Linux Compatible - Slackware (Page 8)

sendmail (SSA:2006-081-01)

Slackware 1231 Published 2006-03-23 10:22 by Philipp Esselbach 0

New sendmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue.

Sendmail's advisory concerning this issue may be found here:
http://www.sendmail.com/company/advisory/index.shtml

This issue will appear in the Common Vulnerabilities and Exposures (CVE)database at the following location:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0058

Slackware 10.1 kdegraphics (SSA:2006-072-01)

Slackware 1231 Published 2006-03-14 09:50 by Philipp Esselbach 0

A new kdegraphics package is available for Slackware 10.1 to fix a security issue. A portion of the recent security patch was missing in the version that was applied to kdegraphics-3.3.2 in Slackware 10.1. Other versions of Slackware are not affected by this specific missing patch issue.

More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0746

gnupg (SSA:2006-072-02)

Slackware 1231 Published 2006-03-14 09:49 by Philipp Esselbach 0

New GnuPG packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues.

More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0455
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0049

openssh (SSA:2006-045-06)

Slackware 1231 Published 2006-02-15 11:28 by Philipp Esselbach 0

New openssh packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0225

kdelibs (SSA:2006-045-05)

Slackware 1231 Published 2006-02-15 11:28 by Philipp Esselbach 0

New kdelibs packages are available for Slackware 10.0, 10.1, and 10.2 to fix a security issue with kjs.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0019

firefox (SSA:2006-045-02)

Slackware 1231 Published 2006-02-15 11:15 by Philipp Esselbach 0

New Firefox packages are available for Slackware 10.2 and -current to fix security issues.

More details about the issues may be found here:

http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox1.5.0.1

sudo (SSA:2006-045-08)

Slackware 1231 Published 2006-02-15 11:14 by Philipp Esselbach 0

New sudo packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0151

fetchmail (SSA:2006-045-01)

Slackware 1231 Published 2006-02-15 11:13 by Philipp Esselbach 0

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3088
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4348
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0321

xpdf (SSA:2006-045-09)

Slackware 1231 Published 2006-02-15 11:11 by Philipp Esselbach 0

php (SSA:2006-045-07)

Slackware 1231 Published 2006-02-15 11:11 by Philipp Esselbach 0

New php packages are available for Slackware 10.2 and -current to fix minor security issues.

More details about these issues may be found on the PHP website:

http://www.php.net/release_4_4_2.php

imagemagick (SSA:2006-045-03)

Slackware 1231 Published 2006-02-15 11:10 by Philipp Esselbach 0

New imagemagick packages are available for Slackware 10.2 and -current to fix security issues.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4601
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0082

elm mailer (SSA:2005-311-01)

Slackware 1231 Published 2005-11-08 15:01 by Philipp Esselbach 0

New Elm packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue. A buffer overflow in the parsing of the Expires header could allow arbitrary code to be executed as the user running Elm.

curl/wget (SSA:2005-310-01)

Slackware 1231 Published 2005-11-07 01:49 by Philipp Esselbach 0

New curl packages are available for Slackware 9.1, 10.0, 10.1, 10.2, and -current, and new wget packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current. These address a buffer overflow in NTLM handling which may present a security problem, though no public exploits are known at this time.

More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3185

KOffice/KWord (SSA:2005-310-02)

Slackware 1231 Published 2005-11-07 01:49 by Philipp Esselbach 0

New KOffice packages are available for Slackware 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue with KWord. A buffer overflow in the RTF import functionality could result in the execution of arbitrary code.

More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2971

imapd (SSA:2005-310-06)

Slackware 1231 Published 2005-11-07 01:48 by Philipp Esselbach 0

New imapd packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix (an alleged) security issue. See the details below for more information. Also, new Pine packages are provided since these are built together... why not? Might as well upgrade that too, while I'm fixing the fake security problem.

apache (SSA:2005-310-04)

Slackware 1231 Published 2005-11-07 01:47 by Philipp Esselbach 0

New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix potential security issues:

* If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks.

* Added TraceEnable [on|off|extended] per-server directive to alter the behavior of the TRACE method.

It's hard to say how much real-world impact these have, as there's no more information about that in the announcement. The original Apache nnounement can be read here:

http://www.apache.org/dist/httpd/Announcement1.3.html

Note that if you use mod_ssl, you will also need a new mod_ssl package. These have been provided for the same releases of Slackware.

PHP (SSA:2005-310-05)

Slackware 1231 Published 2005-11-07 01:46 by Philipp Esselbach 0

New PHP packages are available for Slackware 10.2 and -current to fix minor security issues relating to the overwriting of the GLOBALS array.

It has been reported here that this new version of PHP also breaks squirrelmail and probably some other things. Given the vague nature of the security report, it's possible that the cure might be worse than the disease as far as this upgrade is concerned. If you encounter problems, you may wish to drop back to 4.4.0, and I believe that doing so is relatively safe. I understand at least some of the issues are fixed in CVS already, so perhaps another maintainance release is not far off.

Thanks to Gerardo Exequiel Pozzi for bringing the issues with 4.4.1 to my attention so that this additional information could be included here.

lynx (SSA:2005-310-03)

Slackware 1231 Published 2005-11-07 01:46 by Philipp Esselbach 0

New Lynx packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue. An overflow could result in the execution of arbitrary code when using Lynx to connect to a malicious NNTP server.

OpenSSL (SSA:2005-286-01)

Slackware 1231 Published 2005-10-14 05:12 by Philipp Esselbach 0

New OpenSSL packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue. Under certain conditions, an attacker acting as a "man in the middle" may force a client and server to fall back to the less-secure SSL 2.0 protocol.

xine-lib (SSA:2005-283-01)

Slackware 1231 Published 2005-10-11 06:51 by Philipp Esselbach 0

New xine-lib packages are available for Slackware 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue. A format string bug may allow the execution of arbitrary code as the user running a xine-lib linked application. The attacker must provide (by uploading or running a server) specially crafted CDDB information and then get the user to play the referenced audio CD.