—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:219
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : srtp
Date : November 21, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated srtp package fixes security vulnerability:

Fernando Russ from Groundworks Technologies reported a buffer
overflow flaw in srtp, Cisco's reference implementation
of the Secure Real-time Transport Protocol (SRTP), in how
the crypto_policy_set_from_profile_for_rtp() function applies
cryptographic profiles to an srtp_policy. A remote attacker could
exploit this vulnerability to crash an application linked against
libsrtp, resulting in a denial of service (CVE-2013-2139).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2139
http://advisories.mageia.org/MGASA-2014-0465.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
e0447c9fa33ab8edce9657a5dce43fc7 mbs1/x86_64/srtp-1.4.4-3.1.mbs1.x86_64.rpm
745fcb1bd29913e979132a27511dd807 mbs1/SRPMS/srtp-1.4.4-3.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUb2W2mqjQ0CJFipgRAl7NAJ9L7vV/RmDh7SFuhOB0o1yH1BdgRgCg9EVG
OL/+jYin37Oe92GVSFJ7PPk=
=JE3P
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________