<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Oracle VM Security Advisory OVMSA-2009-0022<br>
<br>
The following updated rpms for Oracle VM 2.1 have been uploaded to the
Unbreakable Linux Network:<br>
<br>
i386:<br>
dnsmasq-2.45-1.1.el5_3.i386.rpm<br>
<br>
<br>
SRPMS:<br>
<a class="moz-txt-link-freetext"
href="http://oss.oracle.com/oraclevm/server/SRPMS-updates/dnsmasq-2.45-1.1.el5_3.src.rpm">http://oss.oracle.com/oraclevm/server/SRPMS-updates/dnsmasq-2.45-1.1.el5_3.src.rpm</a><br>
<br>
<br>
Description of changes:<br>
<br>
Following security fixes are included in this errata:<br>
<br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2957">CVE-2009-2957</a><br>
Heap-based buffer overflow in the tftp_request function in tftp.c in
dnsmasq before 2.50, when --enable-tftp is used, might allow remote
attackers to execute arbitrary code via a long filename in a TFTP
packet, as demonstrated by a read (aka RRQ) request.<br>
</tt><tt><a
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2958">CVE-2009-2958</a><br>
The tftp_request function in tftp.c in dnsmasq before 2.50, when
--enable-tftp is used, allows remote attackers to cause a denial of
service (NULL pointer dereference and daemon crash) via a TFTP read
(aka RRQ) request with a malformed blksize option.</tt><br>
<tt><br>
[2.45-1.1.el5]<br>
- problems with strings when enabling tftp CVE-2009-2957 and
CVE-2009-2957<br>
- Resolves: rhbg#519021<br>
<br>
[2.45-1.el5.1]<br>
- update to new upstream version<br>
- fixes for CVE-2008-1447/CERT VU#800113<br>
- Resolves: rhbz#454869<br>
<br>
</tt>
</body>
</html>