Fedora Update Notification
FEDORA-2004-112
2004-04-30
---------------------------------------------------------------------

Name        : mc
Version     : 4.6.0                      
Release     : 14.10                  
Summary     : User-friendly text console file manager and visual shell.
Description :
Midnight Commander is a visual shell much like a file manager, only
with many more features. It is a text mode application, but it also
includes mouse support if you are running GPM. Midnight Commander's
best features are its ability to FTP, view tar and zip files, and to
poke into RPMs for specific files.

---------------------------------------------------------------------
Update Information:

Several buffer overflows, several temporary file creation
vulnerabilities, and one format string vulnerability have been
discovered in Midnight Commander.  These vulnerabilities were
discovered mostly by Andrew V. Samoilov and Pavel Roskin.  The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the names CAN-2004-0226, CAN-2004-0231, and CAN-2004-0232 to these
issues.

---------------------------------------------------------------------
* Fri Apr 16 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-14.10

- don't use mmap if st_size doesn't fit into size_t
- fix one missed match_normal -> match_regex
- rebuilt for FC1 updates

* Fri Apr 16 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-14

- avoid buffer overflows in mcedit Replace function

* Wed Apr 14 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-13

- perl scripting fix

* Wed Apr 14 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-12

- fix a bug in complete.c introduced by last patch
- export MC_TMPDIR env variable
- avoid integer overflows in free diskspace % counting
- put temporary files into $MC_TMPDIR tree if possible,
  use mktemp/mkdtemp

* Mon Apr 05 2004 Jakub Jelinek <jakub@redhat.com> 4.6.0-11

- fix a bunch of buffer overflows and memory leaks (CAN-2004-0226)
- fix hardlink handling in cpio filesystem
- fix handling of filenames with single/double quotes and backslashes
  in /usr/share/mc/extfs/rpm
- update php.syntax file (#112645)
- fix crash with large syntax file (#112644)
- update CAN-2003-1023 fix to still make vfs symlinks relative,
  but with bounds checking

---------------------------------------------------------------------
This update can be downloaded from:
    

b032b48a63ae1f70296d541e470bd9df  SRPMS/mc-4.6.0-14.10.src.rpm
a7ccdcc1744b3ebb1c14842d5a94a437  i386/mc-4.6.0-14.10.i386.rpm
b4a4085af11f8bb7da015080e9ae9301  i386/debug/mc-debuginfo-4.6.0-14.10.i386.rpm
4dbc04a7c8795eeb5098a6d8a87ed38b  x86_64/mc-4.6.0-14.10.x86_64.rpm
6c3a6ec0e4a85269be2438791c7eb2e7  x86_64/debug/mc-debuginfo-4.6.0-14.10.x86_64.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.