Linux Advisory Watch – December 3, 2004

Jouko Pynnonen reported[2], through iDEFENSE, a vulnerability[3]
in the plugin mechanism which allows remote attackers to bypass the Java
sandbox through the use of javascript.

Alert 106930

iDefense[3] discovered[4] a buffer overflow vulnerability[5]
in the wv library which could allow an attacker to execute arbitrary code
with the privileges of the user running the vulnerable application.

Alert 117319

Stefan Esser from e-matters security recently published[2] several
vulnerabilities in cyrus-imapd.

Alert 117320

Joost Pol noticed[2] that SquirrelMail is prone to a cross site
scripting issue in the decoding of encoded text in certain headers. SquirrelMail
correctly decodes the specially crafted header, but doesn’t sanitize the
result.

Alert 117321

More potential integer overflows have been found in the GD graphics
library which weren’t covered by our security advisory DSA 589. They could
be exploited by a specially crafted graphic and could lead to the execution
of arbitrary code on the victim’s machine.

Alert 106931

More potential integer overflows have been found in the GD graphics
library which weren’t covered by our security advisory DSA 589. They could
be exploited by a specially crafted graphic and could lead to the execution
of arbitrary code on the victim’s machine.

Alert 106932

Trustix developers discovered insecure temporary file creation
in a supplemental script (der_chop) of the openssl package which may allow
local users to overwrite files via a symlink attack.

Alert 117312

“infamous41md” discovered a buffer overflow condition in hpsockd,
the socks server written at Hewlett-Packard. An exploit could cause the
program to crash or may have worse effect.

Alert 117313

FixFiles.cron is not needed for targeted policy and needs to
be reworked for strict policy. Removing prevents possible relabeling problems.

Alert 106953

FixFiles.cron is not needed for targeted policy and needs to
be reworked for strict policy. Removing prevents possible relabeling problems.

Alert 106952

if layout code needs to re-prelink some library, make sure all
libraries that depend on it are re-prelinked too (#140081)

Alert 106950

Change location of helper applications and remove some debug
applications that should not have been part of the distribution.

Alert 106951

Forgot to turn of debugging logging. This release speeds up
udev.

Alert 106948

fixed nfs protocol parsing for 64 bit architectures (bug 132781)

Alert 106949

Fixes for tempnam usages and startup geometry crashes

Alert 106947

This fixes tracebacks introduced by the libselinux update (#139155)

Alert 106944

This update closes two security holes: CAN-2004-0882 and CAN-2004-0930

Alert 106941

This update closes two security holes: CAN-2004-0882 and CAN-2004-0930.

Alert 106942

FC2 Update

Alert 106943

CAN-2004-1036 Cross Site Scripting in encoded text

Alert 106934

CAN-2004-1036 Cross Site Scripting in encoded text

Alert 106935

Several important bug fixes in upstream release.

Alert 106936

enable Gujarati and Tamil translations (#140881)

Alert 106937

The implementation of the /proc/curproc/cmdline pseudofile in
the procfs(5) file system on FreeBSD 4.x and 5.x, and of the /proc/self/cmdline
pseudofile in the linprocfs(5) file system on FreeBSD 5.x reads a process’
argument vector from the process address space. During this operation,
a pointer was dereferenced directly without the necessary validation steps
being performed.

Alert 117318

The Java plug-in security in Sun and Blackdown Java environments
can be bypassed to access arbitrary packages, allowing untrusted Java
applets to perform unrestricted actions on the host system.

Alert 106945

Open DC Hub contains a buffer overflow that can be exploited
to allow remote code execution.

Alert 106940

phpWebSite is vulnerable to possible HTTP response splitting
attacks.

Alert 106929

phpMyAdmin is vulnerable to cross-site scripting attacks.

Alert 106939

The previous libxpm4 update had a linking error that resulted
in a missing s_popen symbol error running applications dependant on the
library. In addition, the file path checking in the security updates prevented
some applications, like gimp-2.0 from being able to save xpm format images.

Alert 106946

A number of bugs in kdepim are fixed with this update.

Alert 106938

A number of bugs in kdelibs are fixed with this update.

Alert 106925

A number of bugs in kdebase are fixed with this update.

Alert 106924

Fix amavis user creation on install. Support kickstart files
on FTP. Hyperthreading detection.

Alert 106933

Updated openmotif packages that fix flaws in the Xpm image library
are now available.

Alert 117314

Updated kernel packages that fix several security issues in
Red Hat Enterprise Linux 3 are now available.

Alert 117315

Several security problems have been found and addressed by the
SUSE Security Team. The following issues are present in all SUSE Linux
based products.

Alert 117316

Stefan Esser reported various bugs within the Cyrus IMAP Server.
These include buffer overflows and out-of-bounds memory access which could
allow remote attackers to execute arbitrary commands as root. The bugs
occur in the pre-authentication phase, therefore an update is strongly
recommended.

Alert 117317