Linux Security Week - November 6th 2009
+----------------------------------------------------------------------+
| LinuxSecurity.com Weekly Newsletter |
| November 6th, 2009 Volume 10, Number 45 |
| |
| Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> |
| Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> |
+----------------------------------------------------------------------+
Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.
This week, advisories were released for typo3, libhtml, expat, pyxml,
mimetex, squidguard, yelp, gnome-python, gnome-web-photo, kazehakase,
mozvoikko, miro, mugshot, pcmanx, ruby-gnome, xulrunner, epiphany,
evolution, firefox, galeon, wireshark, jetty, wget, kernel-rt, pidgin,
mozilla-firefox, and poppler. The distributors include Debian, Fedora,
Mandriva, Red Hat, Slackware, SuSE, Ubuntu, and Pardus.
---
>> Linux+DVD Magazine <<
In each issue you can find information concerning the best use of Linux:
safety, databases, multimedia, scientific tools, entertainment,
programming, e-mail, news and desktop environments.
Catch up with what professional network and database administrators,
system programmers, webmasters and all those who believe in the power of
Open Source software are doing!
http://www.linuxsecurity.com/ads/adclick.php?bannerid=26
---
Review: Googling Security: How Much Does Google Know About You
--------------------------------------------------------------
If I ask "How much do you know about Google?" You may not take even a
second to respond. But if I may ask "How much does Google know about
you"? You may instantly reply "Wait... what!? Do they!?" The book
"Googling Security: How Much Does Google Know About You" by Greg Conti
(Computer Science Professor at West Point) is the first book to reveal
how Google's vast information stockpiles could be used against you or
your business and what you can do to protect yourself.
http://www.linuxsecurity.com/content/view/145939
---
A Secure Nagios Server
----------------------
Nagios is a monitoring software designed to let you know about problems
on your hosts and networks quickly. You can configure it to be used on
any network. Setting up a Nagios server on any Linux distribution is a
very quick process however to make it a secure setup it takes some
work. This article will not show you how to install Nagios since there
are tons of them out there but it will show you in detail ways to
improve your Nagios security.
http://www.linuxsecurity.com/content/view/144088
--> Take advantage of the LinuxSecurity.com Quick Reference Card! <--
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <--
------------------------------------------------------------------------
* EnGarde Secure Community 3.0.22 Now Available! (Dec 9)
------------------------------------------------------
Guardian Digital is happy to announce the release of EnGarde Secure
Community 3.0.22 (Version 3.0, Release 22). This release includes
many updated packages and bug fixes and some feature enhancements to
the EnGarde Secure Linux Installer and the SELinux policy.
http://www.linuxsecurity.com/content/view/145668
------------------------------------------------------------------------
* Debian: New Linux 2.6.26 packages fix several vulnerabilities (Nov 5)
---------------------------------------------------------------------
http://www.linuxsecurity.com/content/view/150601
* Debian: New TYPO3 packages fix several vulnerabilities (Nov 4)
--------------------------------------------------------------
http://www.linuxsecurity.com/content/view/150599
* Debian: New libhtml-parser-perl packages fix denial of service (Oct 29)
-----------------------------------------------------------------------
http://www.linuxsecurity.com/content/view/150535
------------------------------------------------------------------------
* Fedora 10 Update: expat-2.0.1-5.fc10.1 (Nov 4)
----------------------------------------------
This update fixes a security vulnerability: A buffer over-read
flaw was found in the way Expat handles malformed UTF-8 sequences
when processing XML files. A specially-crafted XML file could cause
applications using Expat to crash while parsing the file.
(CVE-2009-3720)
http://www.linuxsecurity.com/content/view/150592
* Fedora 11 Update: PyXML-0.8.4-16.fc11 (Nov 4)
---------------------------------------------
Switched to using system expat library. Updated expat packages are
needed to fully resolve this flaw.
http://www.linuxsecurity.com/content/view/150593
* Fedora 11 Update: mimetex-1.71-1.fc11 (Nov 4)
---------------------------------------------
- Fixes a buffer-overflow as detailed in #511049. - Updates to 1.7.
http://www.linuxsecurity.com/content/view/150590
* Fedora 10 Update: squidGuard-1.4-8.fc10 (Nov 4)
-----------------------------------------------
Fixes language file issue, but more importantly. . .
--------------- squidGuard upstream has released patches fixing
(quoting from upstream advisories): a, This patch fixes one
buffer overflow problem in sgLog.c when overlong URLs are requested.
SquidGuard will then go into emergency mode were no blocking occurs.
This is not required in this situation.
http://www.linuxsecurity.com/content/view/150591
* Fedora 11 Update: expat-2.0.1-6.fc11.1 (Nov 4)
----------------------------------------------
This update fixes a security vulnerability: A buffer over-read
flaw was found in the way Expat handles malformed UTF-8 sequences
when processing XML files. A specially-crafted XML file could cause
applications using Expat to crash while parsing the file.
(CVE-2009-3720)
http://www.linuxsecurity.com/content/view/150589
* Fedora 10 Update: yelp-2.24.0-14.fc10 (Nov 4)
---------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150588
* Fedora 10 Update: gnome-python2-extras-2.19.1-35.fc10 (Nov 4)
-------------------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150577
* Fedora 10 Update: gnome-web-photo-0.3-23.fc10 (Nov 4)
-----------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150578
* Fedora 10 Update: google-gadgets-0.10.5-11.fc10 (Nov 4)
-------------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150579
* Fedora 10 Update: kazehakase-0.5.6-4.fc10.7 (Nov 4)
---------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150580
* Fedora 10 Update: mozvoikko-0.9.5-15.fc10 (Nov 4)
-------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150581
* Fedora 10 Update: Miro-2.0.5-5.fc10 (Nov 4)
-------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150582
* Fedora 10 Update: mugshot-1.2.2-14.fc10 (Nov 4)
-----------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150583
* Fedora 10 Update: perl-Gtk2-MozEmbed-0.08-6.fc10.6 (Nov 4)
----------------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150584
* Fedora 10 Update: pcmanx-gtk2-0.3.8-14.fc10 (Nov 4)
---------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150585
* Fedora 10 Update: ruby-gnome2-0.19.3-3.fc10 (Nov 4)
---------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150586
* Fedora 10 Update: xulrunner-1.9.0.15-1.fc10 (Nov 4)
---------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150587
* Fedora 10 Update: epiphany-2.24.3-11.fc10 (Nov 4)
-------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150571
* Fedora 10 Update: evolution-rss-0.1.4-5.fc10 (Nov 4)
----------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150572
* Fedora 10 Update: gecko-sharp2-0.13-13.fc10 (Nov 4)
---------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150573
* Fedora 10 Update: firefox-3.0.15-1.fc10 (Nov 4)
-----------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150574
* Fedora 10 Update: epiphany-extensions-2.24.3-6.fc10 (Nov 4)
-----------------------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150575
* Fedora 10 Update: galeon-2.0.7-15.fc10 (Nov 4)
----------------------------------------------
Update to new upstream Firefox version 3.0.15, fixing multiple
security issues detailed in the upstream advisories:
http://www.mozilla.org/security/known-
vulnerabilities/firefox30.html#firefox3.0.15 Update also includes
all packages depending on gecko-libs rebuilt against new version of
Firefox / XULRunner.
http://www.linuxsecurity.com/content/view/150576
------------------------------------------------------------------------
* Mandriva: Subject: [Security Announce] [ MDVSA-2009:293 ] squidGuard (Nov 3)
----------------------------------------------------------------------------
Multiple vulnerabilities has been found and corrected in squidGuard:
Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote
attackers to cause a denial of service (application hang or loss of
blocking functionality) via a long URL with many / (slash)
characters, related to emergency mode. (CVE-2009-3700). Multiple
buffer overflows in squidGuard 1.4 allow remote attackers to bypass
intended URL blocking via a long URL, related to (1) the relationship
between a certain buffer size in squidGuard and a certain buffer size
in Squid and (2) a redirect URL that contains information about the
originally requested URL (CVE-2009-3826). squidGuard was upgraded to
1.2.1 for MNF2/CS3/CS4 with additional upstream security and bug
fixes patches applied. This update fixes these vulnerabilities.
http://www.linuxsecurity.com/content/view/150554
* Mandriva: Subject: [Security Announce] [ MDVSA-2009:292 ] wireshark (Nov 3)
---------------------------------------------------------------------------
Vulnerabilities have been discovered and corrected in wireshark,
affecting DCERPC/NT dissector, which allows remote attackers to cause
a denial of service (NULL pointer dereference and application crash)
via a file that records a malformed packet trace (CVE-2009-3550); and
in wiretap/erf.c which allows remote attackers to execute arbitrary
code or cause a denial of service (application crash) via a crafted
erf file (CVE-2009-3829). The wireshark package has been updated to
fix these vulnerabilities.
http://www.linuxsecurity.com/content/view/150553
* Mandriva: Subject: [Security Announce] [ MDVSA-2009:291 ] jetty5 (Oct 29)
-------------------------------------------------------------------------
A vulnerability has been identified and corrected in jetty5:
Directory traversal vulnerability in the HTTP server in Mort Bay
Jetty before 6.1.17, and 7.0.0.M2 and earlier 7.x versions, allows
remote attackers to access arbitrary files via directory traversal
sequences in the URI (CVE-2009-1523). This update fixes this
vulnerability.
http://www.linuxsecurity.com/content/view/150534
* Mandriva: Subject: [Security Announce] [ MDVSA-2009:290 ] firefox (Oct 29)
--------------------------------------------------------------------------
Security issues were identified and fixed in firefox 3.0.x: Security
researcher Alin Rad Pop of Secunia Research reported a heap-based
buffer overflow in Mozilla's string to floating point number
conversion routines. Using this vulnerability an attacker could craft
some malicious JavaScript code containing a very long string to be
converted to a floating point number which would result in improper
memory allocation and the execution of an arbitrary memory location.
This vulnerability could thus be leveraged by the attacker to run
arbitrary code on a victim's computer (CVE-2009-1563). Security
researcher Jeremy Brown reported that the file naming scheme used for
downloading a file which already exists in the downloads folder is
predictable. If an attacker had local access to a victim's computer
http://www.linuxsecurity.com/content/view/150531
------------------------------------------------------------------------
* RedHat: Important: kernel security and bug fix update (Nov 3)
-------------------------------------------------------------
Updated kernel packages that fix several security issues and multiple
bugs are now available for Red Hat Enterprise Linux 3. This update
has been rated as having important security impact by the Red Hat
Security Response Team.
http://www.linuxsecurity.com/content/view/150559
* RedHat: Important: kernel security update (Nov 3)
-------------------------------------------------
Updated kernel packages that fix security issues are now available
for Red Hat Enterprise Linux 4. This update has been rated as having
important security impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/150556
* RedHat: Important: kernel security and bug fix update (Nov 3)
-------------------------------------------------------------
Updated kernel packages that fix multiple security issues and several
bugs are now available for Red Hat Enterprise Linux 5. This update
has been rated as having important security impact by the Red Hat
Security Response Team.
http://www.linuxsecurity.com/content/view/150557
* RedHat: Moderate: wget security update (Nov 3)
----------------------------------------------
An updated wget package that fixes a security issue is now available
for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated
as having moderate security impact by the Red Hat Security Response
Team.
http://www.linuxsecurity.com/content/view/150558
* RedHat: Important: kernel-rt security, bug fix, (Nov 3)
-------------------------------------------------------
Updated kernel-rt packages that fix several security issues, multiple
bugs, and add enhancements are now available for Red Hat Enterprise
MRG 1.1. This update has been rated as having important security
impact by the Red Hat Security Response Team.
http://www.linuxsecurity.com/content/view/150555
* RedHat: Moderate: pidgin security update (Oct 29)
-------------------------------------------------
An updated pidgin package that fixes several security issues is now
available for Red Hat Enterprise Linux 3. This update has been rated
as having moderate security impact by the Red Hat Security Response
Team.
http://www.linuxsecurity.com/content/view/150529
* RedHat: Moderate: pidgin security update (Oct 29)
-------------------------------------------------
Updated pidgin packages that fix a security issue are now available
for Red Hat Enterprise Linux 4 and 5. This update has been rated as
having moderate security impact by the Red Hat Security Response
Team.
http://www.linuxsecurity.com/content/view/150530
------------------------------------------------------------------------
* Slackware: mozilla-firefox (Nov 2)
------------------------------------
New mozilla-firefox packages are available for Slackware 12.2, 13.0,
and -current to fix security issues. The Firefox 3.0.15 package may
also be used with Slackware 11.0 or newer.
More details about the issues may be found on the Mozilla website:
http://www.mozilla.org/security/known-vulnerabilities/firefox30.html
http://www.mozilla.org/security/known-vulnerabilities/firefox35.html
http://www.linuxsecurity.com/content/view/150548
* Slackware: poppler (Oct 29)
-----------------------------
New poppler packages are available for Slackware 12.0, 12.1, 12.2,
13.0, and -current to fix security issues. More details about this
issue may be found in the Common Vulnerabilities and Exposures (CVE)
database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3605
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3609
http://www.linuxsecurity.com/content/view/150527
* Slackware: xpdf (Oct 29)
--------------------------
New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2,
11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.
More details about the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3605
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3609
http://www.linuxsecurity.com/content/view/150526
------------------------------------------------------------------------
* SuSE: IBM Java 6 (SUSE-SA:2009:053) (Nov 4)
-------------------------------------------
http://www.linuxsecurity.com/content/view/150595
* SuSE: Mozilla Firefox (SUSE-SA:2009:052) (Nov 4)
------------------------------------------------
http://www.linuxsecurity.com/content/view/150594
* SuSE: Linux kernel (SUSE-SA:2009:051) (Nov 2)
---------------------------------------------
http://www.linuxsecurity.com/content/view/150546
------------------------------------------------------------------------
* Ubuntu: poppler vulnerabilities (Nov 2)
----------------------------------------
USN-850-1 fixed vulnerabilities in poppler. This update provides the
corresponding updates for Ubuntu 9.10. Original advisory details: It
was discovered that poppler contained multiple security issues when
parsing malformed PDF documents. If a user or automated system were
tricked into opening a crafted PDF file, an attacker could cause a
denial of service or execute arbitrary code with privileges of the
user invoking the program.
http://www.linuxsecurity.com/content/view/150547
------------------------------------------------------------------------
* Pardus: [UPDATED] Gd: Integer Overflow (Nov 3)
----------------------------------------------
[UPDATE] Same issue was fixed in Pardus 2008, please update your
system.
http://www.linuxsecurity.com/content/view/150549
* Pardus: [UPDATED] Perl-HTML-Parser: (Oct 30)
--------------------------------------------
A vulnerability has been found in Perl HTML-Parser module which
causes denial of service (infinite loop) via crafted input.
http://www.linuxsecurity.com/content/view/150536
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
[Fedora Announce]
[Linux Crypto]
[Kernel]
[Netfilter]
[Video for Linux]
[Bugtraq]
[USB]
[Fedora Security]
