-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:114
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : file
 Date    : June 5, 2007
 Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0,
           Multi Network Firewall 2.0
 _______________________________________________________________________
 
 Problem Description:
 
 The update to correct CVE-2007-1536 (MDKSA-2007:067), a buffer overflow
 in the file_printf() function, introduced a new integer overflow as
 reported by Colin Percival.  This flaw, if an atacker could trick a
 user into running file on a specially crafted file, could possibly
 lead to the execution of arbitrary code with the privileges of the
 user running file (CVE-2007-2799).
 
 As well, in file 4.20, flawed regular expressions to identify OS/2
 REXX files could lead to a denial of service via CPU consumption
 (CVE-2007-2026).
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2026
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2799
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 3da3923de6da550bab34801eef616c65  2007.0/i586/file-4.17-2.2mdv2007.0.i586.rpm
 cdda9efd3b6b29b3bd959c27b9b4ff45  2007.0/i586/libmagic1-4.17-2.2mdv2007.0.i586.rpm
 7a7639ae8578d60800a3606ea7846046  2007.0/i586/libmagic1-devel-4.17-2.2mdv2007.0.i586.rpm
 b88d355059a7abaa684ca4ccd2902f5e  2007.0/i586/libmagic1-static-devel-4.17-2.2mdv2007.0.i586.rpm
 8be4b2fc01aae6687cea3d32bf13adec  2007.0/i586/python-magic-4.17-2.2mdv2007.0.i586.rpm 
 0faac11bd3ceb07623dcc538259b4920  2007.0/SRPMS/file-4.17-2.2mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 7b236e74e29e7322a63db012508f4ff7  2007.0/x86_64/file-4.17-2.2mdv2007.0.x86_64.rpm
 c9ee191afb3c4f13989aecc4c0550a64  2007.0/x86_64/lib64magic1-4.17-2.2mdv2007.0.x86_64.rpm
 895f9822301c950fa52b34a8f1e6458d  2007.0/x86_64/lib64magic1-devel-4.17-2.2mdv2007.0.x86_64.rpm
 a667f8207f61a7407ad3434e779cd2a3  2007.0/x86_64/lib64magic1-static-devel-4.17-2.2mdv2007.0.x86_64.rpm
 87b499c21853acc87c968c6a24a5f0d4  2007.0/x86_64/python-magic-4.17-2.2mdv2007.0.x86_64.rpm 
 0faac11bd3ceb07623dcc538259b4920  2007.0/SRPMS/file-4.17-2.2mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 0f340f48900656e4d393c26f41cfd24a  2007.1/i586/file-4.20-1.1mdv2007.1.i586.rpm
 d690cf39a2b9d4bce78eb3ba76f89034  2007.1/i586/libmagic1-4.20-1.1mdv2007.1.i586.rpm
 adf38bdec1118a46cbc8063cd1c87bfd  2007.1/i586/libmagic1-devel-4.20-1.1mdv2007.1.i586.rpm
 7f650e75b6bcbfee83f356e6a39f5d8b  2007.1/i586/libmagic1-static-devel-4.20-1.1mdv2007.1.i586.rpm
 d5556e8963b4f8e3750a8c2b4844f3cb  2007.1/i586/python-magic-4.20-1.1mdv2007.1.i586.rpm 
 4335066ac789ab04b344be24e80f26c7  2007.1/SRPMS/file-4.20-1.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 649ff715c11ed4de3233ac50f1cf0773  2007.1/x86_64/file-4.20-1.1mdv2007.1.x86_64.rpm
 a5c7e2604290b2523288614191ecb153  2007.1/x86_64/lib64magic1-4.20-1.1mdv2007.1.x86_64.rpm
 239042ad851510f9e66e3c03067e3129  2007.1/x86_64/lib64magic1-devel-4.20-1.1mdv2007.1.x86_64.rpm
 a8597d9708ea995c85ae640b468ed43a  2007.1/x86_64/lib64magic1-static-devel-4.20-1.1mdv2007.1.x86_64.rpm
 f13b9cb6c65c4247a66a18b32f02a253  2007.1/x86_64/python-magic-4.20-1.1mdv2007.1.x86_64.rpm 
 4335066ac789ab04b344be24e80f26c7  2007.1/SRPMS/file-4.20-1.1mdv2007.1.src.rpm

 Corporate 3.0:
 1df48d0c9911aa0bb1ffd7cd6541841a  corporate/3.0/i586/file-4.07-3.2.C30mdk.i586.rpm
 a874520fc37514088e859482cecc1e74  corporate/3.0/i586/libmagic1-4.07-3.2.C30mdk.i586.rpm
 45f463521c4a48a6fe5a94af29c0bf08  corporate/3.0/i586/libmagic1-devel-4.07-3.2.C30mdk.i586.rpm
 8d2c8f7eafc9a606913c0d4ec5e4398c  corporate/3.0/i586/libmagic1-static-devel-4.07-3.2.C30mdk.i586.rpm 
 f3f6d9560bd1ef14795abec51391e776  corporate/3.0/SRPMS/file-4.07-3.2.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 554baaf5942ac5e533e72812394fc6ec  corporate/3.0/x86_64/file-4.07-3.2.C30mdk.x86_64.rpm
 5880184431f8918886543337a43f19d5  corporate/3.0/x86_64/lib64magic1-4.07-3.2.C30mdk.x86_64.rpm
 a1c8b2cd7a721e1429f3a4cd855b0235  corporate/3.0/x86_64/lib64magic1-devel-4.07-3.2.C30mdk.x86_64.rpm
 b56eba4a34a18ea5df00a1bfbd103b91  corporate/3.0/x86_64/lib64magic1-static-devel-4.07-3.2.C30mdk.x86_64.rpm 
 f3f6d9560bd1ef14795abec51391e776  corporate/3.0/SRPMS/file-4.07-3.2.C30mdk.src.rpm

 Corporate 4.0:
 0a2f24f69b886df7c5439dd4726bae7a  corporate/4.0/i586/file-4.14-2.3.20060mlcs4.i586.rpm
 cf7484c68d78b2888290ed83ca69b2f7  corporate/4.0/i586/libmagic1-4.14-2.3.20060mlcs4.i586.rpm
 4f71702b0528d8cb8f3a999043a37b60  corporate/4.0/i586/libmagic1-devel-4.14-2.3.20060mlcs4.i586.rpm
 05d475851788a7e2c1e2ff0ae1bf783e  corporate/4.0/i586/libmagic1-static-devel-4.14-2.3.20060mlcs4.i586.rpm 
 f23dc6744da226429ea647881c10e253  corporate/4.0/SRPMS/file-4.14-2.3.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 60519ec0a662cfd9501527b1476595d7  corporate/4.0/x86_64/file-4.14-2.3.20060mlcs4.x86_64.rpm
 96b1ce3bf2e2b45ff51ab6c83f9e41c8  corporate/4.0/x86_64/lib64magic1-4.14-2.3.20060mlcs4.x86_64.rpm
 5d167574eb45cdea383ce87ea933fa9e  corporate/4.0/x86_64/lib64magic1-devel-4.14-2.3.20060mlcs4.x86_64.rpm
 bb4bba87454e9c9d098e68ededde68af  corporate/4.0/x86_64/lib64magic1-static-devel-4.14-2.3.20060mlcs4.x86_64.rpm 
 f23dc6744da226429ea647881c10e253  corporate/4.0/SRPMS/file-4.14-2.3.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 9186aca370a3692ac9552e43e4eecc9f  mnf/2.0/i586/file-4.07-3.2.M20mdk.i586.rpm
 595a5d6433d2adbcb068de6c8076411b  mnf/2.0/i586/libmagic1-4.07-3.2.M20mdk.i586.rpm 
 2197334faacdf1e24067cd02e8dec993  mnf/2.0/SRPMS/file-4.07-3.2.M20mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGZcJpmqjQ0CJFipgRAt3hAKCUKl739wcB+BbX/V/jSiNi4zh5agCfSl76
12rwbbkfYa/z/vdUPZDNkU4=
=d33Q
-----END PGP SIGNATURE-----