Welcome to our website
To take full advantage of all features you need to login or register. Registration is completely free and takes only a few seconds.
4 Security Updates for Gentoo
Posted by Philipp Esselbach on: 09/07/2010 08:20 PM [ Print | 0 comment(s) ]
4 new security updates are available for Gentoo Linux
- [ GLSA 201009-03 ] sudo: Privilege Escalation
- [ GLSA 201009-06 ] Clam AntiVirus: Multiple vulnerabilities
- [ GLSA 201009-05 ] Adobe Reader: Multiple vulnerabilities
- [ GLSA 201009-04 ] SARG: User-assisted execution of arbitrary code
- [ GLSA 201009-03 ] sudo: Privilege Escalation
- [ GLSA 201009-06 ] Clam AntiVirus: Multiple vulnerabilities
- [ GLSA 201009-05 ] Adobe Reader: Multiple vulnerabilities
- [ GLSA 201009-04 ] SARG: User-assisted execution of arbitrary code
[gentoo-announce] [ GLSA 201009-03 ] sudo: Privilege Escalation
[gentoo-announce] [ GLSA 201009-06 ] Clam AntiVirus: Multiple vulnerabilities
[gentoo-announce] [ GLSA 201009-05 ] Adobe Reader: Multiple vulnerabilities
[gentoo-announce] [ GLSA 201009-04 ] SARG: User-assisted execution of arbitrary code
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: sudo: Privilege Escalation
Date: September 07, 2010
Bugs: #322517, #335381
ID: 201009-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
The secure path feature and group handling in sudo allow local
attackers to escalate privileges.
Background
==========
sudo allows a system administrator to give users the ability to run
commands as other users.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-admin/sudo < 1.7.4_p3-r1 >= 1.7.4_p3-r1
Description
===========
Multiple vulnerabilities have been reported in sudo:
* Evan Broder and Anders Kaseorg of Ksplice, Inc. reported that the
sudo 'secure path' feature does not properly handle multiple PATH
variables (CVE-2010-1646).
* Markus Wuethrich of Swiss Post reported that sudo fails to restrict
access when using Runas groups and the group (-g) command line option
(CVE-2010-2956).
Impact
======
A local attacker could exploit these vulnerabilities to gain the
ability to run certain commands with the privileges of other users,
including root, depending on the configuration.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All sudo users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/sudo-1.7.4_p3-r1"
References
==========
[ 1 ] CVE-2010-1646
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646
[ 2 ] CVE-2010-2956
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2956
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-03.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 201009-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: sudo: Privilege Escalation
Date: September 07, 2010
Bugs: #322517, #335381
ID: 201009-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
The secure path feature and group handling in sudo allow local
attackers to escalate privileges.
Background
==========
sudo allows a system administrator to give users the ability to run
commands as other users.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-admin/sudo < 1.7.4_p3-r1 >= 1.7.4_p3-r1
Description
===========
Multiple vulnerabilities have been reported in sudo:
* Evan Broder and Anders Kaseorg of Ksplice, Inc. reported that the
sudo 'secure path' feature does not properly handle multiple PATH
variables (CVE-2010-1646).
* Markus Wuethrich of Swiss Post reported that sudo fails to restrict
access when using Runas groups and the group (-g) command line option
(CVE-2010-2956).
Impact
======
A local attacker could exploit these vulnerabilities to gain the
ability to run certain commands with the privileges of other users,
including root, depending on the configuration.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All sudo users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/sudo-1.7.4_p3-r1"
References
==========
[ 1 ] CVE-2010-1646
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646
[ 2 ] CVE-2010-2956
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2956
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-03.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
[gentoo-announce] [ GLSA 201009-06 ] Clam AntiVirus: Multiple vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Clam AntiVirus: Multiple vulnerabilities
Date: September 07, 2010
Bugs: #314087, #321157
ID: 201009-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Clam AntiVirus.
Background
==========
Clam AntiVirus (short: ClamAV) is an anti-virus toolkit for UNIX,
designed especially for e-mail scanning on mail gateways.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-antivirus/clamav < 0.96.1 >= 0.96.1
Description
===========
Multiple vulnerabilities were discovered in Clam AntiVirus. For further
information, please consult the CVE entries referenced below.
Impact
======
A remote attacker could possibly bypass virus detection or cause a
Denial of Service.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Clam AntiVirus users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.96.1"
References
==========
[ 1 ] CVE-2010-0098
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0098
[ 2 ] CVE-2010-1311
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1311
[ 3 ] CVE-2010-1639
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1639
[ 4 ] CVE-2010-1640
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1640
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-06.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 201009-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Clam AntiVirus: Multiple vulnerabilities
Date: September 07, 2010
Bugs: #314087, #321157
ID: 201009-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Clam AntiVirus.
Background
==========
Clam AntiVirus (short: ClamAV) is an anti-virus toolkit for UNIX,
designed especially for e-mail scanning on mail gateways.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-antivirus/clamav < 0.96.1 >= 0.96.1
Description
===========
Multiple vulnerabilities were discovered in Clam AntiVirus. For further
information, please consult the CVE entries referenced below.
Impact
======
A remote attacker could possibly bypass virus detection or cause a
Denial of Service.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Clam AntiVirus users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.96.1"
References
==========
[ 1 ] CVE-2010-0098
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0098
[ 2 ] CVE-2010-1311
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1311
[ 3 ] CVE-2010-1639
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1639
[ 4 ] CVE-2010-1640
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1640
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-06.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
[gentoo-announce] [ GLSA 201009-05 ] Adobe Reader: Multiple vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Adobe Reader: Multiple vulnerabilities
Date: September 07, 2010
Bugs: #297385, #306429, #313343, #322857
ID: 201009-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities in Adobe Reader might result in the execution
of arbitrary code or other attacks.
Background
==========
Adobe Reader (formerly Adobe Acrobat Reader) is a closed-source PDF
reader.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-text/acroread < 9.3.4 >= 9.3.4
Description
===========
Multiple vulnerabilities were discovered in Adobe Reader. For further
information please consult the CVE entries and the Adobe Security
Bulletins referenced below.
Impact
======
A remote attacker might entice a user to open a specially crafted PDF
file, possibly resulting in the execution of arbitrary code with the
privileges of the user running the application, or bypass intended
sandbox restrictions, make cross-domain requests, inject arbitrary web
script or HTML, or cause a Denial of Service condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Reader users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.3.4"
References
==========
[ 1 ] APSA10-01
http://www.adobe.com/support/security/advisories/apsa10-01.html
[ 2 ] APSB10-02
http://www.adobe.com/support/security/bulletins/apsb10-02.html
[ 3 ] APSB10-07
http://www.adobe.com/support/security/bulletins/apsb10-07.html
[ 4 ] APSB10-09
http://www.adobe.com/support/security/bulletins/apsb10-09.html
[ 5 ] APSB10-14
http://www.adobe.com/support/security/bulletins/apsb10-14.html
[ 6 ] APSB10-16
http://www.adobe.com/support/security/bulletins/apsb10-16.html
[ 7 ] CVE-2009-3953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953
[ 8 ] CVE-2009-4324
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324
[ 9 ] CVE-2010-0186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186
[ 10 ] CVE-2010-0188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188
[ 11 ] CVE-2010-0190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190
[ 12 ] CVE-2010-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191
[ 13 ] CVE-2010-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192
[ 14 ] CVE-2010-0193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193
[ 15 ] CVE-2010-0194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194
[ 16 ] CVE-2010-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195
[ 17 ] CVE-2010-0196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196
[ 18 ] CVE-2010-0197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197
[ 19 ] CVE-2010-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198
[ 20 ] CVE-2010-0199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199
[ 21 ] CVE-2010-0201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201
[ 22 ] CVE-2010-0202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202
[ 23 ] CVE-2010-0203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203
[ 24 ] CVE-2010-0204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204
[ 25 ] CVE-2010-1241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241
[ 26 ] CVE-2010-1285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285
[ 27 ] CVE-2010-1295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295
[ 28 ] CVE-2010-1297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297
[ 29 ] CVE-2010-2168
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168
[ 30 ] CVE-2010-2201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201
[ 31 ] CVE-2010-2202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202
[ 32 ] CVE-2010-2203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203
[ 33 ] CVE-2010-2204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204
[ 34 ] CVE-2010-2205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205
[ 35 ] CVE-2010-2206
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206
[ 36 ] CVE-2010-2207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207
[ 37 ] CVE-2010-2208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208
[ 38 ] CVE-2010-2209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209
[ 39 ] CVE-2010-2210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210
[ 40 ] CVE-2010-2211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211
[ 41 ] CVE-2010-2212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-05.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 201009-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Adobe Reader: Multiple vulnerabilities
Date: September 07, 2010
Bugs: #297385, #306429, #313343, #322857
ID: 201009-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities in Adobe Reader might result in the execution
of arbitrary code or other attacks.
Background
==========
Adobe Reader (formerly Adobe Acrobat Reader) is a closed-source PDF
reader.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-text/acroread < 9.3.4 >= 9.3.4
Description
===========
Multiple vulnerabilities were discovered in Adobe Reader. For further
information please consult the CVE entries and the Adobe Security
Bulletins referenced below.
Impact
======
A remote attacker might entice a user to open a specially crafted PDF
file, possibly resulting in the execution of arbitrary code with the
privileges of the user running the application, or bypass intended
sandbox restrictions, make cross-domain requests, inject arbitrary web
script or HTML, or cause a Denial of Service condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Reader users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.3.4"
References
==========
[ 1 ] APSA10-01
http://www.adobe.com/support/security/advisories/apsa10-01.html
[ 2 ] APSB10-02
http://www.adobe.com/support/security/bulletins/apsb10-02.html
[ 3 ] APSB10-07
http://www.adobe.com/support/security/bulletins/apsb10-07.html
[ 4 ] APSB10-09
http://www.adobe.com/support/security/bulletins/apsb10-09.html
[ 5 ] APSB10-14
http://www.adobe.com/support/security/bulletins/apsb10-14.html
[ 6 ] APSB10-16
http://www.adobe.com/support/security/bulletins/apsb10-16.html
[ 7 ] CVE-2009-3953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953
[ 8 ] CVE-2009-4324
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324
[ 9 ] CVE-2010-0186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186
[ 10 ] CVE-2010-0188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188
[ 11 ] CVE-2010-0190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190
[ 12 ] CVE-2010-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191
[ 13 ] CVE-2010-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192
[ 14 ] CVE-2010-0193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193
[ 15 ] CVE-2010-0194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194
[ 16 ] CVE-2010-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195
[ 17 ] CVE-2010-0196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196
[ 18 ] CVE-2010-0197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197
[ 19 ] CVE-2010-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198
[ 20 ] CVE-2010-0199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199
[ 21 ] CVE-2010-0201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201
[ 22 ] CVE-2010-0202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202
[ 23 ] CVE-2010-0203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203
[ 24 ] CVE-2010-0204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204
[ 25 ] CVE-2010-1241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241
[ 26 ] CVE-2010-1285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285
[ 27 ] CVE-2010-1295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295
[ 28 ] CVE-2010-1297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297
[ 29 ] CVE-2010-2168
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168
[ 30 ] CVE-2010-2201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201
[ 31 ] CVE-2010-2202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202
[ 32 ] CVE-2010-2203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203
[ 33 ] CVE-2010-2204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204
[ 34 ] CVE-2010-2205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205
[ 35 ] CVE-2010-2206
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206
[ 36 ] CVE-2010-2207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207
[ 37 ] CVE-2010-2208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208
[ 38 ] CVE-2010-2209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209
[ 39 ] CVE-2010-2210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210
[ 40 ] CVE-2010-2211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211
[ 41 ] CVE-2010-2212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-05.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
[gentoo-announce] [ GLSA 201009-04 ] SARG: User-assisted execution of arbitrary code
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: SARG: User-assisted execution of arbitrary code
Date: September 07, 2010
Bugs: #222121
ID: 201009-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple stack-based buffer overflow vulnerabilities were discovered in
SARG allowing for remote code execution.
Background
==========
SARG is the Squid Analysis Report Generator.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-analyzer/sarg < 2.2.5-r5 >= 2.2.5-r5
Description
===========
Multiple vulnerabilities were discovered in SARG. For further
information please consult the CVE entries referenced below.
Impact
======
These vulnerabilities might allow attackers to execute arbitrary code
via unknown vectors.
NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since April 18, 2009. It is likely that your system is
already no longer affected by this issue.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All SARG users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/sarg-2.2.5-r5"
References
==========
[ 1 ] CVE-2008-1922
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1922
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-04.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 201009-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: SARG: User-assisted execution of arbitrary code
Date: September 07, 2010
Bugs: #222121
ID: 201009-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple stack-based buffer overflow vulnerabilities were discovered in
SARG allowing for remote code execution.
Background
==========
SARG is the Squid Analysis Report Generator.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-analyzer/sarg < 2.2.5-r5 >= 2.2.5-r5
Description
===========
Multiple vulnerabilities were discovered in SARG. For further
information please consult the CVE entries referenced below.
Impact
======
These vulnerabilities might allow attackers to execute arbitrary code
via unknown vectors.
NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since April 18, 2009. It is likely that your system is
already no longer affected by this issue.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All SARG users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/sarg-2.2.5-r5"
References
==========
[ 1 ] CVE-2008-1922
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1922
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-04.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
