Updated libxml2 packages are available for Red Hat Linux 7.3
-----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated libxml2 resolves security vulnerability
Advisory ID: FLSA:1324
Issue date: 2004-10-04
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1324
CVE Names: CAN-2004-0110
-----------------------------------------------------------------------
-----------------------------------------------------------------------
1. Topic:
[Updated 4th October 2004]
The packages contained in the original release of this advisory were missing python 2.2 support. These updated packages restore the missing functionality.
Updated libxml2 packages that fix an overflow when parsing remote resources are now available.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Updated cyrus-sasl packages are available for Red Hat Enterprise Linux 2.1 and 3
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated cyrus-sasl packages fix security flaw
Advisory ID: RHSA-2004:546-01
Issue date: 2004-10-07
Updated on: 2004-10-07
Product: Red Hat Enterprise Linux
Keywords: environment
CVE Names: CAN-2004-0884
----------------------------------------------------------------------
1. Summary:
Updated cyrus-sasl packages that fix a setuid and setgid application vulnerability are now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, ppc64, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat has released updated XFree86 packages for Red Hat Enterprise Linux 2.1
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated XFree86 packages fix security issues and bugs
Advisory ID: RHSA-2004:479-01
Issue date: 2004-10-06
Updated on: 2004-10-06
Product: Red Hat Enterprise Linux
Keywords: ATI Radeon 7000m
Obsoletes: RHBA-2004:155
CVE Names: CAN-2004-0687 CAN-2004-0688 CAN-2004-0692
----------------------------------------------------------------------
1. Summary:
Updated XFree86 packages that fix several security issues in libXpm, as well as other bug fixes, are now available for Red Hat Enterprise Linux 2.1.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Edward Kozel, Cisco's former chief technology officer, joins the board of Linux seller Red Hat.
Read more
Updated samba packages are available for Red Hat Enterprise Linux 2.1
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated samba packages fix security issue
Advisory ID: RHSA-2004:498-01
Issue date: 2004-10-04
Updated on: 2004-10-04
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-0815
----------------------------------------------------------------------
1. Summary:
Updated samba packages that fix an input validation vulnerability are now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Updated XFree86 packages are available for Red Hat Enterprise Linux 3
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated XFree86 packages fix security issues and bugs
Advisory ID: RHSA-2004:478-01
Issue date: 2004-10-04
Updated on: 2004-10-04
Product: Red Hat Enterprise Linux
Obsoletes: RHEA-2004:352
CVE Names: CAN-2004-0419 CAN-2004-0687 CAN-2004-0688 CAN-2004-0692
----------------------------------------------------------------------
1. Summary:
Updated XFree86 packages that fix several security flaws in libXpm, as well as other bugs, are now available for Red Hat Enterprise Linux 3.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, ppc64, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Updated kdelibs and kdebase packages are available for Red Hat Enterprise Linux 2.1 and 3
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated kdelibs and kdebase packages correct security issues
Advisory ID: RHSA-2004:412-01
Issue date: 2004-10-04
Updated on: 2004-10-04
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-0689 CAN-2004-0746 CAN-2004-0721
----------------------------------------------------------------------
1. Summary:
Updated kdelib and kdebase packages that resolve multiple security issues are now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Updated mod_python packages are available for Red HAt Linux 7.3
-----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated mod_python resolves security vulnerability
Advisory ID: FLSA:1325
Issue date: 2004-10-03
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1325
CVE Names: CAN-2003-0973
-----------------------------------------------------------------------
-----------------------------------------------------------------------
1. Topic:
Updated mod_python packages that fix a security vulnerability are now available.
mod_python embeds the Python language interpreter within the Apache httpd server.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Updated systat packages are available for Red Hat Linux 7.3
------------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated sysstat packages fix security vulnerabilities
Advisory ID: FLSA:1372
Issue date: 2004-10-03
Product: Red Hat Linux
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1372
CVE Names: CAN-2004-0107
------------------------------------------------------------------------
------------------------------------------------------------------------
1. Topic:
Updated sysstat packages that fix various bugs and a minor security issue are now available.
Sysstat is a tool for gathering system statistics.
2. Relevent releases/architectures:
Red Hat Linux 7.3 - i386
Updated squirrelmail packages are available for Red Hat Linux 9
-----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated squirrelmail resolves security vulnerabilities
Advisory ID: FLSA:1733
Issue date: 2004-10-02
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1733
CVE Names: CAN-2004-0519, CAN-2004-0520, CAN-2004-0521
-----------------------------------------------------------------------
-----------------------------------------------------------------------
1. Topic:
Updated squirrelmail packages that fix a security vulnerability are now available.
SquirrelMail is a standards-based webmail package written in PHP4.
2. Relevant releases/architectures:
Red Hat Linux 9 - i386
Updated mozilla packages are available for Red Hat Enterprise Linux 2.1 and 3
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated mozilla packages fix security issues
Advisory ID: RHSA-2004:486-01
Issue date: 2004-09-30
Updated on: 2004-09-30
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-0902 CAN-2004-0903 CAN-2004-0904 CAN-2004-0905 CAN-2004-0908
----------------------------------------------------------------------
1. Summary:
Updated mozilla packages that fix a number of security issues are now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
3. Problem description:
Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.
Jesse Ruderman discovered a cross-domain scripting bug in Mozilla. If a user is tricked into dragging a javascript link into another frame or page, it becomes possible for an attacker to steal or modify sensitive information from that site. Additionally, if a user is tricked into dragging two links in sequence to another window (not frame), it is possible for the attacker to execute arbitrary commands. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0905 to this issue.
Gael Delalleau discovered an integer overflow which affects the BMP handling code inside Mozilla. An attacker could create a carefully crafted BMP file in such a way that it would cause Mozilla to crash or execute arbitrary code when the image is viewed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0904 to this issue.
Georgi Guninski discovered a stack-based buffer overflow in the vCard display routines. An attacker could create a carefully crafted vCard file in such a way that it would cause Mozilla to crash or execute arbitrary code when viewed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0903 to this issue.
Wladimir Palant discovered a flaw in the way javascript interacts with the clipboard. It is possible that an attacker could use malicious javascript code to steal sensitive data which has been copied into the clipboard. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0908 to this issue.
Georgi Guninski discovered a heap based buffer overflow in the "Send Page" feature. It is possible that an attacker could construct a link in such a way that a user attempting to forward it could result in a crash or arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0902 to this issue.
Users of Mozilla should update to these updated packages, which contain backported patches and are not vulnerable to these issues.
Updated squid packages are available for Red Hat Enterprise Linux 3
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated squid package fixes security vulnerability
Advisory ID: RHSA-2004:462-01
Issue date: 2004-09-30
Updated on: 2004-09-30
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-0832
----------------------------------------------------------------------
1. Summary:
An updated squid package that fixes a security vulnerability in the NTLM authentication helper is now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
3. Problem description:
Squid is a full-featured Web proxy cache.
An out of bounds memory read bug was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authentication helper, a remote attacker could send a carefully crafted NTLM authentication packet and cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0832 to this issue.
Note: The NTLM authentication helper is not enabled by default in Red Hat Enterprise Linux 3. Red Hat Enterprise Linux 2.1 is not vulnerable to this issue as it shipped with a version of Squid which did not contain the vulnerable helper.
Users of Squid should update to this erratum package, which contains a backported patch and is not vulnerable to this issue.
Updated spamassassin packages are available for Red Hat Enterprise Linux 3
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated spamassassin package fixes denial of service issue
Advisory ID: RHSA-2004:451-01
Issue date: 2004-09-30
Updated on: 2004-09-30
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-0796
----------------------------------------------------------------------
1. Summary:
An updated spamassassin package that fixes a denial of service bug when parsing malformed messages is now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
3. Problem description:
SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.
A denial of service bug has been found in SpamAssassin versions below 2.64. A malicious attacker could construct a message in such a way that would cause spamassassin to stop responding, potentially preventing the delivery or filtering of email. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0796 to this issue.
Users of SpamAssassin should update to these updated packages which contain a backported patch and is not vulnerable to this issue.
Updated ruby packages are available for Red Hat Enterprise Linux 2.1 and 3
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated ruby package fixes security flaw
Advisory ID: RHSA-2004:441-01
Issue date: 2004-09-30
Updated on: 2004-09-30
Product: Red Hat Enterprise Linux
Keywords: file permission
CVE Names: CAN-2004-0755
----------------------------------------------------------------------
1. Summary:
An updated ruby package that fixes insecure file permissions for CGI session files is now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
3. Problem description:
Ruby is an interpreted scripting language for object-oriented programming.
Andres Salomon reported an insecure file permissions flaw in the CGI session management of Ruby. FileStore created world readable files that could allow a malicious local user the ability to read CGI session data. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0755 to this issue.
Users are advised to upgrade to this erratum package, which contains a backported patch to CGI::Session FileStore.
Updated flim packages are available for Red Hat Linux 7.3 and 9
-----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated flim resolves security vulnerabilities
Advisory ID: FLSA:1581
Issue date: 2004-09-30
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1581
CVE Names: CAN-2004-0422
-----------------------------------------------------------------------
-----------------------------------------------------------------------
1. Topic:
Updated flim packages that fix a security vulnerability are now available.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
3. Problem description:
The flim package includes a MIME library for GNU Emacs and XEmacs used by the wl mail package.
Tatsuya Kinoshita discovered a vulnerability in flim, an emacs library for working with Internet messages. Temporary files were being created without taking adequate precautions, and therefore a local user could potentially overwrite files with the privileges of the user running emacs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0422 to this issue.
Users of flim are advised to upgrade to this updated package, which contains patches correcting these issues.
Updated xchat packages are available for Red Hat Linux 7.3
-----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated xchat resolves security vulnerabilities
Advisory ID: FLSA:1549
Issue date: 2004-09-30
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1549
CVE Names: CAN-2004-0409
-----------------------------------------------------------------------
-----------------------------------------------------------------------
1. Topic:
Updated xchat packages that fix a security vulnerability are now available.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
3. Problem description:
X-Chat is a graphical IRC chat client for the X Window System.
A stack buffer overflow flaw was found in the X-Chat's Socks-5 proxy code. An attacker could create a malicious Socks-5 proxy server in such a way that X-Chat would execute arbitrary code if a victim configured X-Chat to use the proxy.
Users of X-Chat should upgrade to this updated package which contains a backported security patch and is not vulnerable to this issue.
Updated tcpdump packages are available for Red Hat Linux 7.3 and 9
-----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated tcpdump resolves security vulnerabilities
Advisory ID: FLSA:1468
Issue date: 2004-09-29
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1468
CVE Names: CAN-2004-0183, CAN-2004-0184
-----------------------------------------------------------------------
-----------------------------------------------------------------------
1. Topic:
Updated tcpdump packages that fix multiple security vulnerabilities are now available.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
3. Problem description:
Tcpdump is a command-line tool for monitoring network traffic.
Tcpdump v3.8.1 and earlier versions contained multiple flaws in the packet display functions for the ISAKMP protocol. Upon receiving specially crafted ISAKMP packets, tcpdump would try to read beyond the end of the packet capture buffer and subsequently crash.
All users are advised to upgrade to these updated packages, which contain a backported fix and are not vulnerable to this issue.
Updated Ethereal packages are available for Red Hat Linux 7.3 and 9
-------------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated Ethereal packages fix security issues
Advisory ID: FLSA:1840
Issue date: 2004-09-30
Product: Red Hat Linux
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1840
CVE Names: CAN-2004-0176 CAN-2004-0365 CAN-2004-0367
CAN-2004-0504 CAN-2004-0505 CAN-2004-0506
CAN-2004-0507 CAN-2004-0633 CAN-2004-0634
CAN-2004-0635
-------------------------------------------------------------------------
--
-----------------------------------------------------------------------
1. Topic:
Updated Ethereal packages that fix various security vulnerabilities are now available.
Ethereal is a program for monitoring network traffic.
2. Relevent releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
3. Problem description:
Issues fixed with this Ethereal release include:
Stefan Esser reported that Ethereal versions 0.10.1 and earlier contain stack overflows in the IGRP, PGM, Metflow, ISUP, TCAP, or IGAP dissectors. On a system where Ethereal is being run a remote attacker could send malicious packets that could cause Ethereal to crash or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0176 to this issue.
Jonathan Heussser discovered that a carefully-crafted RADIUS packet could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0365 to this issue.
Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0367 to this issue.
The MMSE dissector in Ethereal releases 0.10.1 through 0.10.3 contained a buffer overflow flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0507 to this issue.
In addition, other flaws in Ethereal prior to 0.10.4 were found that could cause it to crash in response to carefully crafted SIP (CAN-2004-0504), AIM (CAN-2004-0505), or SPNEGO (CAN-2004-0506) packets.
The SNMP dissector in Ethereal releases 0.8.15 through 0.10.4 contained a memory read flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or possibly execute arbitrary code. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0635 to this issue.
The SMB dissector in Ethereal releases 0.9.15 through 0.10.4 contained a null pointer flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0634 to this issue.
The iSNS dissector in Ethereal releases 0.10.3 through 0.10.4 contained an integer overflow flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or possibly execute arbitrary code. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0633 to this issue.
Users of Ethereal should upgrade to these updated packages, which contain backported security patches that correct these issues.
Updated rsync packages are available for Red Hat Linux 7.3 and 9
-------------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated rsync package fixes security issues
Advisory ID: FLSA:2003
Issue date: 2004-09-30
Product: Red Hat Linux
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id
03
CVE Names: CAN-2004-0426 CAN-2004-0792
-------------------------------------------------------------------------
-------------------------------------------------------------------------
1. Topic:
An updated rsync package that fixes several security issues is now available.
The rsync program synchronizes files over a network.
2. Relevent releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
3. Problem description:
Rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot. This could allow a remote attacker to write files outside of the module's "path", depending on the privileges assigned to the rsync daemon. Users not running an rsync daemon, running a read-only daemon, or running a chrooted daemon are not affected by this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0426 to this issue.
Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync directory. This vulnerability is only exploitable when an rsync server is enabled and is not running within a chroot. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0792 to this issue.
Users of rsync are advised to upgrade to this updated package, which contains backported patches and is not affected by these issues.
The Linux seller plans to release the Netscape Enterprise Suite as open-source software in a bid to expand beyond its core product.
Read more
