Linux Advisory Watch: December 16th, 2011
+----------------------------------------------------------------------+
| LinuxSecurity.com Linux Advisory Watch |
| December 16th, 2011 Volume 12, Number 51 |
| |
| Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> |
+----------------------------------------------------------------------+
Thank you for reading the Linux Advisory Watch Security Newsletter. The
purpose of this document is to provide our readers with a quick summary of
each week's vendor security bulletins and pointers on methods to improve
the security posture of your open source system.
Vulnerabilities affect nearly every vendor virtually every week, so be
sure to read through to find the updates your distributor have made
available.
Password guessing as an attack vector
-------------------------------------
Using password guessing as an attack vector. Over the years we've been
taught a strong password must be long and complex to be considered
secure. Some of us have taken that notion to heart and always ensure
our passwords are strong. But some don't give a second thought to the
complexity or length of our password.
http://www.linuxsecurity.com/content/view/156412
------------------------------------------------------------------------
* Debian: 2362-1: acpid: Multiple vulnerabilities (Dec 10)
--------------------------------------------------------
Multiple vulnerabilities were found in the acpid, the Advanced
Configuration and Power Interface event daemon: CVE-2011-1159
[More...]
http://www.linuxsecurity.com/content/view/156392
------------------------------------------------------------------------
* Mandriva: 2011:189: jasper (Dec 16)
-----------------------------------
Multiple vulnerabilities has been discovered and corrected in jasper:
Heap-based buffer overflow in the jpc_cox_getcompparms function in
libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to
execute arbitrary code or cause a denial of service (memory
corruption) [More...]
http://www.linuxsecurity.com/content/view/156433
* Mandriva: 2011:188: libxml2 (Dec 15)
------------------------------------
Multiple vulnerabilities has been discovered and corrected in
libxml2: Off-by-one error in libxml allows remote attackers to
execute arbitrary code or cause a denial of service (heap-based
buffer overflow and application crash) via a crafted web site
CVE-2011-0216). [More...]
http://www.linuxsecurity.com/content/view/156432
* Mandriva: 2011:187: php-pear (Dec 15)
-------------------------------------
A vulnerability has been discovered and corrected in php-pear: The
installer in PEAR before 1.9.2 allows local users to overwrite
arbitrary files via a symlink attack on the package.xml file, related
to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and [More...]
http://www.linuxsecurity.com/content/view/156431
* Mandriva: 2011:186: nfs-utils (Dec 12)
--------------------------------------
A vulnerability has been discovered and corrected in nfs-utils: It
was found that the mount.nfs tool did not handle certain errors
correctly when updating the mtab (mounted file systems table) file. A
local attacker could use this flaw to corrupt the mtab file [More...]
http://www.linuxsecurity.com/content/view/156403
* Mandriva: 2011:185: libcap (Dec 12)
-----------------------------------
A vulnerability has been discovered and corrected in libcap: capsh
did not chdir(/) after callling chroot(). Programs could therefore
access the current directory outside of the chroot (CVE-2011-4099).
[More...]
http://www.linuxsecurity.com/content/view/156395
* Mandriva: 2011:184: krb5 (Dec 12)
---------------------------------
A vulnerability has been discovered and corrected in krb5: The
process_tgs_req function in do_tgs_req.c in the Key Distribution
Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows
remote authenticated users to cause a denial of service (NULL pointer
[More...]
http://www.linuxsecurity.com/content/view/156394
* Mandriva: 2011:183: pidgin (Dec 10)
-----------------------------------
Multiple vulnerabilities has been discovered and corrected in pidgin:
When receiving various stanzas related to voice and video chat, the
XMPP protocol plugin failed to ensure that the incoming message
contained all required fields, and would crash if certain fields
[More...]
http://www.linuxsecurity.com/content/view/156393
* Mandriva: 2011:182: dhcp (Dec 8)
--------------------------------
A vulnerability has been discovered and corrected in dhcp: dhcpd in
ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not
properly handle regular expressions in dhcpd.conf, which allows
remote attackers to cause a denial of service (daemon crash)
[More...]
http://www.linuxsecurity.com/content/view/156380
------------------------------------------------------------------------
* Red Hat: 2011:1821-01: pidgin: Moderate Advisory (Dec 14)
---------------------------------------------------------
Updated pidgin packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 6. The Red Hat Security
Response Team has rated this update as having moderate [More...]
http://www.linuxsecurity.com/content/view/156424
* Red Hat: 2011:1820-01: pidgin: Moderate Advisory (Dec 14)
---------------------------------------------------------
Updated pidgin packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security
Response Team has rated this update as having moderate [More...]
http://www.linuxsecurity.com/content/view/156423
* Red Hat: 2011:1819-01: dhcp: Moderate Advisory (Dec 14)
-------------------------------------------------------
Updated dhcp packages that fix one security issue are now available
for Red Hat Enterprise Linux 6. The Red Hat Security Response Team
has rated this update as having moderate [More...]
http://www.linuxsecurity.com/content/view/156422
* Red Hat: 2011:1815-01: icu: Moderate Advisory (Dec 13)
------------------------------------------------------
Updated icu packages that fix one security issue are now available
for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response
Team has rated this update as having moderate [More...]
http://www.linuxsecurity.com/content/view/156417
* Red Hat: 2011:1814-01: ipmitool: Moderate Advisory (Dec 13)
-----------------------------------------------------------
An updated ipmitool package that fixes one security issue is now
available for Red Hat Enterprise Linux 6. The Red Hat Security
Response Team has rated this update as having moderate [More...]
http://www.linuxsecurity.com/content/view/156416
* Red Hat: 2011:1813-01: kernel: Important Advisory (Dec 13)
----------------------------------------------------------
Updated kernel packages that fix several security issues and various
bugs are now available for Red Hat Enterprise Linux 5.6 Extended
Update Support. The Red Hat Security Response Team has rated this
update as having [More...]
http://www.linuxsecurity.com/content/view/156415
* Red Hat: 2011:1811-01: netpbm: Important Advisory (Dec 12)
----------------------------------------------------------
Updated netpbm packages that fix three security issues are now
available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security
Response Team has rated this update as having [More...]
http://www.linuxsecurity.com/content/view/156402
* Red Hat: 2011:1807-01: jasper: Important Advisory (Dec 9)
---------------------------------------------------------
Updated jasper packages that fix two security issues are now
available for Red Hat Enterprise Linux 6. The Red Hat Security
Response Team has rated this update as having [More...]
http://www.linuxsecurity.com/content/view/156387
* Red Hat: 2011:1801-01: qemu-kvm: Important Advisory (Dec 8)
-----------------------------------------------------------
Updated qemu-kvm packages that fix one security issue are now
available for Red Hat Enterprise Linux 6.1 Extended Update Support.
The Red Hat Security Response Team has rated this update as having
[More...]
http://www.linuxsecurity.com/content/view/156385
* Red Hat: 2011:1797-01: perl: Moderate Advisory (Dec 8)
------------------------------------------------------
Updated perl packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security
Response Team has rated this update as having moderate [More...]
http://www.linuxsecurity.com/content/view/156384
------------------------------------------------------------------------
* Ubuntu: 1309-1: DHCP vulnerability (Dec 15)
-------------------------------------------
DHCP could be made to crash if it received specially crafted
networktraffic.
http://www.linuxsecurity.com/content/view/156430
* Ubuntu: 1308-1: bzip2 vulnerability (Dec 14)
--------------------------------------------
Executables compressed by bzexe could be made to run programs as
yourlogin.
http://www.linuxsecurity.com/content/view/156425
* Ubuntu: 1307-1: PHP vulnerability (Dec 14)
------------------------------------------
PHP could be made to crash or disclose sensitive information if
itprocessed a specially crafted image file.
http://www.linuxsecurity.com/content/view/156421
* Ubuntu: 1305-1: Nova vulnerability (Dec 13)
-------------------------------------------
Nova could be made to overwrite files.
http://www.linuxsecurity.com/content/view/156413
* Ubuntu: 1304-1: Linux kernel (OMAP4) vulnerabilities (Dec 13)
-------------------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156410
* Ubuntu: 1303-1: Linux kernel (Marvell DOVE) vulnerabilities (Dec 13)
--------------------------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156409
* Ubuntu: 1302-1: Linux kernel (OMAP4) vulnerabilities (Dec 13)
-------------------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156408
* Ubuntu: 1301-1: Linux kernel (Natty backport) vulnerabilities (Dec 13)
----------------------------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156407
* Ubuntu: 1300-1: Linux kernel (FSL-IMX51) vulnerabilities (Dec 13)
-----------------------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156406
* Ubuntu: 1299-1: Linux kernel (EC2) vulnerabilities (Dec 13)
-----------------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156405
* Ubuntu: 1298-1: Apache Commons Daemon vulnerability (Dec 12)
------------------------------------------------------------
Apache Commons Daemon would allow unintended access to files over
thenetwork.
http://www.linuxsecurity.com/content/view/156401
* Ubuntu: 1296-1: acpid vulnerabilities (Dec 8)
---------------------------------------------
Several security issues were fixed in acpid.
http://www.linuxsecurity.com/content/view/156386
* Ubuntu: 1294-1: Linux kernel (Oneiric backport) vulnerabilities (Dec 8)
-----------------------------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156379
* Ubuntu: 1293-1: Linux kernel vulnerabilities (Dec 8)
----------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156378
* Ubuntu: 1292-1: Linux kernel (Maverick backport) vulnerabilities (Dec 8)
------------------------------------------------------------------------
Several security issues were fixed in the kernel.
http://www.linuxsecurity.com/content/view/156377
* Ubuntu: 1291-1: Linux kernel vulnerabilities (Dec 8)
----------------------------------------------------
Several security issues were fixed in XXX-APP-XXX.
http://www.linuxsecurity.com/content/view/156376
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
[Fedora Announce]
[Linux Crypto]
[Kernel]
[Netfilter]
[Video for Linux]
[Bugtraq]
[USB]
[Fedora Security]
