Linux Compatible - Gentoo (Page 17)

GLSA 200502-13: Perl: Vulnerabilities in perl-suid wrapper

Gentoo 2529 Published 2005-02-11 17:48 by Philipp Esselbach 0

A Perl security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: Perl: Vulnerabilities in perl-suid wrapper
Date: February 11, 2005
Bugs: #80460
ID: 200502-13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Vulnerabilities leading to file overwriting and code execution with elevated privileges have been discovered in the perl-suid wrapper.

GLSA 200502-12: Webmin: Information leak in Gentoo binary

Gentoo 2529 Published 2005-02-11 17:46 by Philipp Esselbach 0

A Webmin security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Webmin: Information leak in Gentoo binary package
Date: February 11, 2005
Bugs: #77731
ID: 200502-12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Portage-built Webmin binary packages accidentally include a file containing the local encrypted root password.

GLSA 200501-45: Gallery: Cross-site scripting vulne

Gentoo 2529 Published 2005-02-10 17:24 by Philipp Esselbach 0

A Gallery update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory [UPDATE] GLSA 200501-45:03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Gallery: Cross-site scripting vulnerability
Date: January 30, 2005
Updated: February 10, 2005
Bugs: #78522
ID: 200501-45:03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Update
=====

The cross-site scripting vulnerability that Gallery 1.4.4-pl5 was intended to fix, did not actually resolve the issue. The Gallery Development Team have released version 1.4.4-pl6 to properly solve this problem.

GLSA 200502-11: Mailman: Directory traversal vulnerability

Gentoo 2529 Published 2005-02-10 17:23 by Philipp Esselbach 0

A Mailman security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Mailman: Directory traversal vulnerability
Date: February 10, 2005
Bugs: #81109
ID: 200502-11

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Mailman fails to properly sanitize input, leading to information disclosure.

GLSA 200502-10: pdftohtml: Vulnerabilities in included Xpdf

Gentoo 2529 Published 2005-02-09 12:56 by Philipp Esselbach 0

A pdftohtml security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-10
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: pdftohtml: Vulnerabilities in included Xpdf
Date: February 09, 2005
Bugs: #78629
ID: 200502-10

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

pdftohtml includes vulnerable Xpdf code to handle PDF files, making it vulnerable to execution of arbitrary code upon converting a malicious PDF file.

GLSA 200502-09: Python: Arbitrary code execution

Gentoo 2529 Published 2005-02-08 17:27 by Philipp Esselbach 0

A Python security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: Python: Arbitrary code execution through SimpleXMLRPCServer
Date: February 08, 2005
Bugs: #80592
ID: 200502-09

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Python-based XML-RPC servers may be vulnerable to remote execution of arbitrary code.

GLSA 200502-08: PostgreSQL: Local privilege escalation

Gentoo 2529 Published 2005-02-07 14:41 by Philipp Esselbach 0

A PostgreSQL security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: PostgreSQL: Local privilege escalation
Date: February 07, 2005
Bugs: #80342
ID: 200502-08

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

The PostgreSQL server can be tricked by a local attacker to execute arbitrary code.

GLSA 200502-07: OpenMotif: Multiple vulnerabilities in libX

Gentoo 2529 Published 2005-02-07 14:06 by Philipp Esselbach 0

An OpenMotif security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: OpenMotif: Multiple vulnerabilities in libXpm
Date: February 07, 2005
Bugs: #78111
ID: 200502-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Multiple vulnerabilities have been discovered in libXpm, which is included in OpenMotif, that can potentially lead to remote code execution.

GLSA 200502-06: LessTif: Multiple vulnerabilities in libXpm

Gentoo 2529 Published 2005-02-06 16:44 by Philipp Esselbach 0

A LessTif security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: LessTif: Multiple vulnerabilities in libXpm
Date: February 06, 2005
Bugs: #78483
ID: 200502-06

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Multiple vulnerabilities have been discovered in libXpm, which is included in LessTif, that can potentially lead to remote code execution.

GLSA 200502-05: Newspost: Buffer overflow vulnerability

Gentoo 2529 Published 2005-02-03 06:03 by Philipp Esselbach 0

A newspost security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Newspost: Buffer overflow vulnerability
Date: February 03, 2005
Bugs: #78530
ID: 200502-05

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

A buffer overflow can be exploited to crash Newspost remotely and potentially execute arbitrary code.

GLSA 200502-04: Squid: Multiple vulnerabilities

Gentoo 2529 Published 2005-02-02 18:05 by Philipp Esselbach 0

A Squid security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-04:02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Squid: Multiple vulnerabilities
Date: February 02, 2005
Updated: February 02, 2005
Bugs: #79495, #78776, #80201, #80341
ID: 200502-04:02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Squid contains vulnerabilities in the code handling WCCP, HTTP and LDAP which could lead to Denial of Service, access control bypass, web cache and log poisoning.

GLSA 200502-03: enscript: Multiple vulnerabilities

Gentoo 2529 Published 2005-02-02 09:00 by Philipp Esselbach 0

An enscript security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: enscript: Multiple vulnerabilities
Date: February 02, 2005
Bugs: #77408
ID: 200502-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

enscript suffers from vulnerabilities and design flaws, potentially resulting in the execution of arbitrary code.

GLSA 200502-02: UW IMAP: CRAM-MD5 authentication bypass

Gentoo 2529 Published 2005-02-02 05:43 by Philipp Esselbach 0

An UW IMAP security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: UW IMAP: CRAM-MD5 authentication bypass
Date: February 02, 2005
Bugs: #79874
ID: 200502-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

UW IMAP contains a vulnerability in the code handling CRAM-MD5 authentication allowing authentication bypass.

GLSA 200502-01: FireHOL: Insecure temporary file creation

Gentoo 2529 Published 2005-02-02 04:47 by Philipp Esselbach 0

A FireHOL security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200502-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: FireHOL: Insecure temporary file creation
Date: February 01, 2005
Bugs: #79330
ID: 200502-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

FireHOL is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.

GLSA 200501-46: ClamAV

Gentoo 2529 Published 2005-01-31 17:23 by Philipp Esselbach 0

A ClamAV security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-46
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: ClamAV: Multiple issues
Date: January 31, 2005
Bugs: #78656, #79194
ID: 200501-46

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

ClamAV contains two vulnerabilities that could lead to Denial of Service and evasion of virus scanning.

GLSA 200501-45: Gallery: Cross-site scripting vulnerability

Gentoo 2529 Published 2005-01-30 18:11 by Philipp Esselbach 0

A Gallery security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-45
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: Gallery: Cross-site scripting vulnerability
Date: January 30, 2005
Bugs: #78522
ID: 200501-45

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

Gallery is vulnerable to cross-site scripting attacks.

Background
=========

Gallery is a web application written in PHP which is used to organize and publish photo albums. It allows multiple users to build and maintain their own albums. It also supports the mirroring of images on other servers.

Affected packages
================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-apps/gallery = 1.4.4_p5

Description
==========

Rafel Ivgi has discovered a cross-site scripting vulnerability where the 'username' parameter is not properly sanitized in 'login.php'.

Impact
=====

By sending a carefully crafted URL, an attacker can inject and execute script code in the victim's browser window, and potentially compromise the user's gallery.

Workaround
=========

There is no known workaround at this time.

Resolution
=========

All Gallery users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/gallery-1.4.4_p5"

References
=========

[ 1 ] Gallery Announcement
http://gallery.menalto.com/modules.php?op=modload&name=News&file=article&sid=147
[ 2 ] Secunia Advisory SA13887
http://secunia.com/advisories/13887/

Availability
===========

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200501-45.xml

Concerns?
========

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License
======

Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

GLSA 200501-44: ncpfs: Multiple vulnerabilities

Gentoo 2529 Published 2005-01-30 18:10 by Philipp Esselbach 0

A ncpfs security update is available for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-44
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: ncpfs: Multiple vulnerabilities
Date: January 30, 2005
Bugs: #77414
ID: 200501-44

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

The ncpfs utilities contain multiple flaws, potentially resulting in the remote execution of arbitrary code or local file access with elevated privileges.

Background
=========

ncpfs is a NCP protocol network filesystem driver that allows access to NetWare services, to mount volumes of NetWare servers or print to NetWare print queues.

Affected packages
================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-fs/ncpfs < 2.2.6 >= 2.2.6

Description
==========

Erik Sjolund discovered two vulnerabilities in the programs bundled with ncpfs: there is a potentially exploitable buffer overflow in ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities using the NetWare client functions insecurely access files with elevated privileges (CAN-2005-0013).

Impact
=====

The buffer overflow might allow a malicious remote NetWare server to execute arbitrary code on the NetWare client. Furthermore, a local attacker may be able to create links and access files with elevated privileges using SUID ncpfs utilities.

Workaround
=========

There is no known workaround at this time.

Resolution
=========

All ncpfs users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-fs/ncpfs-2.2.6"

References
=========

[ 1 ] CAN-2005-0013
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0013
[ 2 ] CAN-2005-0014
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0014
[ 3 ] ncpfs ChangeLog
ftp://platan.vc.cvut.cz/pub/linux/ncpfs/Changes-2.2.6

Availability
===========

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200501-44.xml

Concerns?
========

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License
======

Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

GLSA 200501-43: f2c: Insecure temporary file creation

Gentoo 2529 Published 2005-01-30 18:09 by Philipp Esselbach 0

A f2c security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-43
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: f2c: Insecure temporary file creation
Date: January 30, 2005
Bugs: #79725
ID: 200501-43

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

f2c is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.

GLSA 200501-42: VDR: Arbitrary file overwriting issue

Gentoo 2529 Published 2005-01-30 18:08 by Philipp Esselbach 0

A VDR security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-42
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: VDR: Arbitrary file overwriting issue
Date: January 30, 2005
Bugs: #78230
ID: 200501-42

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

VDR insecurely accesses files with elevated privileges, which may result in the overwriting of arbitrary files.

GLSA 200501-41: TikiWiki: Arbitrary command execution

Gentoo 2529 Published 2005-01-30 04:37 by Philipp Esselbach 0

A TikiWiki security update has been released for Gentoo Linux

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-41
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: TikiWiki: Arbitrary command execution
Date: January 30, 2005
Bugs: #78944
ID: 200501-41

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======

A bug in TikiWiki allows certain users to upload and execute malicious PHP scripts.