Wiki » Support/Advisories/MGASA-2012-0195

MGASA-2012-0195

Date:	August 2nd, 2012
Affected releases:	1, 2

Description:
Updated rocksndiamonds package fixes security vulnerability:

Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1
allows local users to overwrite arbitrary files via a symlink attack on
.rocksndiamonds/cache/artworkinfo.cache under a user's home directory
(CVE-2011-4606).

Note: if you have previously played rocksndiamonds, you'll need to
manually fix the permissions (e.g. chmod 700 ~/.rocksndiamonds).

Updated Packages:
Mageia 1:
rocksndiamonds-3.3.0.1-2.1.mga1

Mageia 2:
rocksndiamonds-3.3.0.1-2.1.mga2

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4606
http://lists.fedoraproject.org/pipermail/package-announce/2012-February/073481.html
https://bugs.mageia.org/show_bug.cgi?id=6884