Mandriva Linux Security Advisory : libcdaudio (MDVSA-2008:233-1)

Critical Nessus Plugin ID 36292


The remote Mandriva Linux host is missing one or more security updates.


A heap overflow was found in the CDDB retrieval code of libcdaudio, which could result in the execution of arbitrary code (CVE-2008-5030).

In addition, the fixes for CVE-2005-0706 were not applied to newer libcdaudio packages as shipped with Mandriva Linux, so the patch to fix that issue has been applied to 2008.1 and 2009.0 (this was originally fixed in MDKSA-2005:075). This issue is a buffer overflow flaw found by Joseph VanAndel. Corporate 3.0 has this fix already applied.

The updated packages have been patched to prevent these issues.


Update the affected packages.

Plugin Details

Severity: Critical

ID: 36292

File Name: mandriva_MDVSA-2008-233.nasl

Version: $Revision: 1.11 $

Type: local

Published: 2009/04/23

Modified: 2013/06/01

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64cdaudio1, p-cpe:/a:mandriva:linux:lib64cdaudio1-devel, p-cpe:/a:mandriva:linux:libcdaudio1, p-cpe:/a:mandriva:linux:libcdaudio1-devel, cpe:/o:mandriva:linux:2008.0, cpe:/o:mandriva:linux:2008.1, cpe:/o:mandriva:linux:2009.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2008/11/20

Reference Information

CVE: CVE-2005-0706, CVE-2008-5030

MDVSA: 2008:233, 2008:233-1

CWE: 119