Showing all newswire headlines
View by date, instead?« Previous ( 1 ... 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 ... 2062 ) Next »
Debian alert: New version of nmh released
The version of nmh that was distributed in Debian GNU/Linux 2.1 (aka slink)
did not check incoming mail messages properly. This could be exploited by
using carefully designed MIME headers to trick mhshow into executing
arbitrary shell code.
Debian alert: New version of htdig released
The version of htdig that was distribution in Debian GNU/Linux 2.1 (aka slink)
is vulnerable to a remote attack. There was a vulnerability in the htsearch
script that allowed remote users to read any file on the webserver that is readable
by the uid under which the server is running.
Debian alert: New version of make released
The make package as shipped in Debian GNU/Linux 2.1 is vulnerable to a
race condition that can be exploited with a symlink attack. make used
mktemp while creating temporary files in /tmp. and that is a known
potential security hole, as documented in the man page of mktemp.
SuSE alert: make
If GNU make is fed with Makefiles via stdin it creates temporary files in /tmp without checking for links.
SuSE alert: mysql
A bug in the authentication function of mysql allows anyone who knows a valid username to successfully authenticate as that users in no more than 32 tries.
SuSE alert: mount
The mount/umount command doesn't do proper bounds checking on user input.
Debian alert: New version of apcd released
The apcd package as shipped in Debian GNU/Linux 2.1 is vulnerable to
a symlink attack. If the apcd process gets a SIGUSR1 signal it will
dump its status to /tmp/upsstat. However this file is not opened
safely, which makes it a good target for a symlink attack.
SuSE alert: lprold-update
We apologize for the wrong md5 checksums in our original advisory.
You can find the correct checksums below.
Red Hat alert: New majordomo packages available
New majordomo packages are available to fix a local security problem in majordomo.
SuSE alert: lprold
lprold is the default printer daemon. If the hosts.lpd mechanism is used to permit printing to remote hosts, this can be circumvented if the attacker controls a DNS server, because no double-reverse lookup was done the IP address. A second vulnerability involves the manipulating the control file of a print job in a way, that statements are sent to sendmail as arguments where an attacker could specify a sendmail config file of his own.
Debian alert: New version of lpr released
The version of lpr that was distributed with Debian GNU/Linux 2.1
and the updated version released in 2.1r4 have a two security
problems:
Debian alert: New version of nvi released
The version of nvi that was distributed with Debian GNU/Linux 2.1 has
an error in the default /etc/init.d/nviboot script: it did not handle
filenames with embedded spaces correctly. This made it possible to remove
files in the root directory by creating entries in /var/tmp/vi.recover.
Red Hat alert: New version of usermode, pam
A security bug has been discovered and fixed in the userhelper program.
SuSE alert: wvdial
If someone uses the wvdial.lxdialog script to configure a ppp dialup, the config file /var/lib/wvdial/.config is created readable for everyone. This config file usually contains the login and password for the dialup. However, the directory where the config file is placed is only accessable to those in the "dialout" group. The default wvdial config file of SuSE, which is /etc/wvdial.conf, hasn't got this problem.
Debian alert: New version of htdig released
The version of htdig that was shipped in Debian GNU/Linux 2.1 has a problem
with calling external programs to handle non-HTML documents: it calls
the external program with the document as a parameter, but does not check
for shell escapes. This can be exploited by creating files with filenames
that include shell escapes to run arbitraty commands on the machine that
runs htdig.
Debian alert: New version of sendmail-wide released
This has been fixed in version 8.9.3+3.2W-3slink1 by only allowing root
and trusted users to regenerate the aliases database.
Debian alert: Updated i386 package for sendmail
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian alert: New version of sendmail released
This has been fixed in version 8.9.3-3slink1 by only allowing root
and trusted users to regenerate the aliases database.
Red Hat alert: ORBit, esound, gnome-core
ORBit and gnome-session each contained a denial-of-service hole.
ORBit and esound each contained a security hole.
Debian alert: New version of dump released.
This has been fixed in version 0.4b9-0slink1. We recommend you upgrade
your dump package immediately.
« Previous ( 1 ... 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 ... 2062 ) Next »