|
|
There were 25 security alerts issued last week.
|
|
Fedora Core 1 Update: XFree86-4.3.0-55
Feb 13, 2004 9:23 PM
Updated XFree86 packages that fix a privilege escalation vulnerability are now available.
Conectiva alert: gaim
Feb 10, 2004 9:09 PM
Stefan Esser found[1] several remote vulnerabilities in Gaim. A remote attacker can use specially crafted network packets to exploit at least one of these vulnerabilities and execute arbitrary code in the context of the user running the program or cause a denial of service condition.
Conectiva alert: initscripts
Feb 13, 2004 1:32 PM
When a machine is booted, one of the tasks performed by the initscripts package is to remove temporary files and stale locks. This script ("/etc/rc.d/init.d/cleanup" in CL9, and "/etc/rc.d/rc.sysinit" in CL8), however, incorrectly removed some important files in /var/lock/samba needed by the samba server, causing it to behave incorrectly. The most affected service is winbind, because the idmap file was removed at every boot, causing a loss of the user <-> userid mapping.
Conectiva alert: vim
Feb 10, 2004 7:53 PM
Georgi Guninski found[1] a vulnerability[2] in vim that can be exploited to execute arbitrary commands when the user opens a text file specially crafted by an attacker. The vulnerability resides in the "modelines" feature, which allows one to place some VIM commands inside of a text file.
Debian alert: New cgiemail packages fix open mail relaying
Feb 12, 2004 12:21 PM
A vulnerability was discovered in cgiemail, a CGI program used to email the contentsof an HTML form, whereby it could be used to send email to arbitrary addresses. This type of vulnerability is commonly exploited to send unsolicited commercial email (spam).
Debian alert: New gnupg packages fix cryptographic weakness
Feb 14, 2004 1:39 PM
Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing.
Fedora Core 1 alert: mutt-1.4.1-5
Feb 11, 2004 7:20 PM
This package fixes CAN-2004-0078, where a specifc message could cause mutt to crash. This is the vulnerability fixed in the recently released mutt-1.4.2.
Fedora Core alert: Updated kernel packages
Feb 11, 2004 1:20 PM
Red Hat has released a new kernel update, giving no information as to the problems fixed. The changelog was last updated on January 26th.
Gentoo alert: Gallery <= 1.4.1 and below remote exploit vulnerability
Feb 11, 2004 9:24 PM
The Gallery developers have discovered a potentially serious security flaw in Gallery 1.3.1, 1.3.2, 1.3.3, 1.4 and 1.4.1 which can a remote exploit of your webserver.
Gentoo alert: Monkeyd Denial of Service vulnerability
Feb 11, 2004 8:56 PM
A bug in get_real_string() function allows for a Denial of Service attack to be launched against the webserver.
Gentoo alert: XFree86 Font Information File Buffer Overflow
Feb 11, 2004 8:50 PM
Exploitation of a buffer overflow in the XFree86 Project Inc.'s XFree86 X Window System allows local attackers to gain root privileges.
Immunix alert: XFree86
Feb 13, 2004 1:10 PM
Greg MacManus, of iDEFENSE Labs, reports finding several potentially exploitable buffer overflows in XFree86's font code.
Mandrake security alert: Updated mailman packages close various cross-site scripting vulnerabilities.
Feb 13, 2004 11:13 PM
CAN-2003-0965, CAN-2003-0991, and CAN-2003-0992 are resolved with this update.
Mandrake security alert: Updated mutt packages fix remote crash
Feb 12, 2004 12:18 PM
A bug in mutt was reported by Neils Heinen that could allow a remote attacker to send a carefully crafted mail message that can cause mutt to segfault and possibly execute arbitrary code as the user running mutt.
Mandrake security alert: Updated NetPBM packages fix a number of temporary file bugs.
Feb 12, 2004 12:18 PM
A number of temporary file bugs have been found in versions of NetPBM. These could allow a local user the ability to overwrite or create files as a different user who happens to run one of the the vulnerable utilities.
Mandrake security alert: Updated XFree86 packages fix buffer overflow vulnerabilities
Feb 13, 2004 5:22 PM
Two buffer overflow vulnerabilities were found by iDEFENSE in XFree86's parsing of the font.alias file. The X server, which runs as root, fails to check the length of user-provided input; as a result a malicious user could craft a malformed font.alias file causing a buffer overflow upon parsing, which could eventually lead to the execution of arbitrary code.
Red Hat alert: Updated Gaim packages fix security vulnerabilities
Feb 9, 2004 7:05 PM
Updated Gaim packages that fix a pair of security vulnerabilities are now available.
Red Hat alert: Updated mailman packages close DoS vulnerability
Feb 9, 2004 7:05 PM
Updated mailman packages that close a DoS vulnerability present in mailman versions prior to version 2.1 are now available.
Red Hat alert: Updated mutt packages fix remotely-triggerable crash
Feb 11, 2004 2:04 PM
New mutt packages that fix a remotely-triggerable crash in the menu drawing code are now available.
Red Hat alert: Updated PWLib packages fix protocol security issues
Feb 13, 2004 1:07 PM
Updated PWLib packages that contain fixes for security issues found during protocol testing by the NISCC are now available.
Red Hat alert: Updated XFree86 packages fix privilege escalation vulnerability
Feb 13, 2004 1:07 PM
Updated XFree86 packages that fix a privilege escalation vulnerability are now available.
Security alert: Mutt-1.4.2 fixes buffer overflow
Feb 11, 2004 3:26 PM
Mutt-1.4.2 has just been released; this version fixes a buffer overflow that can be triggered by incoming messages. There are reports about spam that has actually triggered this problem and crashed mutt.
Slackware alert: mutt security update
Feb 12, 2004 9:08 PM
These have been upgraded to version 1.4.2i to fix a buffer overflow that could lead to a machine compromise. All sites using mutt should upgrade to the new mutt package.
Slackware alert: XFree86 security update
Feb 12, 2004 9:08 PM
These fix overflows which could possibly be exploited to gain unauthorized root access. All sites running XFree86 should upgrade to the new package.
Trustix alert: mutt
Feb 13, 2004 3:15 PM
It was discovered that certain messages would cause mutt to crash. Mutt 1.4.2 fixes this bug. See CAN-2004-0078.
|
