Linux Advisory Watch: May 20th, 2011
+----------------------------------------------------------------------+
| LinuxSecurity.com Linux Advisory Watch |
| May 20th, 2011 Volume 12, Number 21 |
| |
| Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> |
| Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> |
+----------------------------------------------------------------------+
Thank you for reading the Linux Advisory Watch Security Newsletter. The
purpose of this document is to provide our readers with a quick summary of
each week's vendor security bulletins and pointers on methods to improve
the security posture of your open source system.
Vulnerabilities affect nearly every vendor virtually every week, so be
sure to read through to find the updates your distributor have made
available.
sec-wall: Open Source Security Proxy
------------------------------------
sec-wall, a recently released security proxy is a one-stop place for
everything related to securing HTTP/HTTPS traffic. Designed as a
pragmatic solution to the question of securing servers using SSL/TLS
certificates, WS-Security, HTTP Basic/Digest Auth, custom HTTP headers,
XPath expressions with an option of modifying HTTP headers and URLs on
the fly.
http://www.linuxsecurity.com/content/view/154884
--------------------------------------------------------------
* Debian: 2238-1: vino: Multiple vulnerabilities (May 19)
-------------------------------------------------------
Kevin Chen discovered that incorrect processing of framebuffer
requests in the Vino VNC server could lead to denial of service. For
the stable distribution (squeeze), this problem has been fixed in
[More...]
http://www.linuxsecurity.com/content/view/155112
* Debian: 2237-1: apr: denial of service (May 15)
-----------------------------------------------
A flaw was found in the APR library, which could be exploited through
Apache HTTPD's mod_autoindex. If a directory indexed by mod_autoindex
contained files with sufficiently long names, a remote attacker could
[More...]
http://www.linuxsecurity.com/content/view/155068
* Debian: 2236-1: exim4: command injection (May 12)
-------------------------------------------------
It was discovered that Exim, Debian's default mail transfer agent, is
vulnerable to command injection attacks in its DKIM processing code,
leading to arbitrary code execution. (CVE-2011-1407) [More...]
http://www.linuxsecurity.com/content/view/155056
------------------------------------------------------------------------
* Mandriva: 2011:095: apr (May 20)
--------------------------------
It was discovered that the fix for CVE-2011-0419 under certain
conditions could cause a denial-of-service (DoS) attack in APR
(CVE-2011-1928). Packages for 2009.0 are provided as of the Extended
Maintenance [More...]
http://www.linuxsecurity.com/content/view/155114
* Mandriva: 2011:094: pure-ftpd (May 19)
--------------------------------------
A denial-of-service (DoS) attack related to glob brace expansion was
discovered and fixed in pure-ftpd (CVE-2011-0418). Packages for
2009.0 are provided as of the Extended Maintenance Program. Please
visit this link to learn more: [More...]
http://www.linuxsecurity.com/content/view/155111
* Mandriva: 2011:093: gnome-screensaver (May 18)
----------------------------------------------
A vulnerability has been found and corrected in gnome-screensaver:
gnome-screensaver 2.14.3, 2.22.2, 2.27.x, 2.28.0, and 2.28.3, when
the X configuration enables the extend screen option, allows
physically proximate attackers to bypass screen locking, access an
unattended [More...]
http://www.linuxsecurity.com/content/view/155094
* Mandriva: 2011:092: perl-IO-Socket-SSL (May 18)
-----------------------------------------------
A vulnerability has been found and corrected in perl-IO-Socket-SSL:
IO::Socket::SSL Perl module 1.35, when verify_mode is not
VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error
when a ca_file/ca_path cannot be verified, which allows remote
attackers to [More...]
http://www.linuxsecurity.com/content/view/155093
* Mandriva: 2011:091: perl (May 18)
---------------------------------
A vulnerability has been found and corrected in perl: The (1) lc, (2)
lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x,
and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply
the taint attribute to the return value upon processing [More...]
http://www.linuxsecurity.com/content/view/155088
* Mandriva: 2011:090: postfix (May 17)
------------------------------------
A vulnerability has been found and corrected in postfix: The SMTP
server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before
2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication
methods are enabled, does not create a new server handle [More...]
http://www.linuxsecurity.com/content/view/155081
* Mandriva: 2011:089: mplayer (May 16)
------------------------------------
Multiple vulnerabilities have been identified and fixed in mplayer:
FFmpeg 0.5 allows remote attackers to cause a denial of service
(hang) via a crafted file that triggers an infinite loop.
(CVE-2009-4636) [More...]
http://www.linuxsecurity.com/content/view/155078
* Mandriva: 2011:088: mplayer (May 16)
------------------------------------
Multiple vulnerabilities have been identified and fixed in mplayer:
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain
pointer arithmetic, which might allow remote attackers to obtain
sensitive memory contents and cause a denial of service via a crafted
[More...]
http://www.linuxsecurity.com/content/view/155077
* Mandriva: 2011:087: vino (May 16)
---------------------------------
Multile vulnerabilities has been found and corrected in vino: The
rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c
in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x
before 3.0.2, and 3.1.x before [More...]
http://www.linuxsecurity.com/content/view/155071
* Mandriva: 2011:086: polkit (May 16)
-----------------------------------
A vulnerability has been found and corrected in polkit: A race
condition flaw was found in the PolicyKit pkexec utility and polkitd
daemon. A local user could use this flaw to appear as a privileged
user to pkexec, allowing them to execute arbitrary commands [More...]
http://www.linuxsecurity.com/content/view/155070
* Mandriva: 2011:085: libmodplug (May 13)
---------------------------------------
A vulnerability has been found and corrected in libmodplug:
Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in
libmodplug before 0.8.8.2 allows remote attackers to execute
arbitrary code via a crafted S3M file (CVE-2011-1574). [More...]
http://www.linuxsecurity.com/content/view/155065
* Mandriva: 2011:084: apr (May 13)
--------------------------------
It was discovered that the apr_fnmatch() function used an
unconstrained recursion when processing patterns with the
'*' wildcard. An attacker could use this flaw to cause an
application using this function, which also accepted untrusted input
as a pattern for matching (such as an httpd server using the
mod_autoindex module), to exhaust all [More...]
http://www.linuxsecurity.com/content/view/155063
* Mandriva: 2011:083: wireshark (May 12)
--------------------------------------
This advisory updates wireshark to the latest version (1.2.16),
fixing several security issues: The X.509if dissector in Wireshark
1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly
initialize certain global variables, [More...]
http://www.linuxsecurity.com/content/view/155057
------------------------------------------------------------------------
* Red Hat: 2011:0600-01: dovecot: Moderate Advisory (May 19)
----------------------------------------------------------
Updated dovecot packages that fix two security issues and add one
enhancement are now available for Red Hat Enterprise Linux 6. The Red
Hat Security Response Team has rated this update as having moderate
[More...]
http://www.linuxsecurity.com/content/view/155107
* Red Hat: 2011:0599-01: sudo: Low Advisory (May 19)
--------------------------------------------------
An updated sudo package that fixes one security issue and several
bugs is now available for Red Hat Enterprise Linux 6. The Red Hat
Security Response Team has rated this update as having low [More...]
http://www.linuxsecurity.com/content/view/155106
* Red Hat: 2011:0586-01: libguestfs: Low Advisory (May 19)
--------------------------------------------------------
Updated libguestfs packages that fix one security issue, several
bugs, and add one enhancement are now available for Red Hat
Enterprise Linux 6. The Red Hat Security Response Team has rated this
update as having low [More...]
http://www.linuxsecurity.com/content/view/155105
* Red Hat: 2011:0677-01: openssl: Moderate Advisory (May 19)
----------------------------------------------------------
Updated openssl packages that fix one security issue, two bugs, and
add two enhancements are now available for Red Hat Enterprise Linux
6. The Red Hat Security Response Team has rated this update as having
moderate [More...]
http://www.linuxsecurity.com/content/view/155100
* Red Hat: 2011:0558-01: perl: Moderate Advisory (May 19)
-------------------------------------------------------
Updated perl packages that fix three security issues and several bugs
are now available for Red Hat Enterprise Linux 6. The Red Hat
Security Response Team has rated this update as having moderate
[More...]
http://www.linuxsecurity.com/content/view/155101
* Red Hat: 2011:0560-01: sssd: Low Advisory (May 19)
--------------------------------------------------
Updated sssd packages that fix one security issue, several bugs, and
add various enhancements are now available for Red Hat Enterprise
Linux 6. The Red Hat Security Response Team has rated this update as
having low [More...]
http://www.linuxsecurity.com/content/view/155102
* Red Hat: 2011:0779-01: avahi: Moderate Advisory (May 19)
--------------------------------------------------------
Updated avahi packages that fix one security issue and one bug are
now available for Red Hat Enterprise Linux 6. The Red Hat Security
Response Team has rated this update as having moderate [More...]
http://www.linuxsecurity.com/content/view/155103
* Red Hat: 2011:0791-01: tomcat6: Moderate Advisory (May 19)
----------------------------------------------------------
Updated tomcat6 packages that fix three security issues and several
bugs are now available for Red Hat Enterprise Linux 6. The Red Hat
Security Response Team has rated this update as having moderate
[More...]
http://www.linuxsecurity.com/content/view/155104
* Red Hat: 2011:0616-01: pidgin: Low Advisory (May 19)
----------------------------------------------------
Updated pidgin packages that fix multiple security issues and various
bugs are now available for Red Hat Enterprise Linux 6. The Red Hat
Security Response Team has rated this update as having low [More...]
http://www.linuxsecurity.com/content/view/155098
* Red Hat: 2011:0568-01: eclipse: Low Advisory (May 19)
-----------------------------------------------------
Updated eclipse packages that fix one security issue, several bugs,
and add various enhancements are now available for Red Hat Enterprise
Linux 6. The Red Hat Security Response Team has rated this update as
having low [More...]
http://www.linuxsecurity.com/content/view/155099
* Red Hat: 2011:0554-01: python: Moderate Advisory (May 19)
---------------------------------------------------------
Updated python packages that fix three security issues, several bugs,
and add various enhancements are now available for Red Hat Enterprise
Linux 6. The Red Hat Security Response Team has rated this update as
having moderate [More...]
http://www.linuxsecurity.com/content/view/155095
* Red Hat: 2011:0534-01: qemu-kvm: Important Advisory (May 19)
------------------------------------------------------------
Updated qemu-kvm packages that fix two security issues, several bugs,
and add various enhancements are now available for Red Hat Enterprise
Linux 6. The Red Hat Security Response Team has rated this update as
having [More...]
http://www.linuxsecurity.com/content/view/155096
* Red Hat: 2011:0545-01: squid: Low Advisory (May 19)
---------------------------------------------------
An updated squid package that fixes one security issue and two bugs
is now available for Red Hat Enterprise Linux 6. The Red Hat Security
Response Team has rated this update as having low [More...]
http://www.linuxsecurity.com/content/view/155097
* Red Hat: 2011:0511-01: flash-plugin: Critical Advisory (May 13)
---------------------------------------------------------------
An updated Adobe Flash Player package that fixes multiple security
issues is now available for Red Hat Enterprise Linux 5 and 6
Supplementary. The Red Hat Security Response Team has rated this
update as having critical [More...]
http://www.linuxsecurity.com/content/view/155058
------------------------------------------------------------------------
* Slackware: 2011-133-01: apr/apr-util: Security Update (May 14)
--------------------------------------------------------------
New apr and apr-util packages are available for Slackware 11.0, 12.0,
12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue.
[More Info...]
http://www.linuxsecurity.com/content/view/155066
* Slackware: 2011-133-02: httpd: Security Update (May 14)
-------------------------------------------------------
New httpd packages are available for Slackware 12.0, 12.1, 12.2,
13.0, 13.1, 13.37, and -current. These have been compiled against
the new versions of apr and apr-util, which were upgraded to fix a
security issue that affects Apache httpd. It is recommended that all
three updates be applied. [More Info...]
http://www.linuxsecurity.com/content/view/155067
------------------------------------------------------------------------
* SuSE: 2011-026: Linux kernel (May 20)
-------------------------------------
This kernel update for the SUSE Linux Enterprise 10 SP4 kernel fixes
several security issues and bugs. Following security issues were
fixed: CVE-2011-1017,CVE-2011-1012: The code for evaluating LDM
partitions (in fs/partitions/ldm.c) contained bugs that could crash
the kernel [More...]
http://www.linuxsecurity.com/content/view/155113
* SuSE: 2011-025: flash-player (May 18)
-------------------------------------
Flash Player has been updated to version 10.3, fixing bugs and
security issues. - CVE-2011-0589: CVSS v2 Base Score: 6.8
(AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119) -
CVE-2011-0618: CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P):
[More...]
http://www.linuxsecurity.com/content/view/155087
* SuSE: Weekly Summary 2011:009 (May 17)
--------------------------------------
To avoid flooding mailing lists with SUSE Security Announcements for
minor issues, SUSE Security releases weekly summary reports for the
low profile vulnerability fixes. The SUSE Security Summary Reports do
not list or download URLs like the SUSE Security Announcements that
are released for more severe vulnerabilities. List of
vulnerabilities in this summary include: mailman, openssl, tgt,
rsync, vsftpd, libzip1/libzip-devel, otrs, libtiff, kdelibs4,
libwebkit, libpython2_6-1_0, perl, pure-ftpd, collectd, vino,
aaa_base, exim.
http://www.linuxsecurity.com/content/view/155082
* SuSE: 2011-024: IBM Java 1.4.2 (May 13)
---------------------------------------
IBM Java 1.4.2 was updated to SR 13 Fix Pack 9, fixing bugs and
security issues. More information can be found on the IBM JDK Alerts
page: http://www.ibm.com/developerworks/java/jdk/alerts/
http://www.linuxsecurity.com/content/view/155059
------------------------------------------------------------------------
* Ubuntu: 1132-1: apturl vulnerability (May 16)
---------------------------------------------
apturl could be made to cause your desktop to crash if it opened a
verylong URL.
http://www.linuxsecurity.com/content/view/155079
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
[Fedora Announce]
[Linux Crypto]
[Kernel]
[Netfilter]
[Video for Linux]
[Bugtraq]
[USB]
[Fedora Security]
