Linux Advisory Watch – December 10, 2004

“infamous41md” discovered a buffer overflow condition in hpsockd,
the socks server written at Hewlett-Packard. An exploit could cause the
program to crash or may have worse effect.

http://www.linuxsecurity.com/content/view/117313

Hajvan Sehic discovered several vulnerabilities in viewcvs,
a utility for viewing CVS and Subversion repositories via HTTP. When exporting
a repository as a tar archive the hide_cvsroot and forbidden settings
were not honoured enough.

http://www.linuxsecurity.com/content/view/117392

SGI has discovered that rpc.statd from the nfs-utils package,
the Network Status Monitor, did not ignore the “SIGPIPE”. Hence, a client
prematurely terminating the TCP connection could also terminate the server
process.

http://www.linuxsecurity.com/content/view/117423

The recent update to cyrus-imapd-2.2.10-1.fc2 for security exploits
revealed a package installation problem.

http://www.linuxsecurity.com/content/view/117366

The recent update to cyrus-imapd-2.2.10-1.fc3 for security exploits
revealed a package installation problem. If the main configuration files
for cyrus-imapd

http://www.linuxsecurity.com/content/view/117367

Fix to temp file vulnerability in /etc/psf/etc2ps

http://www.linuxsecurity.com/content/view/117395

Fix temp file vulnerability in /etc/psf/etc2ps

http://www.linuxsecurity.com/content/view/117396

Gaim allows you to talk to anyone using a variety of messaging
protocols, including AIM (Oscar and TOC), ICQ, IRC, Yahoo!, MSN Messenger,
Jabber, Gadu-Gadu, Napster, and Zephyr. These protocols are implemented
using a modular, easy to use design. To use a protocol, just add an account
using the account editor.

http://www.linuxsecurity.com/content/view/117397

Gaim allows you to talk to anyone using a variety of messaging
protocols, including AIM (Oscar and TOC), ICQ, IRC, Yahoo!, MSN Messenger,
Jabber, Gadu-Gadu, Napster, and Zephyr. These protocols are implemented
using a modular, easy to use design. To use a protocol, just add an account
using the account editor.

http://www.linuxsecurity.com/content/view/117398

Remove synaptics requires (#137935)

http://www.linuxsecurity.com/content/view/117399

reverted the previous changes so that it broke ghostscript working.
(#139798)

http://www.linuxsecurity.com/content/view/117404

The updated version of Midnight Commander contains finished
CAN-2004-0494 security fixes in extfs scripts and has better support for
UTF-8, contains subshell prompt fixes and enhanced large file support.

http://www.linuxsecurity.com/content/view/117417

udev is a implementation of devfs in userspace using sysfs and
/sbin/hotplug. It requires a 2.6 kernel to run properly.

http://www.linuxsecurity.com/content/view/117418

fixed udev.rules for cdrom symlinks (bug 141897)

http://www.linuxsecurity.com/content/view/117419

fixed again gnome-bluetooth-manager script for 64bit (bug 134864)

http://www.linuxsecurity.com/content/view/117420

fixed rexec fails with “Invalid Argument” (#118630)

http://www.linuxsecurity.com/content/view/117432

This is the 0.9.2 release of the Omni printer driver collection.
It also fixes a library path problem on multilib architectures such as
x86_64.

http://www.linuxsecurity.com/content/view/117433

fix security issues CAN-2004-0835, CAN-2004-0836, CAN-2004-0837
(bugs #135372, 135375, 135387)

http://www.linuxsecurity.com/content/view/117434

Updates libpng to the current release 1.2.8. For details about
the bugs which have been fixed in this release, see http://www.libpng.org/pub/png/libpng.html

http://www.linuxsecurity.com/content/view/117439

Updates libpng10 to the current release 1.0.18. For details
about the bugs which have been fixed in this release, see http://www.libpng.org/pub/png/libpng.html

http://www.linuxsecurity.com/content/view/117440

Updates GLib to the current stable release 2.4.8. For details
about the bugs which have been fixed in this release, see http://mail.gnome.org/archives/gnome-announce-list/2004-
December/msg00004.html

http://www.linuxsecurity.com/content/view/117441

Updates GTK+ to the current stable release 2.4.14. For details
about the bugs which have been fixed in this release, see http://mail.gnome.org/archives/gnome-announce-list/2004-
December/msg00007.html

http://www.linuxsecurity.com/content/view/117442

Updates libpng10 to the current release 1.0.18. For details
about the bugs which have been fixed in this release, see http://www.libpng.org/pub/png/libpng.html

http://www.linuxsecurity.com/content/view/117443

Updates libpng to the current release 1.2.8. For details about
the bugs which have been fixed in this release, see http://www.libpng.org/pub/png/libpng.html

http://www.linuxsecurity.com/content/view/117444

Updates GLib to the current stable release 2.4.8. For details
about the bugs which have been fixed in this release, see http://mail.gnome.org/archives/gnome-announce-list/2004-
December/msg00004.html

http://www.linuxsecurity.com/content/view/117445

Updates GTK+ to the current stable release 2.4.14. For details
about the bugs which have been fixed in this release, see http://mail.gnome.org/archives/gnome-announce-list/2004-
December/msg00007.html

http://www.linuxsecurity.com/content/view/117446

This update fixes problems occurring on 64-bit platforms.

http://www.linuxsecurity.com/content/view/117447

This update fixes problems occurring on 64-bit platforms.

http://www.linuxsecurity.com/content/view/117448

This update synchronizes PostgreSQL for FC2 with the version
already released in FC3.

http://www.linuxsecurity.com/content/view/117449

A regression has been fixed where strict enforcement of POSIX
rules for user and group names prevented Samba 3 from using its “add machine
script” feature with useradd. Also, the maximum length for a username/groupname
is now 31 (previously it was 32). The lastlog command can now handle extremely
large (greater than 4GB) lastlogs.

http://www.linuxsecurity.com/content/view/117452

A regression has been fixed where strict enforcement of POSIX
rules for user and group names prevented Samba 3 from using its “add machine
script” feature with useradd. Also, the maximum length for a username/groupname
is now 31 (previously it was 32). The lastlog command can now handle extremely
large (greater than 4GB) lastlogs.

http://www.linuxsecurity.com/content/view/117453

rssh and scponly do not filter command-line options that can
be exploited to execute any command, thereby allowing a remote user to
completely bypass the restricted shell.

http://www.linuxsecurity.com/content/view/117364

PDFlib is vulnerable to multiple overflows, which can potentially
lead to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/117393

Multiple overflows have been found in the imlib library image
decoding routines, potentially allowing execution of arbitrary code.

http://www.linuxsecurity.com/content/view/117394

Perl is vulnerable to symlink attacks, potentially allowing
a local user to overwrite arbitrary files.

http://www.linuxsecurity.com/content/view/117402

mirrorselect is vulnerable to symlink attacks, potentially allowing
a local user to overwrite arbitrary files.

http://www.linuxsecurity.com/content/view/117403

Beginning immediately, all bug reports for stable releases will
be handled via Bugzilla at http://qa.mandrakesoft.com/. The drakbug tool
has been updated to point users of stable releases to Bugzilla.

http://www.linuxsecurity.com/content/view/117405

There was a problem with dietlibc in Mandrakelinux 10.0/amd64
where it would not provide proper support for the AMD64 architecture.
The updated package fixes this.

http://www.linuxsecurity.com/content/view/117406

The Trustix developers found some insecure temporary file creation
problems in the zdiff, znew, and gzeze supplemental scripts in the gzip
package. These flaws could allow local users to overwrite files via a
symlink attack.

http://www.linuxsecurity.com/content/view/117407

A vulnerability was discovered in ImageMagick where, due to
a boundary error within the EXIF parsing routine, a specially crafted
graphic image could potentially lead to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/117408

The Trustix developers discovered that the lvmcreate_initrd
script, part of the lvm1 package, created a temporary directory in an
insecure manner. This could allow for a symlink attack to create or overwrite
arbitrary files with the privileges of the user running the script.

http://www.linuxsecurity.com/content/view/117409

Max Vozeler discovered a vulnerability in pppoe, part of the
rp-pppoe package. When pppoe is running setuid root, an attacker can overwrite
any file on the system. Mandrakelinux does not install pppoe setuid root,
however the packages have been patched to prevent this problem.

http://www.linuxsecurity.com/content/view/117410

SGI developers discovered a remote DoS (Denial of Service) condition
in the NFS statd server. rpc.statd did not ignore the “SIGPIPE” signal
which would cause it to shutdown if a misconfigured or malicious peer
terminated the TCP connection prematurely.

http://www.linuxsecurity.com/content/view/117411

The Trustix developers found that the der_chop script, included
in the openssl package, created temporary files insecurely. This could
allow local users to overwrite files using a symlink attack.

http://www.linuxsecurity.com/content/view/117412

amavisd-new
AMaViS is a script that interfaces a mail transport agent (MTA) with one
or more virus scanners.

http://www.linuxsecurity.com/content/view/117437

SGI developers discovered a remote Denial of Service in the
NFS statd server where it did not ignore the “SIGPIPE” signal. This could
cause the server to shut down if a client terminates prematurely.

http://www.linuxsecurity.com/content/view/117438

Updated ImageMagick packages that fixes a buffer overflow are
now available.

http://www.linuxsecurity.com/content/view/117431

Stefan Esser reported various bugs within the Cyrus IMAP Server.
These include buffer overflows and out-of-bounds memory access which could
allow remote attackers to execute arbitrary commands as root. The bugs
occur in the pre-authentication phase, therefore an update is strongly
recommended.

http://www.linuxsecurity.com/content/view/117317

Two vulnerabilities discovered in Samba. DoS vulnerability in
cups.

http://www.linuxsecurity.com/content/view/117424