Linux Compatible - Gentoo (Page 11)

GLSA 200411-11: ImageMagick: EXIF buffer overflow

Gentoo 2535 Published 2004-11-06 20:43 by Philipp Esselbach 0

An ImageMagick security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-11:01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: ImageMagick: EXIF buffer overflow
Date: November 06, 2004
Bugs: #69825
ID: 200411-11:01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

ImageMagick contains an error in boundary checks when handling EXIF information, which could lead to arbitrary code execution.

GLSA 200411-10: Gallery: Cross-site scripting vulnerability

Gentoo 2535 Published 2004-11-06 20:41 by Philipp Esselbach 0

A Gallery security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-10:01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Gallery: Cross-site scripting vulnerability
Date: November 06, 2004
Bugs: #69904
ID: 200411-10:01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Gallery is vulnerable to cross-site scripting attacks.

GLSA 200411-09: shadow: Unauthorized modification of account

Gentoo 2535 Published 2004-11-04 15:49 by Philipp Esselbach 0

A shadow security update has been released

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: shadow: Unauthorized modification of account information
Date: November 04, 2004
Bugs: #69212
ID: 200411-09

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

A flaw in the chfn and chsh utilities might allow modification of account properties by unauthorized users.

GLSA 200411-08: GD: Integer overflow

Gentoo 2535 Published 2004-11-04 12:04 by Philipp Esselbach 0

A GD security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: GD: Integer overflow
Date: November 03, 2004
Bugs: #69070
ID: 200411-08

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

The PNG image decoding routines in the GD library contain an integer overflow that may allow execution of arbitrary code with the rights of the program decoding a malicious PNG image.

GLSA 200411-07: Proxytunnel: Format string vulnerability

Gentoo 2535 Published 2004-11-04 11:21 by Philipp Esselbach 0

A Proxytunnel security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Proxytunnel: Format string vulnerability
Date: November 03, 2004
Bugs: #69379
ID: 200411-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Proxytunnel is vulnerable to a format string vulnerability, potentially allowing a remote server to execute arbitrary code with the rights of the Proxytunnel process.

GLSA 200411-06: MIME-tools: Virus detection evasion

Gentoo 2535 Published 2004-11-02 16:56 by Philipp Esselbach 0

A MIME-tools security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: MIME-tools: Virus detection evasion
Date: November 02, 2004
Bugs: #69181
ID: 200411-06

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

MIME-tools doesn't handle empty MIME boundaries correctly. This may prevent some virus-scanning programs which use MIME-tools from detecting certain viruses.

GLSA 200411-05: libxml2: Remotely exploitable buffer overflow

Gentoo 2535 Published 2004-11-02 16:45 by Philipp Esselbach 0

A libxml2 security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: libxml2: Remotely exploitable buffer overflow
Date: November 02, 2004
Bugs: #69154
ID: 200411-05

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

libxml2 contains multiple buffer overflows which could lead to the execution of arbitrary code.

GLSA 200411-01: ppp: No denial of service

Gentoo 2535 Published 2004-11-02 16:28 by Philipp Esselbach 0

A ppp security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: ppp: No denial of service vulnerability
Date: November 01, 2004
Bugs: #69152
ID: 200411-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

pppd contains a bug that allows an attacker to crash his own connection, but it cannot be used to deny service to other users.

GLSA 200411-04: Speedtouch USB driver: Privilege escalation

Gentoo 2535 Published 2004-11-02 09:52 by Philipp Esselbach 0

An updated Speedtouch USB driver has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: Speedtouch USB driver: Privilege escalation vulnerability
Date: November 02, 2004
Bugs: #68436
ID: 200411-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability in the Speedtouch USB driver can be exploited to allow local users to execute arbitrary code with escalated privileges.

GLSA 200411-03: Apache 1.3: Buffer overflow vulnerability

Gentoo 2535 Published 2004-11-02 09:51 by Philipp Esselbach 0

An Apache security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Apache 1.3: Buffer overflow vulnerability in mod_include
Date: November 02, 2004
Bugs: #68564
ID: 200411-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

A buffer overflow vulnerability exists in mod_include which could possibly allow a local attacker to gain escalated privileges.

GLSA 200411-02: Cherokee: Format string vulnerability

Gentoo 2535 Published 2004-11-01 16:52 by Philipp Esselbach 0

A Cherokee update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: Cherokee: Format string vulnerability
Date: November 01, 2004
Bugs: #67667
ID: 200411-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Cherokee contains a format string vulnerability that could lead to denial of service or the execution of arbitary code.

GLSA 200411-01: ppp: Remote denial of service vulnerability

Gentoo 2535 Published 2004-11-01 16:46 by Philipp Esselbach 0

A ppp security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200411-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: ppp: Remote denial of service vulnerability
Date: November 01, 2004
Bugs: #69152
ID: 200411-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

pppd contains a vulnerability that may allow an attacker to crash the server.

GLSA 200410-31: Archive::Zip: Virus detection evasion

Gentoo 2535 Published 2004-10-29 17:25 by Philipp Esselbach 0

An Archive::Zip update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-31
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Archive::Zip: Virus detection evasion
Date: October 29, 2004
Bugs: #68616
ID: 200410-31

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Email virus scanning software relying on Archive::Zip can be fooled into thinking a ZIP attachment is empty while it contains a virus, allowing detection evasion.

GLSA 200410-30: GPdf, KPDF, KOffice

Gentoo 2535 Published 2004-10-28 06:55 by Philipp Esselbach 0

GPdf, KPDF, and KOffice security updates are available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-30
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: GPdf, KPDF, KOffice: Vulnerabilities in included xpdf
Date: October 28, 2004
Bugs: #68558, #68665, #68571
ID: 200410-30

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

GPdf, KPDF and KOffice all include vulnerable xpdf code to handle PDF files, making them vulnerable to execution of arbitrary code upon viewing a malicious PDF file.

GLSA 200410-29: PuTTY: Pre-authentication buffer overflow

Gentoo 2535 Published 2004-10-27 18:20 by Philipp Esselbach 0

A PuTTY security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-29
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: PuTTY: Pre-authentication buffer overflow
Date: October 27, 2004
Bugs: #69123
ID: 200410-29

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

PuTTY contains a vulnerability allowing an SSH server to execute arbitrary code on the connecting client.

GLSA 200410-28: rssh: Format string vulnerability

Gentoo 2535 Published 2004-10-27 18:02 by Philipp Esselbach 0

A rssh security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-28
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: rssh: Format string vulnerability
Date: October 27, 2004
Bugs: #66988
ID: 200410-28

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

rssh is vulnerable to a format string vulnerability that allows arbitrary execution of code with the rights of the connected user, thereby bypassing rssh restrictions.

GLSA 200410-27: mpg123: Buffer overflow vulnerabilities

Gentoo 2535 Published 2004-10-27 18:01 by Philipp Esselbach 0

A mpg123 security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-27
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: mpg123: Buffer overflow vulnerabilities
Date: October 27, 2004
Bugs: #68343
ID: 200410-27

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Buffer overflow vulnerabilities have been found in mpg123 which could lead to execution of arbitrary code.

GLSA 200410-26: socat: Format string vulnerability

Gentoo 2535 Published 2004-10-25 15:34 by Philipp Esselbach 0

A socat security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: socat: Format string vulnerability
Date: October 25, 2004
Bugs: #68547
ID: 200410-26

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

socat contains a format string vulnerability that can potentially lead to remote or local execution of arbitrary code with the privileges of the socat process.

GLSA 200410-25: Netatalk: Insecure tempfile handling

Gentoo 2535 Published 2004-10-25 15:29 by Philipp Esselbach 0

A Netatalk security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-25
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Netatalk: Insecure tempfile handling in etc2ps.sh
Date: October 25, 2004
Bugs: #66370
ID: 200410-25

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The etc2ps.sh script, included in the Netatalk package, is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the utility.

GLSA 200410-24: MIT krb5: Insecure temporary file

Gentoo 2535 Published 2004-10-25 15:27 by Philipp Esselbach 0

A MIT krb5 security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200410-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: MIT krb5: Insecure temporary file use in send-pr.sh
Date: October 25, 2004
Bugs: #66359
ID: 200410-24

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

The send-pr.sh script, included in the mit-krb5 package, is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the utility.