Solution
Please Install the Updated Packages.
Insight
A heap overflow was found in the CDDB retrieval code of libcdaudio, which could result in the execution of arbitrary code (CVE-2008-5030).
In addition, the fixes for CVE-2005-0706 were not applied to newer libcdaudio packages as shipped with Mandriva Linux, so the patch to fix that issue has been applied to 2008.1 and 2009.0 (this was originally fixed in MDKSA-2005:075). This issue is a buffer overflow flaw found by Joseph VanAndel. Corporate 3.0 has this fix already applied.
The updated packages have been patched to prevent these issues.
Affected
libcdaudio on Mandriva Linux 2008.1,
Mandriva Linux 2008.1/X86_64,
Mandriva Linux 2009.0,
Mandriva Linux 2009.0/X86_64
Severity
Classification
-
CVE CVE-2005-0706, CVE-2008-5030 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities