/X86_64:
6d65c123db855e44d27fec23464175dd mbs2/x86_64/directfb-doc-1.7.0-3.1.mbs2.noarch.rpm
38092695d865312a4fe97cc7074375fe mbs2/x86_64/lib64directfb1.7_0-1.7.0-3.1.mbs2.x86_64.rpm
9d0eb66feef71fc8506cb6380048a305 mbs2/x86_64/lib64directfb-devel-1.7.0-3.1.mbs2.x86_64.rpm
95afda68b1de9af00a8cddfe38c263a2 mbs2/SRPMS/directfb-1.7.0-3.1.mbs2.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVR5eYmqjQ0CJFipgRAiM8AJ9X9sBeaessnSgGy3Zwlh0UfJtxhACfdatk
hWj8+pyligsZaFjhyXQAt+Y=
=PYEi
-----END PGP SIGNATURE-----