Re: [Full-Disclosure] Redhat 9 PHP 4.2.2 update for the memory_limit vulnerability
On Wed, 2004-07-21 at 21:18, Jeff Gillian wrote: > Are there any PHP rpms out there for Redhat 9 that have the memory_limit fix? > > I've been looking for hours and I haven't found anything that works > with RedHat 9. You can get a test build of php for Red Hat 9 from the Fedora Legacy Project. https://bugzilla.fedora.us/show_bug.cgi?id=1868 They have not been QA'd yet, but they should work. Please leave a comment in the bug report if they work for you. Marc. ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2004:1833] Updated lha resolves security vulnerabilities
--- Fedora Legacy Update Advisory Synopsis: Updated lha resolves security vulnerabilities Advisory ID: FLSA:1833 Issue date:2004-10-13 Product: Red Hat Linux Keywords: Security Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1833 CVE Names: CAN-2004-0234, CAN-2004-0235, CAN-2004-0694, CAN-2004-0745, CAN-2004-0769, CAN-2004-0771 --- --- 1. Topic: Updated lha packages that fix multiple security vulnerabilities are now available. LHA is an archiving and compression utility for LHarc format archives. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: Ulf Harnhammar discovered two stack buffer overflows and two directory traversal flaws in LHA. An attacker could exploit the buffer overflows by creating a carefully crafted LHA archive in such a way that arbitrary code would be executed when the archive is tested or extracted by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0234 to this issue. An attacker could exploit the directory traversal issues to create files as the victim outside of the expected directory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0235 to this issue. Lukasz Wojtow discovered a stack-based buffer overflow in all versions of lha up to and including version 1.14. A carefully created archive could allow an attacker to execute arbitrary code when a victim extracts or tests the archive. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0769 to this issue. Buffer overflows were discovered in the command line processing of all versions of lha up to and including version 1.14. If a malicious user could trick a victim into passing a specially crafted command line to the lha command, it is possible that arbitrary code could be executed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0771 and CAN-2004-0694 to these issues. Thomas Biege discovered a shell meta character command execution vulnerability in all versions of lha up to and including 1.14. An attacker could create a directory with shell meta characters in its name which could lead to arbitrary command execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0745 to this issue. All users are advised to upgrade to these updated packages, which contain a backported fix and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 1833 - CAN-2004-0694,0745,0769,0771 - Another buffer overflow in LHA http://bugzilla.fedora.us - 1547 - LHA directory traversal, buffer overflow vulns 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/lha-1.14i-4.7.3.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/lha-1.14i-4.7.3.3.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/lha-1.14i-9.4.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/lha-1.14i-9.4.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --- 421a0998d84a2b75ebaa0bb334273ce1dad2be88 7.3/updates/i386/lha-1.14i-4.7.3.3.legacy.i386.rpm aa6033fd436ea908b38b2035f096223f92ed780d 7.3/updates/SRPMS/lha-1.14i-4.7.3.3.legacy.src.rpm 4458d9eec9f7706070f67e0263aab497bced075a 9/updates/i386/lha-1.14i-9.4.legacy.i386.rpm b1ae50a84ca44b9e515757b6e0363ce5bf53d8ab 9/updates/SRPMS/lha-1.14i-9.4.lega
[Full-Disclosure] [FLSA-2004:1888] Updated mod_ssl package fixes Apache security vulnerabilities
--- Fedora Legacy Update Advisory Synopsis: Updated mod_ssl package fixes Apache security vulnerabilities Advisory ID: FLSA:1888 Issue date:2004-10-13 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1888 CVE Names: CAN-2004-0488 CAN-2004-0700 --- --- 1. Topic: Updated mod_ssl packages that fix minor security issues in the Apache Web server are now available. The Apache HTTP Server is a powerful, full-featured, efficient, and freely-available Web server. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: A stack buffer overflow was discovered in mod_ssl which can be triggered if using the FakeBasicAuth option. If mod_ssl is sent a client certificate with a subject DN field longer than 6000 characters, a stack overflow can occur if FakeBasicAuth has been enabled. In order to exploit this issue the carefully crafted malicious certificate would have to be signed by a Certificate Authority which mod_ssl is configured to trust. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0488 to this issue. A format string issue was discovered in mod_ssl for Apache 1.3 which can be triggered if mod_ssl is configured to allow a client to proxy to remote SSL sites. In order to exploit this issue, a user who is authorized to use Apache as a proxy would have to attempt to connect to a carefully crafted hostname via SSL. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0700 to this issue. All users of the Apache HTTP Server are advised to upgrade to these erratum packages, which contain a backported fix and are not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #1708 http://bugzilla.fedora.us - bug #1888 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mod_ssl-2.8.12-6.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/mod_ssl-2.8.12-6.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --- 211714e3a8faab1152e76471f1085f3d8ef30400 7.3/updates/i386/mod_ssl-2.8.12-6.legacy.i386.rpm 027bf3500924d4bb58bd8bb0ed452420a0e134bc 7.3/updates/SRPMS/mod_ssl-2.8.12-6.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0488 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0700 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: This is a digitally signed message part
Re: [Full-Disclosure] my first orgasem
I\\\'ll come with you *smiles* we come gay you and me... ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2004:1737] Updated httpd packages fix a mod_proxy security vulnerability
--- Fedora Legacy Update Advisory Synopsis: Updated httpd packages fix a mod_proxy security vulnerability Advisory ID: FLSA:1737 Issue date:2004-10-13 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1737 CVE Names: CAN-2004-0492 --- --- 1. Topic: Updated httpd packages that fix a security issue in the Apache Web server are now available. The Apache HTTP Server is a powerful, full-featured, efficient, and freely-available Web server. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: A buffer overflow was found in the Apache proxy module, mod_proxy, which can be triggered by receiving an invalid Content-Length header. In order to exploit this issue, an attacker would need an Apache installation that was configured as a proxy to connect to a malicious site. This would cause the Apache child processing the request to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0492 to this issue. All users of the Apache HTTP Server are advised to upgrade to these erratum packages, which contain a backported fix and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #1737 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/apache-1.3.27-5.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/apache-1.3.27-5.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/apache-devel-1.3.27-5.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/apache-manual-1.3.27-5.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --- 2e1f8e6bafbbbe02ac26ccc98b73631e62c889ce 7.3/updates/i386/apache-1.3.27-5.legacy.i386.rpm 27a716974163c739784e09992f1d84a1996041d9 7.3/updates/i386/apache-devel-1.3.27-5.legacy.i386.rpm ab688996e12f0364a50b58c2b120d933b403ce6b 7.3/updates/i386/apache-manual-1.3.27-5.legacy.i386.rpm e2fadeb9a430a5dbda28076cd850180fbb95c2b8 7.3/updates/SRPMS/apache-1.3.27-5.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://www.apacheweek.com/issues/04-06-11#security http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: This is a digitally signed message part
Re: [Full-Disclosure] my first orgasem
I didn't post that message. It must be a virus or something. Marc. On Thu, 2004-10-14 at 07:00, S G Masood wrote: > Do I need to tell you that I didn't post the original > message? Stop spamming the list please. There's no > point in going on. > > -- > Cheers, > S.G.Masood > > > --- Marc Deslauriers <[EMAIL PROTECTED]> > wrote: > > > I\\\'ll come with you *smiles* > > > > we come gay you and me... > > > > ___ > > Full-Disclosure - We believe in it. > > Charter: > > http://lists.netsys.com/full-disclosure-charter.html > > > > > > > ___ > Do you Yahoo!? > Declare Yourself - Register online to vote today! > http://vote.yahoo.com > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html signature.asc Description: This is a digitally signed message part
[Full-Disclosure] [FLSA-2004:1237] Updated gaim package resolves security issues
--- Fedora Legacy Update Advisory Synopsis: Updated gaim package resolves security issues Advisory ID: FLSA:1237 Issue date:2004-10-16 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1237 CVE Names: CAN-2004-0006 CAN-2004-0007 CAN-2004-0008 CAN-2004-0500 CAN-2004-0754 CAN-2004-0784 CAN-2004-0785 --- --- 1. Topic: An updated gaim package that fixes several security issues is now available. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: Issues fixed with this gaim release include: Multiple buffer overflows that affect versions of Gaim 0.75 and earlier. 1) When parsing cookies in a Yahoo web connection, 2) YMSG protocol overflows parsing the Yahoo login webpage, 3) a YMSG packet overflow, 4) flaws in the URL parser, and 5) flaws in HTTP Proxy connect. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0006 to these issues. A buffer overflow in Gaim 0.74 and earlier in the Extract Info Field Function used for MSN and YMSG protocol handlers. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0007 to this issue. An integer overflow in Gaim 0.74 and earlier, when allocating memory for a directIM packet results in heap overflow. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0008 to this issue. Buffer overflow bugs were found in the Gaim MSN protocol handler. In order to exploit these bugs, an attacker would have to perform a man in the middle attack between the MSN server and the vulnerable Gaim client. Such an attack could allow arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0500 to this issue. An integer overflow bug has been found in the Gaim Groupware message receiver. It is possible that if a user connects to a malicious server, an attacker could send carefully crafted data which could lead to arbitrary code execution on the victims machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0754 to this issue. A shell escape bug has been found in the Gaim smiley theme file installation. When a user installs a smiley theme, which is contained within a tar file, the unarchiving of the data is done in an unsafe manner. An attacker could create a malicious smiley theme that would execute arbitrary commands if the theme was installed by the victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0784 to this issue. Buffer overflow bugs have been found in the Gaim URL decoder, local hostname resolver, and the RTF message parser. It is possible that a remote attacker could send carefully crafted data to a vulnerable client and lead to a crash or arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0785 to this issue. Users of Gaim are advised to upgrade to this updated package which contains Gaim version 0.82.1 and is not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #1237 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gaim-0.82.1-0.73.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/gaim-0.82.1-0.73.2.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gaim-0.82.1-0.90.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386
[Full-Disclosure] [FLSA-2004:2072] Updated CUPS packages fix security vulnerability
--- Fedora Legacy Update Advisory Synopsis: Updated CUPS packages fix security vulnerability Advisory ID: FLSA:2072 Issue date:2004-10-16 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2072 CVE Names: CAN-2004-0558 --- --- 1. Topic: Updated cups packages that fix a denial of service vulnerability are now available. The Common UNIX Printing System (CUPS) is a print spooler. 2. Relevant releases/architectures: Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: Alvaro Martinez Echevarria reported a bug in the CUPS Internet Printing Protocol (IPP) implementation in versions of CUPS prior to 1.1.21. An attacker could send a carefully crafted UDP packet to the IPP port which could cause CUPS to stop listening to the port and result in a denial of service. In order to exploit this bug, an attacker would need to have the ability to send a UDP packet to the IPP port (by default 631). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0558 to this issue. All users of cups should upgrade to these updated packages, which contain a backported patch as well as a fix for a non-exploitable off-by-one bug. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 2072 - CAN-2004-0558 - CUPS denial of service 6. RPMs required: Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/cups-1.1.17-13.3.0.6.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/cups-1.1.17-13.3.0.6.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/cups-devel-1.1.17-13.3.0.6.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/cups-libs-1.1.17-13.3.0.6.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/cups-1.1.19-13.2.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/cups-1.1.19-13.2.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/cups-devel-1.1.19-13.2.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/cups-libs-1.1.19-13.2.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --- dc9e67863c6ed358eca94f36f04c2549be49bee7 redhat/9/updates/i386/cups-1.1.17-13.3.0.6.legacy.i386.rpm fc7fd1c2c7ad79e2c419b5440e6b0e0a88b2e276 redhat/9/updates/i386/cups-devel-1.1.17-13.3.0.6.legacy.i386.rpm 39f6b741f82f6e566351d15f7ec384f0cde9a17e redhat/9/updates/i386/cups-libs-1.1.17-13.3.0.6.legacy.i386.rpm ff063b1392b2841153d5dc234c5f3ed6d54d63e4 redhat/9/updates/SRPMS/cups-1.1.17-13.3.0.6.legacy.src.rpm e7684dfcd7142714848be20e318e5c58aed2b481 fedora/1/updates/i386/cups-1.1.19-13.2.legacy.i386.rpm 8dbb4ea34d20de5b70e1672e60794fcfe5021f4b fedora/1/updates/i386/cups-devel-1.1.19-13.2.legacy.i386.rpm 369439d5c253a361ffd64f892efc448c62d54e94 fedora/1/updates/i386/cups-libs-1.1.19-13.2.legacy.i386.rpm 8b69b1f1c661a5c75dfadcfb85a19fd712e5f904 fedora/1/updates/SRPMS/cups-1.1.19-13.2.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0558 http://www.cups.org/str.php?L863 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at
[Full-Disclosure] [FLSA-2004:2003] Updated rsync package fixes security issues
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - --- Fedora Legacy Update Advisory Synopsis: Updated rsync package fixes security issues Advisory ID: FLSA:2003 Issue date:2004-09-30 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2003 CVE Names: CAN-2004-0426 CAN-2004-0792 - - --- - - --- 1. Topic: An updated rsync package that fixes several security issues is now available. The rsync program synchronizes files over a network. 2. Relevent releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: Rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot. This could allow a remote attacker to write files outside of the module's "path", depending on the privileges assigned to the rsync daemon. Users not running an rsync daemon, running a read-only daemon, or running a chrooted daemon are not affected by this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0426 to this issue. Versions of rsync up to and including version 2.6.2 contain a path sanitization issue. This issue could allow an attacker to read or write files outside of the rsync directory. This vulnerability is only exploitable when an rsync server is enabled and is not running within a chroot. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0792 to this issue. Users of rsync are advised to upgrade to this updated package, which contains backported patches and is not affected by these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #1569 http://bugzilla.fedora.us - bug #2003 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/rsync-2.5.7-2.legacy.7x.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/rsync-2.5.7-2.legacy.7x.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/rsync-2.5.7-2.legacy.9.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/rsync-2.5.7-2.legacy.9.i386.rpm 7. Verification: SHA1 sum Package Name - - --- 1101ad1c735a11c9be6f4d45971374a6195431d9 7.3/updates/i386/rsync-2.5.7-2.legacy.7x.i386.rpm 4bb344d823f423cf5c1cc64d949dd1d9408960e7 7.3/updates/SRPMS/rsync-2.5.7-2.legacy.7x.src.rpm 49a3fa2fe967ed5c62994d5785463357aaf49de5 9/updates/i386/rsync-2.5.7-2.legacy.9.i386.rpm 84ec22198c189660f3cf2b967b710de9a04d6b22 9/updates/SRPMS/rsync-2.5.7-2.legacy.9.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://rsync.samba.org/#security_apr04 http://rsync.samba.org/#security_aug04 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0426 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0792 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - - - -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFBW90yLMAs/0C4zNoRAigPAKCyd2qrr/E5euEo4cZ509eGSQ3U3ACfYvP1 1NWrfCntZHfnvKlJ4Uvm98U= =gYDA -END PGP SIGNATURE- ___ Full-Di
[Full-Disclosure] [FLSA-2004:1840] Updated Ethereal packages fix security issues
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - --- Fedora Legacy Update Advisory Synopsis: Updated Ethereal packages fix security issues Advisory ID: FLSA:1840 Issue date:2004-09-30 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1840 CVE Names: CAN-2004-0176 CAN-2004-0365 CAN-2004-0367 CAN-2004-0504 CAN-2004-0505 CAN-2004-0506 CAN-2004-0507 CAN-2004-0633 CAN-2004-0634 CAN-2004-0635 - - --- - - --- 1. Topic: Updated Ethereal packages that fix various security vulnerabilities are now available. Ethereal is a program for monitoring network traffic. 2. Relevent releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: Issues fixed with this Ethereal release include: Stefan Esser reported that Ethereal versions 0.10.1 and earlier contain stack overflows in the IGRP, PGM, Metflow, ISUP, TCAP, or IGAP dissectors. On a system where Ethereal is being run a remote attacker could send malicious packets that could cause Ethereal to crash or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0176 to this issue. Jonathan Heussser discovered that a carefully-crafted RADIUS packet could cause a crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0365 to this issue. Ethereal 0.8.13 to 0.10.2 allows remote attackers to cause a denial of service (crash) via a zero-length Presentation protocol selector. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0367 to this issue. The MMSE dissector in Ethereal releases 0.10.1 through 0.10.3 contained a buffer overflow flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0507 to this issue. In addition, other flaws in Ethereal prior to 0.10.4 were found that could cause it to crash in response to carefully crafted SIP (CAN-2004-0504), AIM (CAN-2004-0505), or SPNEGO (CAN-2004-0506) packets. The SNMP dissector in Ethereal releases 0.8.15 through 0.10.4 contained a memory read flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0635 to this issue. The SMB dissector in Ethereal releases 0.9.15 through 0.10.4 contained a null pointer flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0634 to this issue. The iSNS dissector in Ethereal releases 0.10.3 through 0.10.4 contained an integer overflow flaw. On a system where Ethereal is running, a remote attacker could send malicious packets that could cause Ethereal to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0633 to this issue. Users of Ethereal should upgrade to these updated packages, which contain backported security patches that correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #1419 http://bugzilla.fedora.us - bug #1840 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/ethereal-0.10.3-0.73.3.legacy.src.r
[Full-Disclosure] [FLSA-2004:1372] Updated sysstat packages fix security vulnerabilities
Fedora Legacy Update Advisory Synopsis: Updated sysstat packages fix security vulnerabilities Advisory ID: FLSA:1372 Issue date:2004-10-03 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1372 CVE Names: CAN-2004-0107 1. Topic: Updated sysstat packages that fix various bugs and a minor security issue are now available. Sysstat is a tool for gathering system statistics. 2. Relevent releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: A bug was found in the Red Hat sysstat package post and trigger scripts, which used insecure temporary file names. A local attacker could overwrite system files using carefully-crafted symbolic links in the /tmp directory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0107 to this issue. Other issues addressed in this advisory include: * iostat -x should return all partitions on the system (up to a maximum of 1024) * sar should handle network device names with more than 8 characters properly Users of sysstat should upgrade to these updated packages, which contain patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #1372 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/sysstat-4.0.3-4.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/sysstat-4.0.3-4.legacy.i386.rpm 7. Verification: SHA1 sum Package Name b2d1ced29b39cd024169b173d01db6fa99327bfb 7.3/updates/i386/sysstat-4.0.3-4.legacy.i386.rpm 5bd937c2c0d643ba5a4dcab9c1f5ded2d67c9fb5 7.3/updates/SRPMS/sysstat-4.0.3-4.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0107 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org -- signature.asc Description: This is a digitally signed message part
[Full-Disclosure] [FLSA-2004:1324] Updated libxml2 resolves security vulnerability
--- Fedora Legacy Update Advisory Synopsis: Updated libxml2 resolves security vulnerability Advisory ID: FLSA:1324 Issue date:2004-10-04 Product: Red Hat Linux Keywords: Security Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1324 CVE Names: CAN-2004-0110 --- --- 1. Topic: [Updated 4th October 2004] The packages contained in the original release of this advisory were missing python 2.2 support. These updated packages restore the missing functionality. Updated libxml2 packages that fix an overflow when parsing remote resources are now available. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: libxml2 is a library for manipulating XML files. Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0110 to this issue. All users are advised to upgrade to these updated packages, which contain a backported fix and are not vulnerable to this issue. Fedora Legacy would like to thank Johnny Strom for reporting this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 1324 - libxml2: an overflow when parsing remote resources. 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/libxml2-2.4.19-6.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-2.4.19-6.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-python-2.4.19-6.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/libxml2-devel-2.4.19-6.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --- 41e9e0daaf643f9d3ec96cbba7b050a397d1907e 7.3/updates/i386/libxml2-2.4.19-6.legacy.i386.rpm 130e6e03b76891959e58a3ddd56bc99777d76981 7.3/updates/i386/libxml2-devel-2.4.19-6.legacy.i386.rpm 42087ae0d2e5ee16c4ecf32478991d96ce0500cb 7.3/updates/i386/libxml2-python-2.4.19-6.legacy.i386.rpm 8a1d844bfb9494c00bd4a6dd2d95a0829daf9f42 7.3/updates/SRPMS/libxml2-2.4.19-6.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0110 https://www.redhat.com/archives/redhat-watch-list/2004-February/msg7.html http://mail.gnome.org/archives/xml/2004-February/msg00070.html 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: This is a digitally signed message part
[Full-Disclosure] [FLSA-2004:1868] Updated php packages fix security issues
--- Fedora Legacy Update Advisory Synopsis: Updated php packages fix security issues Advisory ID: FLSA:1868 Issue date:2004-10-07 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1868 CVE Names: CAN-2004-0594 CAN-2004-0595 --- --- 1. Topic: Updated php packages that fix various security issues are now available. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP server. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: Stefan Esser discovered a flaw when memory_limit is enabled in versions of PHP 4 before 4.3.8. If a remote attacker could force the PHP interpreter to allocate more memory than the memory_limit setting before script execution begins, then the attacker may be able to supply the contents of a PHP hash table remotely. This hash table could then be used to execute arbitrary code as the 'apache' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0594 to this issue. This issue has a higher risk when PHP is running on an instance of Apache which is vulnerable to CAN-2004-0493. It may also be possible to exploit this issue if using a non-default PHP configuration with the "register_defaults" setting is changed to "On". Stefan Esser discovered a flaw in the strip_tags function in versions of PHP before 4.3.8. The strip_tags function is commonly used by PHP scripts to prevent Cross-Site-Scripting attacks by removing HTML tags from user-supplied form data. By embedding NUL bytes into form data, HTML tags can in some cases be passed intact through the strip_tags function, which may allow a Cross-Site-Scripting attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0595 to this issue. All users of PHP are advised to upgrade to these updated packages, which contain backported patches that address these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 1868 - CAN-2004-0594, 0595 - PHP multiple vulnerabilities 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/php-4.1.2-7.3.10.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-4.1.2-7.3.10.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-devel-4.1.2-7.3.10.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-imap-4.1.2-7.3.10.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-ldap-4.1.2-7.3.10.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-manual-4.1.2-7.3.10.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-mysql-4.1.2-7.3.10.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-odbc-4.1.2-7.3.10.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-pgsql-4.1.2-7.3.10.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/php-snmp-4.1.2-7.3.10.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/php-4.2.2-17.7.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/php-4.2.2-17.7.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/php-devel-4.2.2-17.7.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/php-imap-4.2.2-17.7.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/php-ldap-4.2.2-17.7.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/php-manual-4.2.2-17.7.legacy.i386.rpm http://download.fedoralegacy.org/redhat/
[Full-Disclosure] [FLSA-2004:2068] Updated httpd packages fix security issues
--- Fedora Legacy Update Advisory Synopsis: Updated httpd packages fix security issues Advisory ID: FLSA:2068 Issue date:2004-10-09 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2068 CVE Names: CAN-2004-0488 CAN-2004-0493 CAN-2004-0747 CVE Names: CAN-2004-0748 CAN-2004-0751 CAN-2004-0786 CVE Names: CAN-2004-0809 CAN-2004-0811 --- --- 1. Topic: Updated httpd packages that include fixes for security issues are now available. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. 2. Relevant releases/architectures: Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: Problems that apply to Red Hat Linux 9 only: A stack buffer overflow was discovered in mod_ssl that could be triggered if using the FakeBasicAuth option. If mod_ssl was sent a client certificate with a subject DN field longer than 6000 characters, a stack overflow occured if FakeBasicAuth had been enabled. In order to exploit this issue the carefully crafted malicious certificate would have had to be signed by a Certificate Authority which mod_ssl is configured to trust. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0488 to this issue. A remotely triggered memory leak in the Apache HTTP Server earlier than version 2.0.50 was also discovered. This allowed a remote attacker to perform a denial of service attack against the server by forcing it to consume large amounts of memory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0493 to this issue. Problems that apply to Fedora Core 1 only: An input filter bug in mod_ssl was discovered in Apache httpd version 2.0.50 and earlier. A remote attacker could force an SSL connection to be aborted in a particular state and cause an Apache child process to enter an infinite loop, consuming CPU resources. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0748 to this issue. Testing using the Codenomicon HTTP Test Tool performed by the Apache Software Foundation security group and Red Hat uncovered an input validation issue in the IPv6 URI parsing routines in the apr-util library. If a remote attacker sent a request including a carefully crafted URI, an httpd child process could be made to crash. This issue is not believed to allow arbitrary code execution on this version of Linux. This issue also does not represent a significant denial of service attack as requests will continue to be handled by other Apache child processes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0786 to this issue. Note that these packages do also contain the fix for a regression in Satisfy handling in the 2.0.51 release (CAN-2004-0811). Problems that apply to both Red Hat Linux 9 and Fedora Core 1: The Swedish IT Incident Centre (SITIC) reported a buffer overflow in the expansion of environment variables during configuration file parsing. This issue could allow a local user to gain 'apache' privileges if an httpd process can be forced to parse a carefully crafted .htaccess file written by a local user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0747 to this issue. An issue was discovered in the mod_ssl module which could be triggered if the server is configured to allow proxying to a remote SSL server. A malicious remote SSL server could force an httpd child process to crash by sending a carefully crafted response header. This issue is not believed to allow execution of arbitrary code. This issue also does not represent a significant Denial of Service attack as requests will continue to be handled by other Apache child processes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0751 to this issue. An issue was discovered in the mod_dav module which could be triggered for a location where WebDAV authoring access has been configured. A malicious remote client which is authorized to use the LOCK method could force an httpd child process to crash by sending a particular sequence of LOCK requests. This issue does not allow execution of arbitrary code. This issue also does not represent a significant Denial of Service attack as requests will continue to be handled by other Apache child processes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0809 to this issue. Users of the Apache HTTP server should upgrade to these updated packages, which contain patches that address these issues.
[Full-Disclosure] [FLSA-2004:1719] Updated Tripwire packages fix security flaw
--- Fedora Legacy Update Advisory Synopsis: Updated Tripwire packages fix security flaw Advisory ID: FLSA:1719 Issue date:2004-10-23 Product: Red Hat Linux Keywords: Security Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1719 CVE Names: CAN-2004-0536 --- --- 1. Topic: Updated Tripwire packages that fix a format string security vulnerability are now available. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: Tripwire is a system integrity assessment tool. Paul Herman discovered a format string vulnerability in Tripwire version 2.3.1 and earlier. If Tripwire is configured to send reports via email, a local user could gain privileges by creating a carefully crafted file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0536 to this issue. Users of Tripwire are advised to upgrade to this erratum package which contains a backported security patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 1719 - Format String Vulnerability in Tripwire 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/tripwire-2.3.1-10.1.legacy.7x.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/tripwire-2.3.1-10.1.legacy.7x.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/tripwire-2.3.1-17.2.legacy.9.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/tripwire-2.3.1-17.2.legacy.9.i386.rpm 7. Verification: SHA1 sum Package Name 1b2a8875e86492065f53db69d04de4a452fb1c5f 7.3/updates/i386/tripwire-2.3.1-10.1.legacy.7x.i386.rpm 3d1d0f2a2b4b27c1e5d3b05dbea78d95c70ddcc2 7.3/updates/SRPMS/tripwire-2.3.1-10.1.legacy.7x.src.rpm cdc032af7c3fa3cfbe153c85a0044bdbbb6326b5 9/updates/i386/tripwire-2.3.1-17.2.legacy.9.i386.rpm 263704b1799204e8ee98b4329cddf7b492d8fff2 9/updates/SRPMS/tripwire-2.3.1-17.2.legacy.9.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://marc.theaimsgroup.com/?l=bugtraq&m=108668791510153 http://lw.ftw.zamosc.pl/lha-exploit.txt 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: This is a digitally signed message part
[Full-Disclosure] [FLSA-2004:1947] Updated glibc packages fix flaws
--- Fedora Legacy Update Advisory Synopsis: Updated glibc packages fix flaws Advisory ID: FLSA:1947 Issue date:2004-10-23 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1947 CVE Names: CAN-2002-0029 --- --- 1. Topic: Updated glibc packages that fix a security flaw in the resolver as well as dlclose handling are now available. The GNU libc packages (known as glibc) contain the standard C libraries used by applications. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: A security audit of glibc revealed a flaw in the resolver library which was originally reported as affecting versions of ISC BIND 4.9. This flaw also applied to glibc versions before 2.3.2. An attacker who is able to send DNS responses (perhaps by creating a malicious DNS server) could remotely exploit this vulnerability to execute arbitrary code or cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0029 to this issue. All users of glibc should upgrade to these updated packages, which resolve these issues. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #1947 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/glibc-2.2.5-44.legacy.3.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-2.2.5-44.legacy.3.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-2.2.5-44.legacy.3.i686.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-common-2.2.5-44.legacy.3.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-debug-2.2.5-44.legacy.3.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-debug-2.2.5-44.legacy.3.i686.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-debug-static-2.2.5-44.legacy.3.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-devel-2.2.5-44.legacy.3.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-profile-2.2.5-44.legacy.3.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/glibc-utils-2.2.5-44.legacy.3.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/nscd-2.2.5-44.legacy.3.i386.rpm 7. Verification: SHA1 sum Package Name --- 787b02c547d9578eab2112b681d58ce40589dd37 7.3/updates/i386/glibc-2.2.5-44.legacy.3.i386.rpm d73f3bf9fd6c094dbf3d7c0409c0d34de40a1cfd 7.3/updates/i386/glibc-2.2.5-44.legacy.3.i686.rpm df3fdb0f5d327b10bb285b06a5f1422642b980b7 7.3/updates/i386/glibc-common-2.2.5-44.legacy.3.i386.rpm 61e6c8521d67f38e96c679b3d263f6dccfb43b75 7.3/updates/i386/glibc-debug-2.2.5-44.legacy.3.i386.rpm d5b070b85a0a57702f3259790e59707dd8d67ef1 7.3/updates/i386/glibc-debug-2.2.5-44.legacy.3.i686.rpm e8988fb212ad671469f190f01b35c7664298ea58 7.3/updates/i386/glibc-debug-static-2.2.5-44.legacy.3.i386.rpm f2043d369aeb8a8a39b0f1e429fdbcf08dcefd5b 7.3/updates/i386/glibc-devel-2.2.5-44.legacy.3.i386.rpm 5902d254f9926b0c532e8af5e0fe3ed22e105215 7.3/updates/i386/glibc-profile-2.2.5-44.legacy.3.i386.rpm 6c8b2d53b0626265c180ba09a1a6161e4be6765d 7.3/updates/i386/glibc-utils-2.2.5-44.legacy.3.i386.rpm 26282373e4cd3770b40b3cf10dc17b7f6f23ce6a 7.3/updates/i386/nscd-2.2.5-44.legacy.3.i386.rpm b8f02cd099305c9866715493147ca9c9dcecfff0 7.3/updates/SRPMS/glibc-2.2.5-44.legacy.3.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine o
[Full-Disclosure] [FLSA-2004:2076] Updated foomatic package fixes security vulnerability
--- Fedora Legacy Update Advisory Synopsis: Updated foomatic package fixes security vulnerability Advisory ID: FLSA:2076 Issue date:2004-11-05 Product: Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2076 CVE Names: CAN-2004-0801 --- --- 1. Topic: Updated foomatic packages that fix an arbitrary command execution vulnerability are now available. Foomatic is a comprehensive, spooler-independent database of printers, printer drivers, and driver descriptions. 2. Relevent releases/architectures: Fedora Core 1 - i386 3. Problem description: Sebastian Krahmer reported a bug in the cupsomatic and foomatic-rip print filters, used by the CUPS print spooler. An attacker who has printing access could send a carefully named file to the print server causing arbitrary commands to be executed as root. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0801 to this issue. All users are advised to upgrade to these updated packages, which contain a backported fix and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 2076 - CAN-2004-0801 - cupsomatic, foomatic arbitrary command execution 6. RPMs required: Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/foomatic-3.0.0-21.5.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/foomatic-3.0.0-21.5.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --- 8a425a8debf0be9be2dbbc0f028ed1eb8350e833 fedora/1/updates/i386/foomatic-3.0.0-21.5.legacy.i386.rpm a684fc034e1cde9ee35185f5db9e3da4446104b3 fedora/1/updates/SRPMS/foomatic-3.0.0-21.5.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0801 http://secunia.com/advisories/12557/ 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: This is a digitally signed message part
[Full-Disclosure] [FLSA-2004:2148] Updated httpd, apache and mod_ssl packages fix security issues
--- Fedora Legacy Update Advisory Synopsis: Updated httpd, apache and mod_ssl packages fix security issues Advisory ID: FLSA:2148 Issue date:2004-12-03 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2148 CVE Names: CAN-2004-0885 CAN-2004-0940 CAN-2004-0942 --- --- 1. Topic: Updated httpd packages that include fixes for security issues are now available. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: An issue has been discovered in the mod_ssl module when configured to use the "SSLCipherSuite" directive in directory or location context. If a particular location context has been configured to require a specific set of cipher suites, then a client will be able to access that location using any cipher suite allowed by the virtual host configuration. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0885 to this issue. Problems that apply to Red Hat Linux 7.3 only: A buffer overflow in mod_include could allow a local user who is authorised to create server side include (SSI) files to gain the privileges of a httpd child. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0940 to this issue. Problems that apply to Red Hat Linux 9 and Fedora Core 1 only: An issue has been discovered in the handling of white space in request header lines using MIME folding. A malicious client could send a carefully crafted request, forcing the server to consume large amounts of memory, leading to a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0942 to this issue. Users of the Apache HTTP server should upgrade to these updated packages, which contain patches that address these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 2148 - Apache httpd Vulnerabilities 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/apache-1.3.27-6.legacy.src.rpm http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mod_ssl-2.8.12-7.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/apache-1.3.27-6.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/apache-devel-1.3.27-6.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/apache-manual-1.3.27-6.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/mod_ssl-2.8.12-7.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/httpd-2.0.40-21.17.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-2.0.40-21.17.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-devel-2.0.40-21.17.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-manual-2.0.40-21.17.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/mod_ssl-2.0.40-21.17.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/httpd-2.0.51-1.6.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/httpd-2.0.51-1.6.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/httpd-devel-2.0.51-1.6.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/httpd-manual-2.0.51-1.6.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/mod_ssl-2.0.51-1.6.legacy.i386.rpm 7. Verification: SHA1 sum
[Full-Disclosure] [FLSA-2005:2255] Updated zip package fixes security issue
- Fedora Legacy Update Advisory Synopsis: Updated zip package fixes security issue Advisory ID: FLSA:2255 Issue date:2005-02-01 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2255 CVE Names: CAN-2004-1010 - - 1. Topic: An updated zip package that fixes a buffer overflow vulnerability is now available. The zip program is an archiving utility which can create ZIP-compatible archives. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: A buffer overflow bug has been discovered in zip when handling long file names. An attacker could create a specially crafted path which could cause zip to crash or execute arbitrary instructions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1010 to this issue. Users of zip should upgrade to this updated package, which contains backported patches and is not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2255 - zip long path buffer overflow 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/zip-2.3-26.1.0.7.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/zip-2.3-26.1.0.7.3.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/zip-2.3-26.1.0.9.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/zip-2.3-26.1.0.9.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/zip-2.3-26.1.1.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/zip-2.3-26.1.1.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 7b1134632529e30a471d2ae038f414f407ac0d3e redhat/7.3/updates/i386/zip-2.3-26.1.0.7.3.legacy.i386.rpm 8db58039a432c0f0c9ff01e07b9190ad23ac4413 redhat/7.3/updates/SRPMS/zip-2.3-26.1.0.7.3.legacy.src.rpm 95966b2b9fdac8f17c74226c3c033b24dd6c9226 redhat/9/updates/i386/zip-2.3-26.1.0.9.legacy.i386.rpm 92b76aadb2e46b57dd9b71927dada7b1c1154dae redhat/9/updates/SRPMS/zip-2.3-26.1.0.9.legacy.src.rpm 9ef4498e118ca6b4a8f72b02fecde57924d51267 fedora/1/updates/i386/zip-2.3-26.1.1.legacy.i386.rpm 2dcdfc8e6ac63e2b74cf7c781c078773e0265eb8 fedora/1/updates/SRPMS/zip-2.3-26.1.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1010 http://lists.netsys.com/pipermail/full-disclosure/2004-November/028379.html 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: OpenPGP digital signature ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2005:2187] Updated freeradius packages fix security flaws
--- Fedora Legacy Update Advisory Synopsis: Updated freeradius packages fix security flaws Advisory ID: FLSA:2187 Issue date:2005-02-01 Product: Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2187 CVE Names: CAN-2004-0938 CAN-2004-0960 CAN-2004-0961 --- --- 1. Topic: Updated freeradius packages that fix a number of denial of service vulnerabilities as well as minor bugs are now available. FreeRADIUS is a high-performance and highly configurable free RADIUS server designed to allow centralized authentication and authorization for a network. 2. Relevant releases/architectures: Fedora Core 1 - i386 3. Problem description: A number of flaws were found in FreeRADIUS versions prior to 1.0.1. An attacker who is able to send packets to the server could construct carefully constructed packets in such a way as to cause the server to consume memory or crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0938, CAN-2004-0960, and CAN-2004-0961 to these issues. Please note that the pam config file included in these packages was renamed to /etc/pam.d/radiusd. Users of FreeRADIUS should update to these erratum packages that contain FreeRADIUS 1.0.1, which is not vulnerable to these issues and also corrects a number of bugs. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 2187 - Freeradius < 1.0.1 DoS and remote crash 6. RPMs required: Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/freeradius-1.0.1-0.FC1.5.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/freeradius-1.0.1-0.FC1.5.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/freeradius-mysql-1.0.1-0.FC1.5.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/freeradius-postgresql-1.0.1-0.FC1.5.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/freeradius-unixODBC-1.0.1-0.FC1.5.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --- 83a5b013fac1aaa3caee75ea97dadb9ead68ca6c fedora/1/updates/i386/freeradius-1.0.1-0.FC1.5.legacy.i386.rpm 6b9dfc73490b32784112f0f6f0cde1d87f1812f7 fedora/1/updates/i386/freeradius-mysql-1.0.1-0.FC1.5.legacy.i386.rpm 58b1e0975443a435c982b394f775337a8eedde9a fedora/1/updates/i386/freeradius-postgresql-1.0.1-0.FC1.5.legacy.i386.rpm 94b816b7da430f359401dade849820c962b5ad98 fedora/1/updates/i386/freeradius-unixODBC-1.0.1-0.FC1.5.legacy.i386.rpm c26c9fe20f721946bbcf7723b654ce72d1fd587f fedora/1/updates/SRPMS/freeradius-1.0.1-0.FC1.5.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0938 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0960 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0961 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: OpenPGP digital signature ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2005:2272] Updated unarj package fixes security issue
- Fedora Legacy Update Advisory Synopsis: Updated unarj package fixes security issue Advisory ID: FLSA:2272 Issue date:2005-02-01 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2272 CVE Names: CAN-2004-0947 CAN-2004-1027 - - 1. Topic: An updated unarj package that fixes a buffer overflow vulnerability and a directory traversal vulnerability is now available. The unarj program is an archiving utility which can extract ARJ-compatible archives. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: A buffer overflow bug was discovered in unarj when handling long file names contained in an archive. An attacker could create a specially crafted archive which could cause unarj to crash or possibly execute arbitrary code when extracted by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0947 to this issue. Additionally, a path traversal vulnerability was discovered in unarj. An attacker could create a specially crafted archive which would create files in the parent ("..") directory when extracted by a victim. When used recursively, this vulnerability could be used to overwrite critical system files and programs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1027 to this issue. Users of unarj should upgrade to this updated package which contains backported patches and is not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2272 - unarj - buffer overflow and path traversal bugs 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/unarj-2.63a-4.0.7.3.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/unarj-2.63a-4.0.7.3.1.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/unarj-2.63a-4.0.9.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/unarj-2.63a-4.0.9.1.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/unarj-2.63a-4.1.1.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/unarj-2.63a-4.1.1.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 8b07f5d8a514324da4097fa5e5fe45ab693fba54 redhat/7.3/updates/i386/unarj-2.63a-4.0.7.3.1.legacy.i386.rpm 07a12c321015017d0813cb107758df017119d9ac redhat/7.3/updates/SRPMS/unarj-2.63a-4.0.7.3.1.legacy.src.rpm a6151b99a058e254d76de4fe73b769fe0978f851 redhat/9/updates/i386/unarj-2.63a-4.0.9.1.legacy.i386.rpm b88dc2c7dad960fdf9fe5392ef4715deca699287 redhat/9/updates/SRPMS/unarj-2.63a-4.0.9.1.legacy.src.rpm ea630f037afc90ab60cc85e230b64e54141535c9 fedora/1/updates/i386/unarj-2.63a-4.1.1.legacy.i386.rpm d44d03bc24fc9459bd0bd4ed42d7802ca53d74c3 fedora/1/updates/SRPMS/unarj-2.63a-4.1.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0947 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1027 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org ---
[Full-Disclosure] [FLSA-2005:2353] Updated gpdf package fixes security issues
- Fedora Legacy Update Advisory Synopsis: Updated gpdf package fixes security issues Advisory ID: FLSA:2353 Issue date:2005-02-10 Product: Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2353 CVE Names: CAN-2004-0888 CAN-2004-1125 CAN-2005-0064 - - 1. Topic: An updated gpdf package that fixes a number of integer overflow security flaws is now available. GPdf is a viewer for Portable Document Format (PDF) files for GNOME. 2. Relevant releases/architectures: Fedora Core 1 - i386 3. Problem description: During a source code audit, Chris Evans and others discovered a number of integer overflow bugs that affected all versions of xpdf. These issues also affect gpdf as it is based on xpdf source code. An attacker could construct a carefully crafted PDF file that could cause gpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0888 to this issue. A buffer overflow flaw was found in the Gfx::doImage function of Xpdf. This flaw also affects gpdf as it is based on xpdf source code. An attacker could construct a carefully crafted PDF file that could cause gpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to this issue. A buffer overflow flaw was found when processing the /Encrypt /Length tag. An attacker could construct a carefully crafted PDF file that could cause gpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. Users of gpdf are advised to upgrade to this errata package, which contains backported patches correcting these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2353 - xpdf buffer overflows apply to gpdf 6. RPMs required: Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/gpdf-0.110-1.4.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/gpdf-0.110-1.4.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 63438a137ac33d1355bc6b8065fef0a03dde7e68 fedora/1/updates/i386/gpdf-0.110-1.4.legacy.i386.rpm 19c4e9fd40a135b4ad782c228990edcdc38dad04 fedora/1/updates/SRPMS/gpdf-0.110-1.4.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064 http://www.idefense.com/application/poi/display?id=186&type=vulnerabilities 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: OpenPGP digital signature ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2005:2352] Updated Xpdf package fixes security issues
- Fedora Legacy Update Advisory Synopsis: Updated Xpdf package fixes security issues Advisory ID: FLSA:2352 Issue date:2005-02-10 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2352 CVE Names: CAN-2004-0888 CAN-2004-1125 CAN-2005-0064 - - 1. Topic: Updated Xpdf packages that fix several security issues are now available. Xpdf is an X Window System based viewer for Portable Document Format (PDF) files. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: During a source code audit, Chris Evans and others discovered a number of integer overflow bugs that affected all versions of xpdf. An attacker could construct a carefully crafted PDF file that could cause xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0888 to this issue. A buffer overflow flaw was found in the Gfx::doImage function of Xpdf. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to this issue. A buffer overflow flaw was found when processing the /Encrypt /Length tag. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. Users of xpdf are advised to upgrade to these errata packages, which contain backported patches correcting these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2352 - xpdf 3.00 Buffer overflow 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/xpdf-1.00-7.4.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-1.00-7.4.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-chinese-simplified-1.00-7.4.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-chinese-traditional-1.00-7.4.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-japanese-1.00-7.4.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-korean-1.00-7.4.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/xpdf-2.01-11.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-2.01-11.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-chinese-simplified-2.01-11.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-chinese-traditional-2.01-11.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-japanese-2.01-11.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-korean-2.01-11.3.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/xpdf-2.03-1.3.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/xpdf-2.03-1.3.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 423ffbb749b7ee88eeb10e6a859eeb0bf065e14f redhat/7.3/updates/i386/xpdf-1.00-7.4.legacy.i386.rpm c73127114f7369b5b7dc47f888bd751aff93126e redhat/7.3/updates/i386/xpdf-chinese-simplified-1.00-7.4.legacy.i386.rpm fc92215a4b5767adc4fc97dbdab273116ba4d633 redhat/7.3/updates/i386/xpdf-chinese-traditional-1.00-7.4.
[Full-Disclosure] [FLSA-2005:2188] Updated gaim package resolves security issues
- Fedora Legacy Update Advisory Synopsis: Updated gaim package resolves security issues Advisory ID: FLSA:2188 Issue date:2005-02-10 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2188 CVE Names: CAN-2004-0891 - - 1. Topic: An updated gaim package that fixes security issues and various bugs is now avaliable. The gaim application is a multi-protocol instant messaging client. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: A buffer overflow has been discovered in the MSN protocol handler. When receiving unexpected sequence of MSNSLP messages, it is possible that an attacker could cause an internal buffer overflow, leading to a crash or possible code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0891 to this issue. This updated gaim package also fixes multiple user interface, protocol, and error handling problems, including an ICQ communication encoding issue. Users of gaim are advised to upgrade to this updated package which contains gaim version 1.0.2 and is not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2188 - gaim MSN protocol buffer overflow. 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gaim-1.0.2-0.FC0.73.0.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/gaim-1.0.2-0.FC0.73.0.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gaim-1.0.2-0.FC0.90.0.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/gaim-1.0.2-0.FC0.90.0.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gaim-1.0.2-0.FC1.0.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/gaim-1.0.2-0.FC1.0.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - a174d3f8283b608124a7d1061d951d3f44eaf5df redhat/7.3/updates/i386/gaim-1.0.2-0.FC0.73.0.legacy.i386.rpm b16668fdeddf34c3534065ab971b511774c346a8 redhat/7.3/updates/SRPMS/gaim-1.0.2-0.FC0.73.0.legacy.src.rpm 4b1ebfc27b5b05868f5737064f16711d72904565 redhat/9/updates/i386/gaim-1.0.2-0.FC0.90.0.legacy.i386.rpm 23dc361672ef204e40dcdba7f5c3a395200625f4 redhat/9/updates/SRPMS/gaim-1.0.2-0.FC0.90.0.legacy.src.rpm 78e9993c468e49abf30779c99a9436046fcce426 fedora/1/updates/i386/gaim-1.0.2-0.FC1.0.legacy.i386.rpm bed1c8a428c099d51086ddc4acf90571f3a04a98 fedora/1/updates/SRPMS/gaim-1.0.2-0.FC1.0.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0891 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: OpenPGP digital signature ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2005:2252] Updated iptables packages resolve security issues
- Fedora Legacy Update Advisory Synopsis: Updated iptables packages resolve security issues Advisory ID: FLSA:2252 Issue date:2005-02-10 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2252 CVE Names: CAN-2004-0986 - - 1. Topic: Updated iptables packages that correct a security problem are now available. The iptables utility controls the network packet filtering code in the Linux kernel. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: Under certain conditions, iptables did not properly load the required modules at system startup, which caused the firewall rules to fail to load and protect the system from remote attackers. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0986 to this issue. Users of iptables are advised to upgrade to these errata packages, which contain backported patches correcting these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2252 - iptables May Fail to Automatically Load Some Modules 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/iptables-1.2.8-8.73.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/iptables-1.2.8-8.73.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/iptables-ipv6-1.2.8-8.73.1.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/iptables-1.2.8-8.90.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/iptables-1.2.8-8.90.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/iptables-ipv6-1.2.8-8.90.1.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/iptables-1.2.9-1.0.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/iptables-1.2.9-1.0.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/iptables-devel-1.2.9-1.0.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/iptables-ipv6-1.2.9-1.0.1.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 83895bb3697fc2c0a6442a12a481e5670a4c4e36 redhat/7.3/updates/i386/iptables-1.2.8-8.73.1.legacy.i386.rpm a4fbd94e3307c8f6915e9cdf23b98069e7c9e44c redhat/7.3/updates/i386/iptables-ipv6-1.2.8-8.73.1.legacy.i386.rpm d0630819c5a33d60976b5b3c0ed5b7e67bbfc1f6 redhat/7.3/updates/SRPMS/iptables-1.2.8-8.73.1.legacy.src.rpm 1bf551072cb97cb4dfcec90530dbe5f71d3eb4b0 redhat/9/updates/i386/iptables-1.2.8-8.90.1.legacy.i386.rpm e80b93d0c4161576a2707253b25240a2330f7d43 redhat/9/updates/i386/iptables-ipv6-1.2.8-8.90.1.legacy.i386.rpm 5a7849fa4cc500bf6bc0d8320080fb6ba23d9e32 redhat/9/updates/SRPMS/iptables-1.2.8-8.90.1.legacy.src.rpm 87484b5ab4fed7ddaeea720d5303e7f9eca88d16 fedora/1/updates/i386/iptables-1.2.9-1.0.1.legacy.i386.rpm 6aa4eab81a36ddbbd00d4bde0280dd673dfd5324 fedora/1/updates/i386/iptables-devel-1.2.9-1.0.1.legacy.i386.rpm 4d545e88fbec8ff2371a4ed9c5bc494400db6d63 fedora/1/updates/i386/iptables-ipv6-1.2.9-1.0.1.legacy.i386.rpm 7ded8f4994d1a0017d804969318d8d0a6fa5053c fedora/1/updates/SRPMS/iptables-1.2.9-1.0.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the followi
[Full-Disclosure] [FLSA-2005:1944] GNOME VFS updates address extfs vulnerability
--- Fedora Legacy Update Advisory Synopsis: GNOME VFS updates address extfs vulnerability Advisory ID: FLSA:1944 Issue date:2005-02-20 Product: Red Hat Linux Keywords: Security Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1944 CVE Names: CAN-2004-0494 --- --- 1. Topic: Updated GNOME VFS packages that remove potential extfs-related vulnerabilities are now available. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: GNOME VFS is the GNOME virtual file system. It provides a modular architecture and ships with several modules that implement support for file systems, HTTP, FTP, and others. The extfs backends make it possible to implement file systems for GNOME VFS using scripts. Flaws have been found in several of the GNOME VFS extfs backend scripts. Red Hat Linux ships with vulnerable scripts, but they are not used by default. An attacker who is able to influence a user to open a specially-crafted URI using gnome-vfs could perform actions as that user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0494 to this issue. Users of Red Hat Linux should upgrade to these updated packages, which remove these unused scripts. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 1944 - CAN-2004-0494 GNOME VFS extfs vulnerability 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gnome-vfs-1.0.5-4.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/gnome-vfs-1.0.5-4.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/gnome-vfs-devel-1.0.5-4.1.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gnome-vfs-1.0.5-13.1.legacy.src.rpm http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gnome-vfs2-2.2.2-4.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/gnome-vfs-1.0.5-13.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/gnome-vfs2-2.2.2-4.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/gnome-vfs2-devel-2.2.2-4.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/gnome-vfs-devel-1.0.5-13.1.legacy.i386.rpm 7. Verification: SHA1 sum Package Name 1b2e233aa6ae55ae23a6789fb13c5b6448a2a949 7.3/updates/i386/gnome-vfs-1.0.5-4.1.legacy.i386.rpm 7a651d8d5ddfc1838664551c97f0326a385f80d1 7.3/updates/i386/gnome-vfs-devel-1.0.5-4.1.legacy.i386.rpm 95d81f3f9744e57c41b80057fd9c1d210cb3f772 7.3/updates/SRPMS/gnome-vfs-1.0.5-4.1.legacy.src.rpm 0c4d06767ec7ffefbcdb77b66f8845502204d5da 9/updates/i386/gnome-vfs-1.0.5-13.1.legacy.i386.rpm 8f5c82ba289b2e7b51079af4867af66006d4 9/updates/i386/gnome-vfs2-2.2.2-4.1.legacy.i386.rpm 65650947bcc05f583b0833ad429e8204e7533fa2 9/updates/i386/gnome-vfs2-devel-2.2.2-4.1.legacy.i386.rpm e702fbcd55b20e6208fe460eb83035173e25a1c4 9/updates/i386/gnome-vfs-devel-1.0.5-13.1.legacy.i386.rpm 5a6db00010fefa6117f5b417262279c7d2645a6a 9/updates/SRPMS/gnome-vfs-1.0.5-13.1.legacy.src.rpm b48bb8e86f9300f2a0b6da398bf3004cba2c19c3 9/updates/SRPMS/gnome-vfs2-2.2.2-4.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?na
[Full-Disclosure] [FLSA-2005:2058] Updated cdrtools packages fix a security issue
- Fedora Legacy Update Advisory Synopsis: Updated cdrtools packages fix a security issue Advisory ID: FLSA:2058 Issue date:2005-02-20 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2058 CVE Names: CAN-2004-0806 - - 1. Topic: Updated cdrtools packages that fix a privilege escalation vulnerability are now available. Cdrtools is a collection of CD/DVD utilities. 2. Relevant releases/architectures: Red Hat Linux 9 - i386 3. Problem description: Max Vozeler found that the cdrecord program, when is set suid root, fails to drop privileges when it executes a program specified by the user through the $RSH environment variable. This can be abused by a local attacker to obtain root privileges. In the default configuration of Red Hat Linux 9, the cdrecord program is not set suid root and this attack is not possible. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0806 to this issue. Users of cdrtools are advised to upgrade to these errata packages, which contain a backported patch correcting this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2058 - cdrecord suid privilege escalation 6. RPMs required: Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/cdrtools-2.0-11.9.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/cdda2wav-2.0-11.9.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/cdrecord-2.0-11.9.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/cdrecord-devel-2.0-11.9.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/mkisofs-2.0-11.9.3.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 6ec40cf0eb0853bbb2cfe36d17349aaed55e82fa redhat/9/updates/i386/cdda2wav-2.0-11.9.3.legacy.i386.rpm ca6510d1737dcc5d2a7491d4b908999bd4cf9003 redhat/9/updates/i386/cdrecord-2.0-11.9.3.legacy.i386.rpm b524bf67a74450990cb95f249153c6e266acbf03 redhat/9/updates/i386/cdrecord-devel-2.0-11.9.3.legacy.i386.rpm 291b49e8ab22b2d1f27052504b41bd1cd25a7c24 redhat/9/updates/i386/mkisofs-2.0-11.9.3.legacy.i386.rpm b138f4696e00faa674c141b8152337f87d6c01f6 redhat/9/updates/SRPMS/cdrtools-2.0-11.9.3.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0806 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: OpenPGP digital signature ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2005:1945] Updated sox packages fix buffer overflows
- Fedora Legacy Update Advisory Synopsis: Updated sox packages fix buffer overflows Advisory ID: FLSA:1945 Issue date:2005-02-20 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1945 CVE Names: CAN-2004-0557 - - 1. Topic: Updated sox packages that fix buffer overflows in the WAV file handling code are now available. SoX (Sound eXchange) is a sound file format converter. SoX can convert between many different digitized sound formats and perform simple sound manipulation functions, including sound effects. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: Buffer overflows existed in the parsing of WAV file header fields. It was possible that a malicious WAV file could have caused arbitrary code to be executed when the file was played or converted. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0557 to these issues. All users of sox should upgrade to these updated packages, which contain a security patch to resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #1945 - sox buffer overflows 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/sox-12.17.3-4.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/sox-12.17.3-4.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/sox-devel-12.17.3-4.1.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/sox-12.17.3-11.1.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/sox-12.17.3-11.1.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/sox-devel-12.17.3-11.1.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 5e0a7fa217885c997e7172017a61ee70ac2301b6 redhat/7.3/updates/i386/sox-12.17.3-4.1.legacy.i386.rpm 0f383f050988875f273e15d9c0aadd802d88001f redhat/7.3/updates/i386/sox-devel-12.17.3-4.1.legacy.i386.rpm b7735f908b893f2b3cd3d9681bc230af3a1344e7 redhat/7.3/updates/SRPMS/sox-12.17.3-4.1.legacy.src.rpm 42f91c34c3ce2ada6f0119961f92e747d962ab43 redhat/9/updates/i386/sox-12.17.3-11.1.legacy.i386.rpm bcc6f5c29e9df358703ff70233ba90a23e01e8cb redhat/9/updates/i386/sox-devel-12.17.3-11.1.legacy.i386.rpm 45f91336a69fb652fc1d4b0594a53784d3d1eb87 redhat/9/updates/SRPMS/sox-12.17.3-11.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0557 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: OpenPGP digital signature ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2005:2343] Updated vim packages fix security issues
- Fedora Legacy Update Advisory Synopsis: Updated vim packages fix security issues Advisory ID: FLSA:2343 Issue date:2005-02-23 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2343 CVE Names: CAN-2004-1138 CAN-2005-0069 - - 1. Topic: Updated vim packages that fix multiple vulnerabilities are now available. VIM (Vi IMproved) is an updated and improved version of the vi screen- based editor. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: Ciaran McCreesh discovered a modeline vulnerability in VIM. It is possible that a malicious user could create a file containing a specially crafted modeline which could cause arbitrary command execution when viewed by a victim. Please note that this issue only affects users who have modelines and filetype plugins enabled, which is not the default. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-1138 to this issue. The Debian Security Audit Project discovered an insecure temporary file usage in VIM. A local user could overwrite or create files as a different user who happens to run one of the the vulnerable utilities. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0069 to this issue. All users of VIM are advised to upgrade to these erratum packages, which contain backported patches for these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2343 - multiple vim vulns 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/vim-6.1-18.7x.2.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/vim-common-6.1-18.7x.2.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/vim-enhanced-6.1-18.7x.2.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/vim-minimal-6.1-18.7x.2.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/vim-X11-6.1-18.7x.2.3.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/vim-6.1-29.3.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/vim-common-6.1-29.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/vim-enhanced-6.1-29.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/vim-minimal-6.1-29.3.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/vim-X11-6.1-29.3.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/vim-6.2.532-1.3.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/vim-common-6.2.532-1.3.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/vim-enhanced-6.2.532-1.3.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/vim-minimal-6.2.532-1.3.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/vim-X11-6.2.532-1.3.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 06e66495cc5204b04791af26d8f907a04230f23e redhat/7.3/updates/i386/vim-common-6.1-18.7x.2.3.legacy.i386.rpm c04107fabe009eb3de20c6835a5dbdbbe65f0683 redhat/7.3/updates/i386/vim-enhanced-6.1-18.7x.2.3.legacy.i386.rpm 216fa044df92639f713b646af18a60dfc5c64b9e redhat/7.3/updates/i386/vim-minimal-6.1-18.7x.2.3.legacy.i386.rpm 9d392b1080667ab00958382c85aeaaac8dcc998b redhat/7.3/updates/i386/vim-X11-6.1-18.7x.2.3.legacy.i386.rpm 6619cf7606ef880604c02d794f379d5bfad274d0 redhat/7.3/updates/SRPMS/vim-6.1-18.7x.2.3.legacy
[Full-Disclosure] [FLSA-2005:2005] Updated gdk-pixbuf packages fix security flaws
- Fedora Legacy Update Advisory Synopsis: Updated gdk-pixbuf packages fix security flaws Advisory ID: FLSA:2005 Issue date:2005-02-23 Product: Red Hat Linux Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2005 CVE Names: CAN-2004-0111 CAN-2004-0753 CAN-2004-0782 CAN-2004-0783 CAN-2004-0788 - - 1. Topic: Updated gdk-pixbuf packages that fix several security flaws are now available. The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 3. Problem description: Thomas Kristensen discovered a bitmap file that would cause the Evolution mail reader to crash. This issue was caused by a flaw that affects versions of the gdk-pixbuf package prior to 0.20. To exploit this flaw, a remote attacker could send (via email) a carefully-crafted BMP file, which would cause Evolution to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0111 to this issue. During testing of a previously fixed flaw in Qt (CAN-2004-0691), a flaw was discovered in the BMP image processor of gdk-pixbuf. An attacker could create a carefully crafted BMP file which would cause an application to enter an infinite loop and not respond to user input when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0753 to this issue. During a security audit, Chris Evans discovered a stack and a heap overflow in the XPM image decoder. An attacker could create a carefully crafted XPM file which could cause an application linked with gtk2 to crash or possibly execute arbitrary code when the file was opened by a victim. (CAN-2004-0782, CAN-2004-0783) Chris Evans also discovered an integer overflow in the ICO image decoder. An attacker could create a carefully crafted ICO file which could cause an application linked with gtk2 to crash when the file is opened by a victim. (CAN-2004-0788) Users of gdk-pixbuf are advised to upgrade to these packages, which contain backported patches and are not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2005 - gdk-pixbuf bmp image loader DOS 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gdk-pixbuf-0.22.0-7.73.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/gdk-pixbuf-0.22.0-7.73.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/gdk-pixbuf-devel-0.22.0-7.73.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/gdk-pixbuf-gnome-0.22.0-7.73.2.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gdk-pixbuf-0.22.0-7.90.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/gdk-pixbuf-0.22.0-7.90.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/gdk-pixbuf-devel-0.22.0-7.90.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/gdk-pixbuf-gnome-0.22.0-7.90.2.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - a29384912cdf63b635694050c1ecf2f8f56f2e3c redhat/7.3/updates/i386/gdk-pixbuf-0.22.0-7.73.2.legacy.i386.rpm 2e9223509766118f53b1934f77ed9d625558772c redhat/7.3/updates/i386/gdk-pixbuf-devel-0.22.0-7.73.2.legacy.i386.rpm 550e131ff9707a021c1949472ed94c23aec2391c redhat/7.3/updates/i386/gdk-pixbuf-gnome-0.22.0-7.73.2.legacy.i386.rpm ed74d85b0419e4b3eba53a2a65cd87be1b460572 redhat/7.3/updates/SRPMS/gdk-p
[Full-Disclosure] [FLSA-2005:2043] Updated zlib package fixes security issues
- Fedora Legacy Update Advisory Synopsis: Updated zlib package fixes security issues Advisory ID: FLSA:2043 Issue date:2005-02-23 Product: Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2043 CVE Names: CAN-2004-0797 - - 1. Topic: An updated zlib package that fixes a security flaw is now available. Zlib is a general-purpose, patent-free, lossless data compression library which is used by many different programs. 2. Relevant releases/architectures: Fedora Core 1 - i386 3. Problem description: Johan Thelmen reported that a specially crafted file can cause a segmentation fault in zlib as the inflate() and inflateBack() functions do not properly handle errors. An attacker could construct a carefully crafted file that could cause a crash or possibly execute arbitrary code when opened. The specific impact depends on the application using zlib. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0797 to this issue. Users of zlib are advised to upgrade to this errata package, which contains a backported patch correcting this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - bug #2043 - Zlib Compression Library Denial Of Service Vulnerability 6. RPMs required: Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/zlib-1.2.0.7-2.1.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/zlib-1.2.0.7-2.1.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/zlib-devel-1.2.0.7-2.1.legacy.i386.rpm 7. Verification: SHA1 sum Package Name - 815ce5cc7d77184e8075d7b81f16ae94f620ffea fedora/1/updates/i386/zlib-1.2.0.7-2.1.legacy.i386.rpm e7364e589e0a06615c3a02235e54619ca58d0997 fedora/1/updates/i386/zlib-devel-1.2.0.7-2.1.legacy.i386.rpm 4013ab1384694342ed5083f843c2b78d1f4082a7 fedora/1/updates/SRPMS/zlib-1.2.0.7-2.1.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy org/about/security.php You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0797 9. Contact: The Fedora Legacy security contact is <[EMAIL PROTECTED]>. More project details at http://www.fedoralegacy.org - signature.asc Description: OpenPGP digital signature ___ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
[Full-Disclosure] [FLSA-2005:2336] Updated kernel packages fix security issues
- Fedora Legacy Update Advisory Synopsis: Updated kernel packages fix security issues Advisory ID: FLSA:2336 Issue date:2005-02-24 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2336 CVE Names: CAN-2004-0177 CAN-2004-0685 CAN-2004-0814 CAN-2004-0883 CAN-2004-0949 CAN-2004-1016 CAN-2004-1017 CAN-2004-1056 CAN-2004-1068 CAN-2004-1070 CAN-2004-1071 CAN-2004-1072 CAN-2004-1073 CAN-2004-1074 CAN-2004-1137 CAN-2004-1234 CAN-2004-1235 CAN-2005-0001 - - 1. Topic: Updated kernel packages that fix several security issues are now available. The Linux kernel handles the basic functions of the operating system. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: This update includes fixes for several security issues: The ext3 code in kernels before 2.4.26 did not properly initialize journal descriptor blocks. A privileged local user could read portions of kernel memory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0177 to this issue. Conectiva discovered flaws in certain USB drivers affecting kernels prior to 2.4.27 which used the copy_to_user function on uninitialized structures. These flaws could allow local users to read small amounts of kernel memory. (CAN-2004-0685) Multiple race conditions in the terminal layer could allow local users to obtain portions of kernel data via a TIOCSETD ioctl call to a terminal interface that is being accessed by another thread. This could also allow remote attackers to cause a denial of service (panic) by switching from console to PPP line discipline, then quickly sending data that is received during the switch. (CAN-2004-0814) Stefan Esser discovered various flaws including buffer overflows in the smbfs driver affecting kernels prior to 2.4.28. A local user may be able to cause a denial of service (crash) or possibly gain privileges. In order to exploit these flaws the user would require control of a connected Samba server. (CAN-2004-0883, CAN-2004-0949) ISEC security research and Georgi Guninski independantly discovered a flaw in the scm_send function in the auxiliary message layer. A local user could create a carefully crafted auxiliary message which could cause a denial of service (system hang). (CAN-2004-1016) Multiple overflows were discovered and corrected in the io_edgeport driver. (CAN-2004-1017) The Direct Rendering Manager (DRM) driver does not properly check the DMA lock, which could allow remote attackers or local users to cause a denial of service (X Server crash) and possibly modify the video output. (CAN-2004-1056) A missing serialization flaw in unix_dgram_recvmsg was discovered that affects kernels prior to 2.4.28. A local user could potentially make use of a race condition in order to gain privileges. (CAN-2004-1068) Paul Starzetz of iSEC discovered various flaws in the ELF binary loader affecting kernels prior to 2.4.28. A local user could use these flaws to gain read access to executable-only binaries or possibly gain privileges. (CAN-2004-1070, CAN-2004-1071, CAN-2004-1072, CAN-2004-1073, CAN-2004-1074) ISEC security research discovered multiple vulnerabilities in the IGMP functionality of the kernels. These flaws could allow a local user to cause a denial of service (crash) or potentially gain privileges. Where multicast applications are being used on a system, these flaws may also allow remote users to cause a denial of service. (CAN-2004-1137) Kirill Korotaev found a flaw in load_elf_binary affecting kernels prior to 2.4.26. A local user could create a carefully crafted binary in such a way that it would cause a denial of service (system crash). (CAN-2004-1234) iSEC Security Research discovered a VMA handling flaw in the uselib(2) system call of the Linux kernel. A local user could make use of this flaw to gain elevated (root) privileges. (CAN-2004-1235) iSEC Security Research discovered a flaw in the page fault handler code that could lead to local users gaining elevated (root) privileges on multiprocessor machines. (CAN-2005-0001) All users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To install kernel packages manually, use "rpm -ivh " and modify system settings to boot the kernel you have installed. To do this, edit /boot/grub/grub.conf and change the default entry to "default=0" (or,
[Full-Disclosure] [FLSA-2005:2127] Updated CUPS packages fix security vulnerabilities
--- Fedora Legacy Update Advisory Synopsis: Updated CUPS packages fix security vulnerabilities Advisory ID: FLSA:2127 Issue date:2005-03-02 Product: Red Hat Linux, Fedora Core Keywords: Bugfix Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2127 CVE Names: CAN-2004-0888 CAN-2004-0923 CAN-2004-1125 CAN-2004-1267 CAN-2004-1268 CAN-2004-1269 CAN-2004-1270 CAN-2005-0064 --- --- 1. Topic: Updated CUPS packages that fix several security issues are now available. The Common UNIX Printing System provides a portable printing layer for UNIX(R) operating systems. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 3. Problem description: During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect xpdf. CUPS contains a copy of the xpdf code used for parsing PDF files and is therefore affected by these bugs. An attacker who has the ability to send a malicious PDF file to a printer could cause CUPS to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0888 to this issue. When set up to print to a shared printer via Samba, CUPS would authenticate with that shared printer using a username and password. By default, the username and password used to connect to the Samba share is written into the error log file. A local user who is able to read the error log file could collect these usernames and passwords. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0923 to this issue. A buffer overflow was found in the CUPS pdftops filter, which uses code from the Xpdf package. An attacker who has the ability to send a malicious PDF file to a printer could possibly execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to this issue. A buffer overflow was found in the ParseCommand function in the hpgltops program. An attacker who has the ability to send a malicious HPGL file to a printer could possibly execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1267 to this issue. The lppasswd utility ignores write errors when modifying the CUPS passwd file. A local user who is able to fill the associated file system could corrupt the CUPS password file or prevent future uses of lppasswd. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-1268 and CAN-2004-1269 to these issues. The lppasswd utility does not verify that the passwd.new file is different from STDERR, which could allow local users to control output to passwd.new via certain user input that triggers an error message. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1270 to this issue. A buffer overflow flaw was found in the Decrypt::makeFileKey2 function of Xpdf which also affects the CUPS pdftops filter due to a shared codebase. An attacker who has the ability to send a malicious PDF file to a printer could possibly execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. All users of cups should upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: http://bugzilla.fedora.us - 2127 - multiple cups vulns 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/cups-1.1.14-15.4.4.legacy.src.rpm i386: http://download.fedoraleg