Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
91
security advisorygentooarbitrary code executionGentoo: GLSA-200903-34 Normal: Amarok User Code Execution Threat
Multiple vulnerabilities in Amarok might allow for user-assisted execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200903-34 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Amarok: User-assisted execution of arbitrary code Date: March 20, 2009 Bugs: #254896 ID: 200903-34 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities in Amarok might allow for user-assisted execution of arbitrary code. Background ========= Amarok is an advanced music player. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-sound/amarok < 1.4.10-r2 > = 1.4.10-r2 Description ========== Tobias Klein has discovered multiple vulnerabilities in Amarok: * Multiple integer overflows in the Audible::Tag::readTag() function in metadata/audible/audibletag.cpp trigger heap-based buffer overflows (CVE-2009-0135). * Multiple array index errors in the Audible::Tag::readTag() function in metadata/audible/audibletag.cpp can lead to invalid pointer dereferences, or the writing of a 0x00 byte to an arbitrary memory location after an allocation failure (CVE-2009-0136). Impact ===== A remote attacker could entice a user to open a specially crafted Audible Audio (.aa) file with a large "nlen" or "vlen" tag value to execute arbitrary code or cause a Denial of Service. Workaround ========= There is no known workaround at this time. Resolution ========= All Amarok users should upgrade to the latest version: # emerge--sync # emerge --ask --oneshot --verbose "> =media-sound/amarok-1.4.10-r2" References ========= [ 1 ] CVE-2009-0135 https://www.cve.org/CVERecord?id=CVE-2009-0135 [ 2 ] CVE-2009-0136 https://www.cve.org/CVERecord?id=CVE-2009-0136 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200903-34 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Mar 20, 2009
Gentoo
89
security advisoryupdatebuffer overflowFedora 9: 2009-0715 Critical Advisory for Amarok Buffer Overflow
This build includes a security fix concerning the parsing of malformed Audible digital audio files.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2009-0715 2009-01-21 20:33:27 --------------------------------------------------------------------------------Name : amarok Product : Fedora 9 Version : 1.4.10 Release : 2.fc9 URL : https://amarok.kde.org/ Summary : Media player Description : Amarok is a multimedia player with: - fresh playlist concept, very fast to use, with drag and drop - plays all formats supported by the various engines - audio effects, like reverb and compressor - compatible with the .m3u and .pls formats for playlists - nice GUI, integrates into the KDE look, but with a unique touch Amarok can use various engines to decode sound : helix and xine. To use the helix engine, you need to install either HelixPlayer or RealPlayer --------------------------------------------------------------------------------Update Information: This build includes a security fix concerning the parsing of malformed Audible digital audio files. --------------------------------------------------------------------------------ChangeLog: * Mon Jan 12 2009 Rex Dieter - 1.4.10-2 - backport security patch * Wed Aug 13 2008 Rex Dieter - 1.4.10-1 - amarok-1.4.10 * Wed Jun 11 2008 Dennis Gilmore - 1.4.9.1-4 - we are building sparc32 as sparcv9 not sparc now fix ifnarch * Fri May 2 2008 Rex Dieter - 1.4.9.1-3 - fix libnjb support (#444940) * Thu May 1 2008 Rex Dieter - 1.4.9.1-2.1 - --with-libvisual fedora-only (epel misses libvisual-plugins) * Thu Apr 17 2008 Rex Dieter - 1.4.9.1-2 - specfile typo (unclosed macro) * Tue Apr 15 2008 Rex Dieter - 1.4.9.1-1 - amarok-1.4.9.1 --------------------------------------------------------------------------------References: [ 1 ] Bug #479560 - amarok: multiple buffer overflows when parsing Audible .aa files https://bugzilla.redhat.com/show_bug.cgi?id=479560 --------------------------------------------------------------------------------This update can be installed with the "yum" update program. Use su -c 'yum update amarok' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list
Jan 22, 2009
•Critical
Fedora
87
security advisorycriticaldebianDebian 4.0: DSA-1706-1 Critical: Amarok Arbitrary Code Execution
Tobias Klein discovered that integer overflows in the code the Amarok media player uses to parse Audible files may lead to the execution of arbitrary code. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1706-1
Jan 15, 2009
•Critical
Debian
89
security advisoryfedorasoftware upgradeFedora 10: FEDORA-2009-0723 Critical: Amarok Buffer Overflow
An update to the latest release, includes new features such as queuing, playlist search and filtering as well as "stop after current track". And, long awaited and finally available: sorting the collection by composer. Also includes a security fix concerning the parsing of malformed Audible digital audio files. For further details, see . --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2009-0550 2009-01-14 23:38:39 --------------------------------------------------------------------------------Name : amarok Product : Fedora 10 Version : 2.0.1.1 Release : 1.fc10 URL : https://amarok.kde.org/ Summary : Media player Description : Amarok is a multimedia player with: - fresh playlist concept, very fast to use, with drag and drop - plays all formats supported by the various engines - audio effects, like reverb and compressor - compatible with the .m3u and .pls formats for playlists - nice GUI, integrates into the KDE look, but with a unique touch --------------------------------------------------------------------------------Update Information: An update to the latest release, includes new features such as queuing, playlist search and filtering as well as "stop after current track". And, long awaited and finally available: sorting the collection by composer. Also includes a security fix concerning the parsing of malformed Audible digital audio files. For further details, see --------------------------------------------------------------------------------ChangeLog: * Fri Jan 9 2009 Rex Dieter - 2.0.1.1-1 - amarok-2.0.1.1 * Tue Jan 6 2009 Rex Dieter - 2.0.1-1 - amarok-2.0.1 * Tue Dec 9 2008 Rex Dieter - 2.0-2 - respin tarball * Fri Dec 5 2008 Rex Dieter - 2.0-1 - amarok-2.0 (final, first cut) * Fri Nov 21 2008 Rex Dieter - 1.98-1 - amarok-1.98 (2rc1) --------------------------------------------------------------------------------References: [ 1 ] Bug#479560 - amarok: multiple buffer overflows when parsing Audible .aa files https://bugzilla.redhat.com/show_bug.cgi?id=479560 --------------------------------------------------------------------------------This update can be installed with the "yum" update program. Use su -c 'yum update amarok' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list
Jan 14, 2009
•Critical
Fedora
89
security advisorycritical issuefedoraFedora 8 amarok-1.4.10 Critical Issue: Temporary File Vulnerability
Amarok 1.4.10 has been released to fix a security problem. For more information please see Please update.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2008-7719 2008-09-05 11:03:20 -------------------------------------------------------------------------------- Name : amarok Product : Fedora 8 Version : 1.4.10 Release : 1.fc8 URL : https://amarok.kde.org/ Summary : Media player Description : Amarok is a multimedia player with: - fresh playlist concept, very fast to use, with drag and drop - plays all formats supported by the various engines - audio effects, like reverb and compressor - compatible with the .m3u and .pls formats for playlists - nice GUI, integrates into the KDE look, but with a unique touch Amarok can use various engines to decode sound : helix and xine. To use the helix engine, you need to install either HelixPlayer or RealPlayer -------------------------------------------------------------------------------- Update Information: Amarok 1.4.10 has been released to fix a security problem. For more information please see Please update. -------------------------------------------------------------------------------- ChangeLog: * Wed Aug 13 2008 Rex Dieter - 1.4.10-1 - amarok-1.4.10 * Wed Jun 11 2008 Dennis Gilmore - 1.4.9.1-4 - we are building sparc32 as sparcv9 not sparc now fix ifnarch * Fri May 2 2008 Rex Dieter - 1.4.9.1-3 - fix libnjb support (#444940) * Thu May 1 2008 Rex Dieter - 1.4.9.1-2.1 - --with-libvisual fedora-only (epel misses libvisual-plugins) * Thu Apr 17 2008 Rex Dieter - 1.4.9.1-2 - specfile typo (unclosed macro) * Tue Apr 15 2008 Rex Dieter - 1.4.9.1-1 - amarok-1.4.9.1 * Wed Mar 12 2008 Rex Dieter - 1.4.8-5 - -konqueror: drop Obsoletes: %name < 1.4.8-4 , which breaks multilib upgrades (#436578) * Thu Feb 21 2008 Rex Dieter - 1.4.8-4 - -konqueror subpkg (#426803) - fix multiarch conflicts (#340641) drop Provides: amarok-devel (f9+), addObsoletes: amarok-devel - gcc43 patch (#433904) * Mon Feb 18 2008 Fedora Release Engineering - 1.4.8-3 - Autorebuild for GCC 4.3 * Wed Jan 9 2008 Rex Dieter 1.4.8-2 - f9+: don't build/include konq(3) side bar support * Thu Dec 20 2007 Rex Dieter 1.4.8-1 - amarok-1.4.8 * Fri Dec 7 2007 Alex Lancaster 1.4.7-14 - Rebuild for new openssl * Thu Nov 29 2007 Rex Dieter 1.4.7-13 - fix --with-mp4v2 handling (#346011#c5,6) * Thu Nov 29 2007 Rex Dieter 1.4.7-12 - --with-mp4v2 (#346011#c3) - fix asf/wma support (rh#346011,kde#151733) * Wed Nov 21 2007 Rex Dieter 1.4.7-11 - dynamic mode floods playlist ... (kde #148317) * Wed Nov 21 2007 Todd Zullinger 1.4.7-10 - rebuild for libgpod-0.6.0 * Tue Nov 20 2007 Rex Dieter 1.4.7-9 - cosmetics (cleanup/sort BR's mostly) - omit "for KDE" from summary/description - make gst support toggled by macro (disabled by default) * Sat Nov 10 2007 Aurelien Bompard 1.4.7-8 - rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #459135 - CVE-2008-3699 amarok: temporary file vulnerability via symlink attacks (priv esc) https://bugzilla.redhat.com/show_bug.cgi?id=459135 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update amarok' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list
Sep 10, 2008
•Critical
Fedora
91
security advisorygentoosymlink attackGentoo: 200809-08 Moderate: Amarok Symlink Attack Risk Report
Amarok uses temporary files in an insecure manner, allowing for a symlink attack.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200809-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Amarok: Insecure temporary file creation Date: September 08, 2008 Bugs: #234689 ID: 200809-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Amarok uses temporary files in an insecure manner, allowing for a symlink attack. Background ========= Amarok is an advanced music player. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-sound/amarok < 1.4.10 > = 1.4.10 Description ========== Dwayne Litzenberger reported that the MagnatuneBrowser::listDownloadComplete() function in magnatunebrowser/magnatunebrowser.cpp uses the album_info.xml temporary file in an insecure manner. Impact ===== A local attacker could perform a symlink attack to overwrite arbitrary files on the system with the privileges of the user running the application. Workaround ========= There is no known workaround at this time. Resolution ========= All Amarok users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-sound/amarok-1.4.10" References ========= [ 1 ] CVE-2008-3699 https://www.cve.org/CVERecord?id=CVE-2008-3699 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200809-08 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 08, 2008
Gentoo
91
security advisorysoftware updateremote executionGentoo: 200703-11 Normal Severity: Amarok Remote Execution of Code
The Magnatune component shipped with Amarok is vulnerable to the injection of arbitrary shell code from a malicious Magnatune server.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200703-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Amarok: User-assisted remote execution of arbitrary code Date: March 13, 2007 Bugs: #166901 ID: 200703-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The Magnatune component shipped with Amarok is vulnerable to the injection of arbitrary shell code from a malicious Magnatune server. Background ========= Amarok is an advanced music player. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-sound/amarok < 1.4.5-r1 > = 1.4.5-r1 Description ========== The Magnatune downloader doesn't quote the "m_currentAlbumFileName" parameter while calling the "unzip" shell command. Impact ===== A compromised or malicious Magnatune server can remotely execute arbitrary shell code with the rights of the user running Amarok on a client that have previously registered for buying music. Workaround ========= Do not use the Magnatune component of Amarok. Resolution ========= All Amarok users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =media-sound/amarok-1.4.5-r1" References ========= [ 1 ] SA24159 https://www.flexera.com/products/security/software-vulnerability-research/secunia-research Availability =========== This GLSA and any updates to it areavailable for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200703-11 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Mar 14, 2007
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!