Fedora 4.6.0-14.10 Critical: Midnight Commander Buffer Overflow

Midnight Commander is a visual shell much like a file manager, only

with many more features. It is a text mode application, but it also

includes mouse support if you are running GPM. Midnight Commander's

best features are its ability to FTP, view tar and zip files, and to

poke into RPMs for specific files.

Several buffer overflows, several temporary file creation vulnerabilities, and one format string vulnerability have been discovered in Midnight Commander. These vulnerabilities were discovered mostly by Andrew V. Samoilov and Pavel Roskin. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0226, CAN-2004-0231, and CAN-2004-0232 to these issues.

* Fri Apr 16 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-14.10

- don't use mmap if st_size doesn't fit into size_t - fix one missed match_normal -> match_regex - rebuilt for FC1 updates

* Fri Apr 16 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-14

- avoid buffer overflows in mcedit Replace function

* Wed Apr 14 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-13

- perl scripting fix

* Wed Apr 14 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-12

- fix a bug in complete.c introduced by last patch - export MC_TMPDIR env variable - avoid integer overflows in free diskspace % countin...