Linux Advisory Watch – November 12, 2004

Chris Evans discovered several integer overflows vulnerabilities in the xpdf code which can be exploited remotely by a specially crafted PDF document and may lead to the execution of arbitrary code.

http://www.linuxsecurity.com/advisories/conectiva_advisory-5098.html

This announcement fixes several integer overflow vulnerabilities that were encountered in libtiff.

http://www.linuxsecurity.com/advisories/conectiva_advisory-5099.html

A vulnerability[2] has been discovered in the Cyrus implementation of the SASL library. The library honors the environment variable SASL_PATH blindly, which allows a local attacker to link against a malicious library to run arbitrary code with the privileges of a setuid or setgid application.

http://www.linuxsecurity.com/advisories/conectiva_advisory-5150.html

A vulnerability has been discovered in the shadow suite which provides programs like chfn and chsh. It is possible for a user, who is logged in but has an expired password to alter his account information with chfn or chsh without having to change the password. The problem was originally thought to be more severe.

http://www.linuxsecurity.com/advisories/debian_advisory-5086.html

The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles.

http://www.linuxsecurity.com/advisories/debian_advisory-5088.html

Luigi Auriemma discovered a buffer overflow condition in the playlist module of freeamp which could lead to arbitrary code execution. Recent versions of freeamp were renamed into zinf.

http://www.linuxsecurity.com/advisories/debian_advisory-5089.html

Trustix developers discovered insecure temporary file creation in supplemental scripts in the gzip package which may allow local users to overwrite files via a symlink attack.

http://www.linuxsecurity.com/advisories/debian_advisory-5101.html

“infamous41md” discovered several integer overflows in the PNG image decoding routines of the GD graphics library. This could lead to the execution of arbitrary code on the victim’s machine.

http://www.linuxsecurity.com/advisories/debian_advisory-5133.html

Khan Shirani discovered a format string vulnerability in gnats, the GNU problem report management system. This problem may be exploited to execute arbitrary code.

http://www.linuxsecurity.com/advisories/debian_advisory-5134.html

“infamous41md” discovered several integer overflows in the PNG image decoding routines of the GD graphics library. This could lead to the execution of arbitrary code on the victim’s machine.

http://www.linuxsecurity.com/advisories/debian_advisory-5135.html

Due to debugging code left accidently in the FC3 udev package, SIGCHLD signals are blocked in udev, which prevents getting the proper exit status in udev.rules. This means no cdrom symlinks are created and pam_console does not apply desktop user ownerships to any cdrom devices.

http://www.linuxsecurity.com/advisories/fedora_advisory-5102.html

This update fixes some minor bugs discovered after the final freeze date.

http://www.linuxsecurity.com/advisories/fedora_advisory-5103.html

This update fixes it so that the sg module gets loaded by hotplug for non-disk, non-optical devices.

http://www.linuxsecurity.com/advisories/fedora_advisory-5104.html

This update fixes the use of ‘setkey’ when reading from stdin (the ‘-c’ argument).

http://www.linuxsecurity.com/advisories/fedora_advisory-5105.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5106.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5107.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5108.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5109.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5110.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5111.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5112.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5113.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5114.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5115.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5116.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5117.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5118.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5119.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5120.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5121.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5122.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5123.html

KDE 3.3.1 update

http://www.linuxsecurity.com/advisories/fedora_advisory-5124.html

GPdf includes the gpdf application, a Bonobo control for PDF display which can be embedded in Nautilus, and a Nautilus property page for PDF files.

http://www.linuxsecurity.com/advisories/fedora_advisory-5125.html

Fixes a memory leak during wireless scans that affects NetworkManager.

http://www.linuxsecurity.com/advisories/fedora_advisory-5126.html

This update fixes issues when using redhat-artwork on 64-bit platforms, having both 32 and 64 bit versions installed.

http://www.linuxsecurity.com/advisories/fedora_advisory-5127.html

GNOME (GNU Network Object Model Environment) is a user-friendly set of GUI applications and desktop tools to be used in conjunction with a window manager for the X Window System. The gnome-media package will install media features like the GNOME CD player.

http://www.linuxsecurity.com/advisories/fedora_advisory-5128.html

A buffer overflow has been found in zip which will lead to a buffer overflow when a user try to create a zip archive which contains very long filenames.

http://www.linuxsecurity.com/advisories/fedora_advisory-5131.html

A buffer overflow has been found in zip which will lead to a buffer overflow when a user try to create a zip archive which contains very long filenames.

http://www.linuxsecurity.com/advisories/fedora_advisory-5132.html

64bit excel {im|ex}port backport fixes

http://www.linuxsecurity.com/advisories/fedora_advisory-5136.html

system-config-users is a graphical utility for administrating users and groups. It depends on the libuser library.

http://www.linuxsecurity.com/advisories/fedora_advisory-5140.html

The fixes in this update are detailed in the changelog entry below.

http://www.linuxsecurity.com/advisories/fedora_advisory-5141.html

The fixes in this update are detailed in the changelog entry below.

http://www.linuxsecurity.com/advisories/fedora_advisory-5142.html

This update fixes a crash when a processing a query requires more than one redirection.

http://www.linuxsecurity.com/advisories/fedora_advisory-5143.html

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

http://www.linuxsecurity.com/advisories/fedora_advisory-5144.html

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

http://www.linuxsecurity.com/advisories/fedora_advisory-5145.html

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs.

http://www.linuxsecurity.com/advisories/fedora_advisory-5153.html

system-config-users is a graphical utility for administrating users and groups. It depends on the libuser library.

http://www.linuxsecurity.com/advisories/fedora_advisory-5154.html

This update to libxml2 fixes a variety of bugs found in 2.6.15, notably #137968.

http://www.linuxsecurity.com/advisories/fedora_advisory-5155.html

This update to libxml2 fixes a variety of bugs found in 2.6.15, notably #137968.

http://www.linuxsecurity.com/advisories/fedora_advisory-5156.html

Several buffer overflows were reported in various memory allocation calls. An attacker could create a carefully crafted image file in such a way that it could cause ImageMagick to execute arbitrary code when processing the image.

http://www.linuxsecurity.com/advisories/fedora_advisory-5157.html

Several buffer overflows were reported in various memory allocation calls. An attacker could create a carefully crafted image file in such a way that it could cause ImageMagick to execute arbitrary code when processing the image.

http://www.linuxsecurity.com/advisories/fedora_advisory-5158.html

A buffer overflow bug has been discovered in unarj when handling long file names contained in an archive. An attacker could create an archive with a specially crafted path which could cause unarj to crash or execute arbitrary instructions.

http://www.linuxsecurity.com/advisories/fedora_advisory-5159.html

The original fix introduced new vulnerabilities on 64-bit platforms. New fixed packages are available. Updated sections follow.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5090.html

The original fix introduced new vulnerabilities on 64-bit platforms. New fixed packages are available. Updated sections follow.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5091.html

Gallery is vulnerable to cross-site scripting attacks.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5092.html

ImageMagick contains an error in boundary checks when handling EXIF information, which could lead to arbitrary code execution.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5093.html

zgv contains multiple buffer overflows that can potentially lead to the execution of arbitrary code.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5094.html

dispatch-conf (included in Portage) and qpkg (included in Gentoolkit) are vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the script.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5095.html

Kaffeine and gxine both contain a buffer overflow that can be exploited when accessing content from a malicious HTTP server with specially crafted headers.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5096.html

groffer, included in the Groff package, and the der_chop script, included in the OpenSSL package, are both vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the utility.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5097.html

zip contains a buffer overflow when creating a ZIP archive of files with very long path names. This could lead to the execution of arbitrary code.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5137.html

mtink is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the utility.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5138.html

A flaw in Apache 2.0 could allow a remote attacker to cause a Denial of Service.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5139.html

Pavuk contains multiple buffer overflows that can allow a remote attacker to run arbitrary code.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5151.html

ez-ipupdate contains a format string vulnerability that could lead to execution of arbitrary code.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5152.html

An input validation flaw in Samba may allow a remote attacker to cause a Denial of Service by excessive consumption of CPU cycles.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5160.html

Davfs2 and the lvmcreate_initrd script (included in the lvm-user package) are both vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running them.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5161.html

A vulnerability in the shadow suite was discovered by Martin Schulze that can be exploited by local users to bypass certain security restrictions due to an input validation error in the passwd_check() function. This function is used by the chfn and chsh tools.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5084.html

Multiple buffer overflows were reported in the libxml XML parsing library. These vulnerabilities may allow remote attackers to execute arbitray code via a long FTP URL that is not properly handled by the xmlNanoFTPScanURL() function, a long proxy URL containing FTP data that is not properly handled by the xmlNanoFTPScanProxy() function, and other overflows in the code that resolves names via DNS.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5085.html

Andres Salomon noticed a problem with the CGI session management in Ruby. The CGI:Session’s FileStore implementations store session information in an insecure manner by just creating files and ignoring permission issues (CAN-2004-0755).

http://www.linuxsecurity.com/advisories/mandrake_advisory-5129.html

There was a problem with two modules in the webmin package that did not work correctly: the cron and backup modules. The updates packages fix the problem so the modules will again work.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5146.html

Ulf Harnhammar discovered a format string vulnerability in ez-ipupdate, a client for many dynamic DNS services. The updated packages are patched to protect against this problem.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5147.html

The Speedtouch USB driver contains a number of format string vulnerabilities due to improperly made syslog() system calls. These vulnerabilities can be abused by a local user to potentially allow the execution of arbitray code with elevated privileges.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5148.html

Karol Wiesek discovered a bug in the input validation routines in Samba 3.x used to match filename strings containing wildcard characters. This bug may allow a user to consume more than normal amounts of CPU cycles which would impact the performance and response of the server.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5149.html

Potential buffer overflow with escaped characters in SSI tag string. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0940 to this issue.

http://www.linuxsecurity.com/advisories/trustix_advisory-5087.html

PHP: Wrong “extension_dir” leads to problems loading modules. Postfix: Fixed a missing define that prevented dynamic loading of modules.

http://www.linuxsecurity.com/advisories/trustix_advisory-5100.html