Linux Compatible - Gentoo (Page 10)

GLSA 200410-23: Gaim: Multiple vulnerabilities

Gentoo 2535 Published 2004-10-24 15:34 by Philipp Esselbach 0

A Gaim security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-23
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: Gaim: Multiple vulnerabilities
Date: October 24, 2004
Bugs: #68271
ID: 200410-23

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Multiple vulnerabilities have been found in Gaim which could allow a remote attacker to crash the application, or possibly execute arbitrary code.

GLSA 200410-22: MySQL: Multiple vulnerabilities

Gentoo 2535 Published 2004-10-24 15:26 by Philipp Esselbach 0

A MySQL security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-22
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: MySQL: Multiple vulnerabilities
Date: October 24, 2004
Bugs: #67062
ID: 200410-22

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Several vulnerabilities including privilege abuse, Denial of Service, and potentially remote arbitrary code execution have been discovered in MySQL.

GLSA 200410-21: Apache 2, mod_ssl: Bypass of SSLCipherSuite

Gentoo 2535 Published 2004-10-21 18:30 by Philipp Esselbach 0

An Apache 2 security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-21
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Apache 2, mod_ssl: Bypass of SSLCipherSuite directive
Date: October 21, 2004
Bugs: #66807
ID: 200410-21

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

In certain configurations, it can be possible to bypass restrictions set by the "SSLCipherSuite" directive of mod_ssl.

GLSA 200410-20: Xpdf, CUPS: Multiple integer overflows

Gentoo 2535 Published 2004-10-21 11:38 by Philipp Esselbach 0

Xpdf and CUPS security updates are available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Xpdf, CUPS: Multiple integer overflows
Date: October 21, 2004
ID: 200410-20

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Multiple integer overflows were discovered in Xpdf, potentially resulting in execution of arbitrary code upon viewing a malicious PDF file. CUPS includes Xpdf code and therefore is vulnerable to the same issues.

GLSA 200410-19: glibc: Insecure tempfile handling in catchs

Gentoo 2535 Published 2004-10-21 11:34 by Philipp Esselbach 0

A glibc security update for Gentoo Linux is now available

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: glibc: Insecure tempfile handling in catchsegv script
Date: October 21, 2004
Bugs: #66358
ID: 200410-19

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The catchsegv script in the glibc package is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the script.

GLSA 200410-18: Ghostscript

Gentoo 2535 Published 2004-10-20 17:45 by Philipp Esselbach 0

A Ghostscript security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-18
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Ghostscript: Insecure temporary file use in multiple
scripts
Date: October 20, 2004
Bugs: #66357
ID: 200410-18

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Multiple scripts in the Ghostscript package are vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the script.

GLSA 200410-17: OpenOffice.org: Temporary files disclosure

Gentoo 2535 Published 2004-10-20 17:43 by Philipp Esselbach 0

An OpenOffice.org security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: OpenOffice.org: Temporary files disclosure
Date: October 20, 2004
Bugs: #63556
ID: 200410-17

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

OpenOffice.org uses insecure temporary files which could allow a malicious local user to gain knowledge of sensitive information from other users' documents.

GLSA 200410-16: PostgreSQL: Insecure temporary file use

Gentoo 2535 Published 2004-10-18 18:12 by Philipp Esselbach 0

A PostgreSQL security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: PostgreSQL: Insecure temporary file use in
make_oidjoins_check
Date: October 18, 2004
Bugs: #66371
ID: 200410-16

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

The make_oidjoins_check script, part of the PostgreSQL package, is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the utility.

GLSA 200410-15: Squid: Remote DoS vulnerability

Gentoo 2535 Published 2004-10-18 15:41 by Philipp Esselbach 0

A Squid security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Squid: Remote DoS vulnerability
Date: October 18, 2004
Bugs: #67167
ID: 200410-15

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Squid contains a vulnerability in the SNMP module which may lead to a denial of service.

GLSA 200410-14: phpMyAdmin

Gentoo 2535 Published 2004-10-18 08:03 by Philipp Esselbach 0

A phpMyAdmin security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: phpMyAdmin: Vulnerability in MIME-based transformation
system
Date: October 18, 2004
Bugs: #67409
ID: 200410-14

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

A vulnerability has been found in the MIME-based transformation system of phpMyAdmin, which may allow remote execution of arbitrary commands if PHP's "safe mode" is disabled.

GLSA 200410-13: BNC: Input validation flaw

Gentoo 2535 Published 2004-10-15 15:18 by Philipp Esselbach 0

A BNC security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: BNC: Input validation flaw
Date: October 15, 2004
Bugs: #66912
ID: 200410-13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

BNC contains an input validation flaw which might allow a remote attacker to issue arbitrary IRC related commands.

GLSA 200410-12: WordPress: HTTP response splitting and XSS

Gentoo 2535 Published 2004-10-14 16:43 by Philipp Esselbach 0

A WordPress security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: WordPress: HTTP response splitting and XSS vulnerabilities
Date: October 14, 2004
Bugs: #65798
ID: 200410-12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

WordPress contains HTTP response splitting and cross-site scripting vulnerabilities.

GLSA 200410-11: tiff: Buffer overflows in image decoding

Gentoo 2535 Published 2004-10-13 16:03 by Philipp Esselbach 0

A tiff security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: tiff: Buffer overflows in image decoding
Date: October 13, 2004
ID: 200410-11

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Multiple heap-based overflows have been found in the tiff library image decoding routines, potentially allowing to execute arbitrary code with the rights of the user viewing a malicious image.

GLSA 200410-10: gettext: Insecure temporary file handling

Gentoo 2535 Published 2004-10-10 20:18 by Philipp Esselbach 0

A gettext security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-10
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: gettext: Insecure temporary file handling
Date: October 10, 2004
Bugs: #66355
ID: 200410-10

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The gettext utility is vulnerable to symlink attacks, potentially allowing a local user to overwrite or change permissions on arbitrary files with the rights of the user running gettext, which could be the root user.

GLSA 200410-09: LessTif: Integer and stack overflows in lib

Gentoo 2535 Published 2004-10-10 07:11 by Philipp Esselbach 0

A LessTif security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: LessTif: Integer and stack overflows in libXpm
Date: October 09, 2004
Bugs: #66647
ID: 200410-09

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been discovered in libXpm, which is included in LessTif, that can potentially lead to remote code execution.

GLSA 200410-08: ncompress: Buffer overflow

Gentoo 2535 Published 2004-10-09 15:47 by Philipp Esselbach 0

A ncompress security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: ncompress: Buffer overflow
Date: October 09, 2004
Bugs: #66251
ID: 200410-08

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

compress and uncompress, which could be used by daemon programs, contain a buffer overflow that could lead to remote execution of arbitrary code with the rights of the daemon process.

GLSA 200410-07: ed: Insecure temporary file handling

Gentoo 2535 Published 2004-10-09 15:45 by Philipp Esselbach 0

An ed security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: ed: Insecure temporary file handling
Date: October 09, 2004
Bugs: #66400
ID: 200410-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

The ed utility is vulnerable to symlink attacks, potentially allowing a local user to overwrite or change rights on arbitrary files with the rights of the user running ed, which could be the root user.

GLSA 200410-06: CUPS: Leakage of sensitive information

Gentoo 2535 Published 2004-10-09 15:33 by Philipp Esselbach 0

A CUPS security update has been released for Debian GNU/Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: CUPS: Leakage of sensitive information
Date: October 09, 2004
Bugs: #66501
ID: 200410-06

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

CUPS leaks information about user names and passwords when using remote printing to SMB-shared printers which require authentication.

Background
=========

The Common UNIX Printing System (CUPS) is a cross-platform print spooler.

Affected packages
================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-print/cups = 1.1.20-r3
== 1.1.21 >= 1.1.21-r1

Description
==========

When printing to a SMB-shared printer requiring authentication, CUPS leaks the user name and password to a logfile.

Impact
=====

A local user could gain knowledge of sensitive authentication data.

Workaround
=========

There is no known workaround at this time.

Resolution
=========

All CUPS users should upgrade to the latest version:

# emerge sync

# emerge -pv ">=net-print/cups-1.1.20-r3"
# emerge ">=net-print/cups-1.1.20-r3"

References
=========

[ 1 ] CAN-2004-0923
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0923

Availability
===========

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200410-06.xml

Concerns?
========

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License
======

Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

GLSA 200410-05: Cyrus-SASL: Buffer overflow

Gentoo 2535 Published 2004-10-07 11:40 by Philipp Esselbach 0

A Cyrus-SASL security updates has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities
Date: October 07, 2004
Bugs: #56016
ID: 200410-05

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Cyrus-SASL contains two vulnerabilities that might allow an attacker to completely compromise the vulnerable system.

GLSA 200410-04: PHP: Memory disclosure

Gentoo 2535 Published 2004-10-06 05:39 by Philipp Esselbach 0

A PHP security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: PHP: Memory disclosure and arbitrary location file upload
Date: October 06, 2004
Bugs: #64223
ID: 200410-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Two bugs in PHP may allow the disclosure of portions of memory and allow remote attackers to upload files to arbitrary locations.