Home > Security > Advisories


Mandriva Advisories

Package name dia
Date April 3rd, 2006
Advisory ID MDKSA-2006:062
Affected versions CS3.0, 2006.0
Synopsis Updated dia packages fix buffer overflow vulnerabilities

Problem Description

Three buffer overflows were discovered by infamous41md in dia's xfig
import code. This could allow for user-complicit attackers to have
an unknown impact via a crafted xfig file, possibly involving an
invalid color index, number of points, or depth.

Updated packages have been patched to correct this issue.

Updated Packages

Corporate Server 3.0

 0d44c1c3c4a7c966ca09a3978f3b0daa  corporate/3.0/RPMS/dia-0.92.2-2.1.C30mdk.i586.rpm
 a4e4380967348069ceb7fed48031f2ac  corporate/3.0/SRPMS/dia-0.92.2-2.1.C30mdk.src.rpm

Corporate Server 3.0/X86_64

 3d5efe348829f4d108ff3b6132a0020b  x86_64/corporate/3.0/RPMS/dia-0.92.2-2.1.C30mdk.x86_64.rpm
 a4e4380967348069ceb7fed48031f2ac  x86_64/corporate/3.0/SRPMS/dia-0.92.2-2.1.C30mdk.src.rpm

Mandriva Linux 2006

 61ff8ad07d0c6760910233f6eee3043d  2006.0/RPMS/dia-0.94-6.2.20060mdk.i586.rpm
 b64fa9e7edd3252d653a7d97f46ed35a  2006.0/SRPMS/dia-0.94-6.2.20060mdk.src.rpm

Mandriva Linux 2006/X86_64

 91bde989f261feaaba0e3e7a6504a17d  x86_64/2006.0/RPMS/dia-0.94-6.2.20060mdk.x86_64.rpm
 b64fa9e7edd3252d653a7d97f46ed35a  x86_64/2006.0/SRPMS/dia-0.94-6.2.20060mdk.src.rpm




To upgrade automatically, use MandrivaUpdate.


Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.