[ MDVSA-2013:043 ] libgssglue

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2013:043
http://www.mandriva.com/en/support/security/

Package : libgssglue
Date : April 5, 2013
Affected: Business Server 1.0

Problem Description:

This update fixes insecure getenv() usage in libgssglue, which could
be used under some circumstances by local attackers do gain root
privileges (CVE-2011-2709).

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2709
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0159

Updated Packages:

Mandriva Business Server 1/X86_64:
a5cc4da52d5ac3532b29f528609ab4b7 mbs1/x86_64/lib64gssglue1-0.4-1.mbs1.x86_64.rpm
af0281d9fa8cdb30634c9442ef414b26 mbs1/x86_64/lib64gssglue-devel-0.4-1.mbs1.x86_64.rpm
4d42b6a08664100814ec344bca919ac4 mbs1/SRPMS/libgssglue-0.4-1.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFRXrBpmqjQ0CJFipgRAu8TAJ9+H22W1UsNzsP8MFlmBNQYWH4AFQCbBpkS
uQJ2c3Eb1rxVi9MeG/RORfY=
=YMhI
-----END PGP SIGNATURE-----