Linux Advisory Watch: August 20th, 2010
+----------------------------------------------------------------------+
| LinuxSecurity.com Linux Advisory Watch |
| August 20th, 2010 Volume 11, Number 34 |
| |
| Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> |
| Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> |
+----------------------------------------------------------------------+
Thank you for reading the Linux Advisory Watch Security Newsletter. The
purpose of this document is to provide our readers with a quick summary of
each week's vendor security bulletins and pointers on methods to improve
the security posture of your open source system.
Vulnerabilities affect nearly every vendor virtually every week, so be
sure to read through to find the updates your distributor have made
available.
Review: Zabbix 1.8 Network Monitoring
-------------------------------------
If you have anything more than a small home network, you need to be
monitoring the status of your systems to ensure they are providing the
services they were designed to provide. Rihards Olups has created a
comprehensive reference and usability guide for the latest version of
Zabbix that anyone being tasked with implementing should have by their
side.
http://www.linuxsecurity.com/content/view/152990
Meet the Anti-Nmap: PSAD
------------------------
How would you know if someone is scanning your defenses? Is there any way
to properly respond to such scans? You bet there is...
http://www.linuxsecurity.com/content/view/134248
--> Take advantage of the LinuxSecurity.com Quick Reference Card! <--
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <--
------------------------------------------------------------------------
* EnGarde Secure Community 3.0.22 Now Available!
----------------------------------------------
Guardian Digital is happy to announce the release of EnGarde Secure
Community 3.0.22 (Version 3.0, Release 22). This release includes
many updated packages and bug fixes and some feature enhancements to
the EnGarde Secure Linux Installer and the SELinux policy.
http://www.linuxsecurity.com/content/view/145668
------------------------------------------------------------------------
* Debian: 2094-1: linux-2.6: privilege escalation/denial (Aug 19)
---------------------------------------------------------------
CVE-2009-4895 Kyle Bader reported an issue in the tty subsystem that
allows local users to create a denial of service (NULL pointer
dereference). [More...]
http://www.linuxsecurity.com/content/view/153078
* Debian: 2093-1: ghostscript: Multiple vulnerabilities (Aug 19)
--------------------------------------------------------------
Two security issues have been discovered in Ghostscript, the GPL
PostScript/PDF interpreter. The Common Vulnerabilities and Exposures
project identifies the following problems: [More...]
http://www.linuxsecurity.com/content/view/153069
* Debian: 1919-2: smarty: Multiple vulnerabilities (Aug 17)
---------------------------------------------------------
A regression was found in the patch applied in DSA 1919-1 to smarty,
which caused compilation failures on some specific templates. This
update corrects the fix. For reference, the full advisory text below.
[More...]
http://www.linuxsecurity.com/content/view/153063
* Debian: 2092-1: lxr-cvs: missing input sanitizing (Aug 17)
----------------------------------------------------------
Dan Rosenberg discovered that in lxr-cvs, a code-indexing tool with a
web frontend, not enough sanitation of user input is performed; an
attacker can take advantage of this and pass script code in order to
perform cross-site scripting attacks. [More...]
http://www.linuxsecurity.com/content/view/153062
* Debian: 2091-1: squirrelmail: No user-specific token impl (Aug 12)
------------------------------------------------------------------
SquirrelMail, a webmail application, does not employ a user-specific
token for webforms. This allows a remote attacker to perform a Cross
Site Request Forgery (CSRF) attack. The attacker may hijack the
authentication of unspecified victims and send messages or change
user preferences among other [More...]
http://www.linuxsecurity.com/content/view/153028
------------------------------------------------------------------------
* Mandriva: 2010:155: mysql (Aug 20)
----------------------------------
Multiple vulnerabilities has been found and corrected in mysql: MySQL
before 5.1.48 allows remote authenticated users with alter database
privileges to cause a denial of service (server crash and database
loss) via an ALTER DATABASE command with a #mysql50# [More...]
http://www.linuxsecurity.com/content/view/153085
* Mandriva: 2010:154: cabextract (Aug 16)
---------------------------------------
Multiple vulnerabilities has been found and corrected in cabextract:
The MS-ZIP decompressor in cabextract before 1.3 allows remote
attackers to cause a denial of service (infinite loop) via a
malformed MSZIP archive in a .cab file during a test or extract
action, related [More...]
http://www.linuxsecurity.com/content/view/153049
* Mandriva: 2010:153: apache (Aug 16)
-----------------------------------
Multiple vulnerabilities has been found and corrected in apache: The
mod_cache and mod_dav modules in the Apache HTTP Server 2.2.x before
2.2.16 allow remote attackers to cause a denial of service (process
crash) via a request that lacks a path (CVE-2010-1452). [More...]
http://www.linuxsecurity.com/content/view/153048
* Mandriva: 2010:152: apache (Aug 16)
-----------------------------------
A vulnerabilitiy has been found and corrected in apache: The
mod_cache and mod_dav modules in the Apache HTTP Server 2.2.x before
2.2.16 allow remote attackers to cause a denial of service (process
crash) via a request that lacks a path (CVE-2010-1452). [More...]
http://www.linuxsecurity.com/content/view/153046
* Mandriva: 2010:151: libmikmod (Aug 16)
--------------------------------------
A vulnerability has been discovered and corrected in libmikmod:
Multiple heap-based buffer overflows might allow remote attackers to
execute arbitrary code via (1) crafted samples or (2) crafted
instrument definitions in an Impulse Tracker file (CVE-2009-3995).
[More...]
http://www.linuxsecurity.com/content/view/153039
* Mandriva: 2010:150: libsndfile (Aug 14)
---------------------------------------
A vulnerability has been discovered and corrected in libsndfile: The
(1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5)
float32_init, and (6) sds_read_header functions in libsndfile 1.0.20
allow context-dependent attackers to cause a denial of service
[More...]
http://www.linuxsecurity.com/content/view/153038
* Mandriva: 2010:149: freetype2 (Aug 12)
--------------------------------------
A vulnerability has been discovered and corrected in freetype2:
Multiple stack overflow flaws have been reported in the way FreeType
font rendering engine processed certain CFF opcodes. An attacker
could use these flaws to create a specially-crafted font file that,
[More...]
http://www.linuxsecurity.com/content/view/153015
* Mandriva: 2010:148: pidgin (Aug 12)
-----------------------------------
A security vulnerability has been identified and fixed in pidgin: The
clientautoresp function in family_icbm.c in the oscar protocol plugin
in libpurple in Pidgin before 2.7.2 allows remote authenticated users
to cause a denial of service (NULL pointer dereference and [More...]
http://www.linuxsecurity.com/content/view/153008
------------------------------------------------------------------------
* Red Hat: 2010:0636-02: acroread: Critical Advisory (Aug 20)
-----------------------------------------------------------
Updated acroread packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 4 Extras and Red Hat
Enterprise Linux 5 Supplementary. [More...]
http://www.linuxsecurity.com/content/view/153079
* Red Hat: 2010:0627-01: kvm: Important Advisory (Aug 19)
-------------------------------------------------------
Updated kvm packages that fix three security issues and multiple bugs
are now available for Red Hat Enterprise Linux 5. The Red Hat
Security Response Team has rated this update as having [More...]
http://www.linuxsecurity.com/content/view/153076
* Red Hat: 2010:0633-01: qspice: Important Advisory (Aug 19)
----------------------------------------------------------
Updated qspice packages that fix two security issues are now
available for Red Hat Enterprise Linux 5. The Red Hat Security
Response Team has rated this update as having [More...]
http://www.linuxsecurity.com/content/view/153077
* Red Hat: 2010:0631-01: kernel-rt: Important Advisory (Aug 17)
-------------------------------------------------------------
Updated kernel-rt packages that fix multiple security issues and
several bugs are now available for Red Hat Enterprise MRG 1.2. The
Red Hat Security Response Team has rated this update as having
[More...]
http://www.linuxsecurity.com/content/view/153060
------------------------------------------------------------------------
* SuSE: 2010-035: Linux kernel (Aug 18)
-------------------------------------
This SUSE Linux Enterprise 10 SP3 kernel was updated to fix various
bugs and one security issue. CVE-2010-1087: The nfs_wait_on_request
function in fs/nfs/pagelist.c in the Linux kernel allows attackers to
cause a denial of service (Oops) [More...]
http://www.linuxsecurity.com/content/view/153064
* SuSE: Weekly Summary 2010:015 (Aug 17)
--------------------------------------
To avoid flooding mailing lists with SUSE Security Announcements for
minor issues, SUSE Security releases weekly summary reports for the
low profile vulnerability fixes. The SUSE Security Summary Reports do
not list or download URLs like the SUSE Security Announcements that
are released for more severe vulnerabilities. List of
vulnerabilities in this summary include: gpg2, krb5, kvirc,
libpcsclite1/pcsc-lite, libpython2_6-1_0, libvorbis, libwebkit,
squidGuard, strongswan.
http://www.linuxsecurity.com/content/view/153050
* SuSE: 2010-034: flash-player (Aug 13)
-------------------------------------
Flash Player was updated to version 10.1.82.76 fixing several
critical security issues: - CVE-2010-0209: CVSS v2 Base Score: 9.3:
Code Injection (CWE-94) Details unknown. - CVE-2010-2188: CVSS v2
Base Score: 6.8: Buffer Errors (CWE-119) [More...]
http://www.linuxsecurity.com/content/view/153030
------------------------------------------------------------------------
* Ubuntu: 974-1: Linux kernel vulnerabilities (Aug 19)
----------------------------------------------------
Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the
memorymanager did not properly handle when applications grow stacks
into adjacentmemory regions. A local attacker could exploit this to
gain control ofcertain applications, potentially leading to privilege
escalation, asdemonstrated in attacks against the X server.
(CVE-2010-2240) [More...]
http://www.linuxsecurity.com/content/view/153075
* Ubuntu: 973-1: KOffice vulnerabilities (Aug 17)
-----------------------------------------------
Will Dormann, Alin Rad Pop, Braden Thomas, and Drew Yao discovered
that theXpdf used in KOffice contained multiple security issues in
its JBIG2decoder. If a user or automated system were tricked into
opening a craftedPDF file, an attacker could cause a denial of
service or execute arbitrarycode with privileges of the user invoking
the program. (CVE-2009-0146, [More...]
http://www.linuxsecurity.com/content/view/153061
* Ubuntu: 972-1: FreeType vulnerabilities (Aug 17)
------------------------------------------------
It was discovered that FreeType did not correctly handle certain
malformedfont files. If a user were tricked into using a specially
crafted fontfile, a remote attacker could cause FreeType to crash or
possibly executearbitrary code with user privileges. [More...]
http://www.linuxsecurity.com/content/view/153059
* Ubuntu: 971-1: OpenJDK vulnerabilities (Aug 16)
-----------------------------------------------
It was discovered that the IcedTea plugin did not correctly check
certainaccesses. If a user or automated system were tricked into
running aspecially crafted Java applet, a remote attacker could read
arbitraryfiles with user privileges, leading to a loss of privacy.
(CVE-2010-2548,CVE-2010-2783) [More...]
http://www.linuxsecurity.com/content/view/153047
------------------------------------------------------------------------
* Pardus: 2010-105: Gnupg: Arbitrary Code Execution (Aug 12)
----------------------------------------------------------
A vulnerability has been fixed in GnuPG, which can be exploited by
malicious people to potentially compromise a user's system.
http://www.linuxsecurity.com/content/view/153016
* Pardus: 2010-109: Cabextract: Multiple (Aug 12)
-----------------------------------------------
Multiple vulnerabilities have been fixed in cabextract.
http://www.linuxsecurity.com/content/view/153017
* Pardus: 2010-107: Firefox: Multiple Vulnerabilities (Aug 12)
------------------------------------------------------------
Multiple vulnerabilities have been fixed in Firefox.
http://www.linuxsecurity.com/content/view/153018
* Pardus: 2010-110: Iputils: Denial of Service (Aug 12)
-----------------------------------------------------
A denial of service vulnerability has been fixed in Iputils.
http://www.linuxsecurity.com/content/view/153019
* Pardus: 2010-111: Vte: Arbitrary Code Execution (Aug 12)
--------------------------------------------------------
A vulnerability has been fixed in Vte, which an allow malicious users
to execute arbitrary code
http://www.linuxsecurity.com/content/view/153020
* Pardus: 2010-112: Kernel: Multiple Vulnerabilities (Aug 12)
-----------------------------------------------------------
Multiple vulnerabilities have been fixed in kernel
http://www.linuxsecurity.com/content/view/153021
* Pardus: 2010-113: Wireshark: Multiple (Aug 12)
----------------------------------------------
Multiple vulnerabilities have been fixed in Wireshark.
http://www.linuxsecurity.com/content/view/153022
* Pardus: 2010-114: FreeType: Multiple Vulnerabilities (Aug 12)
-------------------------------------------------------------
Multiple vulnerabilities have been fixed in FreeType.
http://www.linuxsecurity.com/content/view/153023
* Pardus: 2010-115: Kvirc: Remote Code Execution (Aug 12)
-------------------------------------------------------
A vulnerability was fixed in kvirc, which can be used by malicious
people to execute arbitrary IRC commands via CTCP request.
http://www.linuxsecurity.com/content/view/153024
* Pardus: 2010-108: Rekonq: XSS Vulnerability (Aug 12)
----------------------------------------------------
Universal XSS vulnerability has been fixed in Rekonq.
http://www.linuxsecurity.com/content/view/153025
* Pardus: 2010-116: Pidgin: Denial of Service (Aug 12)
----------------------------------------------------
A flaw has been fixed in Pidgin, which can allow remote attackers to
cause denial of service via X-Status message.
http://www.linuxsecurity.com/content/view/153026
* Pardus: 2010-106: Qt: Multiple Vulnerabilities (Aug 12)
-------------------------------------------------------
Multiple vulnerabilities have been fixed in Qt.
http://www.linuxsecurity.com/content/view/153027
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
[Fedora Announce]
[Linux Crypto]
[Kernel]
[Netfilter]
[Video for Linux]
[Bugtraq]
[USB]
[Fedora Security]
