Showing all newswire headlines
View by date, instead?« Previous ( 1 ... 7354 7355 7356 7357 7358 7359 7360 7361 7362 7363 7364 ... 7384 ) Next »
Red Hat alert: The uuxqt utility can be used to execute arbitrary commands as uucp.uucp
uuxqt in Taylor UUCP package does not properly remove dangerous long
options, which allows local users to gain uid and gid uucp privileges by
calling uux and specifying an alternate configuration file with the
--config option.
Mandrake alert: stunnel update
All versions of stunnel from 3.15 to 3.21c are vulnerable to format string bugs in the functions which implement smtp, pop, and nntp client negotiations. Using stunnel with the "-n service" option and the "-c" client mode option, a malicious server could use the format sting vulnerability to run arbitrary code as the owner of the current stunnel process. Version 3.22 is not vulnerable to this bug.
SuSE alert: at
The 'at' command reads commands from standard input for execution at a later time specified on the command line. If such an execution time is given in a carefully drafted (but wrong) format, the at command may crash as a result of a surplus call to free(). The cause of the crash is a heap corruption that is exploitable under certain circumstances since the /usr/bin/at command is installed setuid root.
Debian alert: New at packages fix heap corruption vulnerability
zen-parse found a bug in the current implementation of at which leads
into a heap corruption vulnerability which in turn could potentially
lead into an exploit of the daemon user.
Mandrake alert: sudo update
The SuSE Security Team discovered a vulnerability in sudo that can be exploited to obtain root privilege because sudo is installed setuid root. An attacker could trick sudo to log failed sudo calls executing the sendmail (or equivalent mailer) program with root privileges and an environment that is not completely clean. This problem has been fixed upstream by the author in sudo 1.6.4 and it is highly recommended that all users upgrade regardless of what mailer you are using.
Red Hat alert: Updated xchat packages are available
Versions of xchat prior to version 1.8.7 contain a vulnerability
which allows an attacker to cause a vulnerable client to execute
arbitrary IRC server commands as if the vulnerable user had typed
them.
This security erratum updates xchat to version 1.8.7, which is
not vulnerable to this attack.
Red Hat alert: Updated pine packages are available
Pine (version 4.43 and earlier) as released with all currently
supported versions of Red Hat Linux (6.2, 7, 7.1, 7.2), contains a URL
handling bug. This bug can allow a malicious attacker to cause arbitrary
commands embedded in a URL to be executed on the users system upon
attempting to view the URL.
Red Hat alert: Updated sudo package is available
This updated sudo package fixes a potential local root exploit.
Red Hat alert: Updated bugzilla packages available
A number of security-related bugs have been found in Bugzilla version
Red Hat alert: Updated sudo packages are available
Updated sudo packages fixing a security problem are available.
Red Hat alert: New groff packages available to fix security problems
New groff packages have been made available that fix an overflow in groff.
If the printing system running this is a security issue, it is recommended
to update to the new, fixed packages.
Debian alert: New sudo packages fix local root exploit
Sebastian Krahmer from SuSE found a vulnerability in sudo which could
easily lead into a local root exploit.
Debian alert: CIPE DoS attack
Larry McVoy found a bug in the packet handling code for the CIPE
VPN package: it did not check if a received packet was too short
and could crash.
SuSE alert: sudo
The SuSE Security Team discovered a bug in the sudo program which is installed setuid to root. Attackers may trick "sudo" to log failed sudo invocations executing the sendmail program with root-privileges and not completely cleaned environment. Depending on the installed mail-package this may enable attackers to execute code as root. This is the case for at least the postfix mailer. Other mailers may be exploited in a similar way. This bug has been fixed by having "sudo" invoke the sendmail command with user-privileges instead. Please update your sudo package regardless of the mail-packages you are using. As a temporary workaround you may remove the s-bit from sudo with the "chmod -s `which sudo`" command, which will disable the sudo functionality.
Debian alert: glibc buffer overflow
A buffer overflow has been found in the globbing code for glibc.
This code which is used to glob patterns for filenames and is
commonly used in applications like shells and FTP servers.
Slackware alert: Pine update fixes insecure URL-handling
Pine 4.44 packages are now available to fix a problem with insecure URL
handling.
Slackware alert: glibc glob overflow patched
A buffer overflow has been found in the glob(3) function in glibc.
Fixed packages for Slackware 8.0 are now available.
Red Hat alert: New mutt packages available to fix security problem
New mutt packages that fix an overflow in mutt's address parsing code are
available. It is recommended that all mutt users update to the fixed packages.
Red Hat alert: Updated namazu packages are available
Updated namazu packages are available for Red Hat Linux 7.0J. These
packages fix cross-site scripting vulnerabilities. It also fixes a possible
buffer overflow.
Mandrake alert: bind update
There are some insecure permissions on configuration files and executables with the bind 9.x packages shipped with Mandrake Linux 8.0 and 8.1. This update provides stricter permissions by making the /etc/rndc.conf and /etc/rndc.key files read/write by the named user and by making /sbin/rndc-confgen and /sbin/rndc read/write/executable only by root.
« Previous ( 1 ... 7354 7355 7356 7357 7358 7359 7360 7361 7362 7363 7364 ... 7384 ) Next »