Linux Advisory Watch – January 28, 2005

This announcement fixes several integer overflow vulnerabilities[3,4]
that were encountered in libtiff by iDefense which could lead to remote
arbitrary code execution.

http://www.linuxsecurity.com/content/view/117982

This update fixes several vulnerabilities[2,3,4] in ethereal: CAN-2004-0633[5]:
The iSNS dissector for ethereal 0.10.3 through 0.10.4 allows remote
attackers to cause a denial of service (process abort) via an integer
overflow.

http://www.linuxsecurity.com/content/view/118030

iDefense noticed two issuesin the xpdf code where two buffer overflows
could lead to remote code execution vulnerabilities.

http://www.linuxsecurity.com/content/view/118050

This update fixes several vulnerabilities in the squid web proxy cache.

http://www.linuxsecurity.com/content/view/118068

A buffer overflow has been discovered in xtrlock, a minimal X display
lock program which can be exploited by a malicious local attacker to
crash the lock program and take over the desktop session.

http://www.linuxsecurity.com/content/view/117981

Ulf Hþrnhammar discovered that due to missing input sanitising
in diatheke, a CGI script for making and browsing a bible website, it
is possible to execute arbitrary commands via a specially crafted URL.

http://www.linuxsecurity.com/content/view/117990

Several vulnerabilities have been discovered in Squid, the internet
object cache, the popular WWW proxy cache.

http://www.linuxsecurity.com/content/view/117991

Several vulnerabilities have been discovered in unarj, a non-free
ARJ unarchive utility.

http://www.linuxsecurity.com/content/view/118007

A buffer overflow has been detected in the X11 dissector of
ethereal, a commonly used network traffic analyser. A remote attacker
may be able to overflow a buffer using a specially crafted IP packet.

http://www.linuxsecurity.com/content/view/118008

Erik Sjšlund has discovered several security relevant problems
in enscript, a program to convert ASCII text into Postscript and other
formats.

http://www.linuxsecurity.com/content/view/118009

Erik Sjšlund discovered that zhcon, a fast console CJK system
using the Linux framebuffer, accesses a user-controlled configuration
file with elevated privileges. Thus, it is possible to read arbitrary
files.

http://www.linuxsecurity.com/content/view/118039

Javier Fern‡ndez-Sanguino Pe–a from the Debian Security Audit
Team has discovered that the vdr daemon which is used for video disk recorders
for DVB cards can overwrite arbitrary files.

http://www.linuxsecurity.com/content/view/118040

A heap overflow has been discovered in the DVD subpicture decoder
of xine-lib. An attacker could cause arbitrary code to be executed on
the victims host by supplying a malicious MPEG. By tricking users to view
a malicious network stream, this is remotely exploitable.

http://www.linuxsecurity.com/content/view/118049

Javier Fern‡ndez-Sanguino Pe–a from the Debian Security Audit
Project discovered that the DBI library, the Perl5 database interface,
creates a tmporary PID file in an insecure manner. This can be exploited
by a malicious user to overwrite arbitrary files owned by the person executing
the parts of the library.

http://www.linuxsecurity.com/content/view/118051

Two problems have been discovered in the libpam-radius-auth
package, the PAM RADIUS authentication module. The Common Vulnerabilities
and Exposures Project identifies the following problems…

http://www.linuxsecurity.com/content/view/118067

Rapha‘l Enrici discovered that the KDE screensaver can crash
under certain local circumstances. This can be exploited by an attacker
with physical access to the workstation to take over the desktop session.

http://www.linuxsecurity.com/content/view/118073

Javier Fern‡ndez-Sanguino Pe–a from the Debian Security Audit
project discovered that f2c and fc, which are both part of the f2c package,
a fortran 77 to C/C++ translator, open temporary files insecurely and
are hence vulnerable to a symlink attack.

http://www.linuxsecurity.com/content/view/118091

This package fixes a buffer overflow which may possibly allow
attackers to execute arbitrary code as the “lp” user. The Common Vulnerabilities
and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064
to this issue.

http://www.linuxsecurity.com/content/view/117983

This package fixes a buffer overflow which may possibly allow
attackers to execute arbitrary code as the “lp” user. The Common Vulnerabilities
and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064
to this issue.

http://www.linuxsecurity.com/content/view/117984

A flaw in the alsa mixer code was discovered, which disabled
stack execution protection for the libasound.so library distributed with
Fedora Core 3. The effect of this flaw resulted in stack execution protection,
through NX or Exec-Shield, which was disabled for any application linked
to libasound.

http://www.linuxsecurity.com/content/view/117985

This update fixes a small regression in handling multibyte input
for “grep -Fi”, and further improves performance when processing UTF-8
input.

http://www.linuxsecurity.com/content/view/117992

Applied patch to fix CAN-2005-0064 (bug #145050)

http://www.linuxsecurity.com/content/view/117993

Applied patch to fix CAN-2005-0064 (bug #145050)

http://www.linuxsecurity.com/content/view/117994

Update microcode_ctl to 1.11 (#131885)

http://www.linuxsecurity.com/content/view/117997

Update microcode_ctl to 1.11

http://www.linuxsecurity.com/content/view/117998

New upstream release

http://www.linuxsecurity.com/content/view/118004

This is a bugfix update.

http://www.linuxsecurity.com/content/view/118010

This is a version upgrade to 2.1.5. More cameras are supported
in this version.

http://www.linuxsecurity.com/content/view/118011

This update includes a regenerated version of the bundled libtool
script, which fixes some build issues with third-party httpd modules.

http://www.linuxsecurity.com/content/view/118012

Fix PAM_IGNORE return value handling and correct the grubb_leak
patch to fix #143750

http://www.linuxsecurity.com/content/view/118019

Updated tetex package fixes another xpdf buffer overflow. The
Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned
the name CAN-2005-0064 to this issue.

http://www.linuxsecurity.com/content/view/118033

Updated tetex package fixes another xpdf buffer overflow. The
Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned
the name CAN-2005-0064 to this issue.

http://www.linuxsecurity.com/content/view/118035

This update fixes several vulnerabilities in the ethereal package.

http://www.linuxsecurity.com/content/view/118041

This update fixes several vulnerabilities in the ethereal package.

http://www.linuxsecurity.com/content/view/118042

This update fixes a buffer overflow in the koffice package.

http://www.linuxsecurity.com/content/view/118043

This update fixes a buffer overflow in the koffice package.

http://www.linuxsecurity.com/content/view/118044

This update fixes several vulnerabilities in graphics-related
KDE packages.

http://www.linuxsecurity.com/content/view/118045

This update fixes several vulnerabilities in graphics-related
KDE packages.

http://www.linuxsecurity.com/content/view/118046

This update fixes several vulnerabilities in KDE.

http://www.linuxsecurity.com/content/view/118047

This update fixes several vulnerabilities in KDE.

http://www.linuxsecurity.com/content/view/118048

Several security relevant problems in enscript, a program to
converts ASCII text to Postscript and other formats.

http://www.linuxsecurity.com/content/view/118075

Fixes a great many bugs. Refer to the official changelog for
details.

http://www.linuxsecurity.com/content/view/118076

Fixes a great many bugs. Refer to the official changelog for
details.

http://www.linuxsecurity.com/content/view/118077

Updated tetex package fixes another xpdf buffer overflow. The
Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned
the name CAN-2005-0064 to this issue.

http://www.linuxsecurity.com/content/view/118078

Updated tetex package fixes another xpdf buffer overflow. The
Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned
the name CAN-2005-0064 to this issue.

http://www.linuxsecurity.com/content/view/118079

Several security relevant problems in enscript, a program to
converts ASCII text to Postscript and other formats.

http://www.linuxsecurity.com/content/view/118080

The procps package contains a set of system utilities that provide
system information.

http://www.linuxsecurity.com/content/view/118093

The procps package contains a set of system utilities that provide
system information.

http://www.linuxsecurity.com/content/view/118094

ImageMagick is vulnerable to a heap overflow when decoding Photoshop
Document (PSD) files, which could lead to arbitrary code execution.

http://www.linuxsecurity.com/content/view/118003

Multiple vulnerabilities exist in Ethereal, which may allow an attacker
to run arbitrary code, crash the program or perform DoS by CPU and disk
utilization.

http://www.linuxsecurity.com/content/view/118005

A stack overflow was discovered in Xpdf, potentially resulting
in the execution of arbitrary code. GPdf includes Xpdf code and therefore
is vulnerable to the same issue.

http://www.linuxsecurity.com/content/view/118020

Mailman is vulnerable to cross-site scripting attacks.

http://www.linuxsecurity.com/content/view/118021

CUPS includes Xpdf code and therefore is vulnerable to the recent
stack overflow issue, potentially resulting in the remote execution of
arbitrary code.

http://www.linuxsecurity.com/content/view/118022

teTeX, pTeX and CSTeX make use of vulnerable Xpdf code which
may allow the remote execution of arbitrary code. Furthermore, the xdvizilla
script is vulnerable to temporary file handling issues.

http://www.linuxsecurity.com/content/view/118023

KPdf and KOffice both include vulnerable Xpdf code to handle
PDF files, making them vulnerable to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/118024

MySQL is vulnerable to symlink attacks, potentially allowing
a local user to overwrite arbitrary files.

http://www.linuxsecurity.com/content/view/118025

Konversation contains multiple vulnerabilities that could lead
to remote command execution or information leaks.

http://www.linuxsecurity.com/content/view/118027

CUPS was vulnerable to multiple vulnerabilities and as a fix
we recommended upgrading to version 1.1.23_rc1. This version is affected
by a remote Denial Of Service, so we now recommend upgrading to the final
1.1.23 release which does not have any known vulnerability.

http://www.linuxsecurity.com/content/view/118029

An overflow in the camel-lock-helper application can be exploited
by an attacker to execute arbitrary code with elevated privileges.

http://www.linuxsecurity.com/content/view/118034

AWStats fails to validate certain input, which could lead to
the remote execution of arbitrary code.

http://www.linuxsecurity.com/content/view/118053

GraphicsMagick is vulnerable to a heap overflow when decoding
Photoshop Document (PSD) files, which could lead to arbitrary code execution.

http://www.linuxsecurity.com/content/view/118081

The Perl DBI library and File::Path::rmtree function are vulnerable
to symlink attacks.

http://www.linuxsecurity.com/content/view/118082

Erik Sjolund discovered that zhcon accesses a user-controlled configuration
file with elevated privileges which could make it possible to read arbitrary
files.

http://www.linuxsecurity.com/content/view/118031

A number of vulnerabilities were found in Ethereal, all of which
are fixed in version 0.10.9: The COPS dissector could go into an infinite
loop (CAN-2005-0006); the DLSw dissector could cause an assertion, making
Ethereal exit prematurely (CAN-2005-0007); the DNP dissector could cause
memory corruption (CAN-2005-0008); the Gnutella dissector could cause
an assertion, making Ethereal exit prematurely (CAN-2005-0009); the MMSE
dissector could free static memory (CAN-2005-0010); and the X11 protocol
dissector is vulnerable to a string buffer overflow (CAN-2005-0084).

http://www.linuxsecurity.com/content/view/118032

“infamous41md” discovered two vulnerabilities in the squid proxy
cache server. The first is a buffer overflow in the Gopher response parser
which leads to memory corruption and would usually crash squid (CAN-2005-0094).
The second is an integer overflow in the receiver of WCCP (Web Cache Communication
Protocol) messages. An attacker could send a specially crafted UDP datagram
that would cause squid to crash (CAN-2005-0095).

http://www.linuxsecurity.com/content/view/118036

When php tries to opens a connection using fsockopen(), but
the connection fails, php would not close the socket.

http://www.linuxsecurity.com/content/view/118037

Florian Weimer discovered a vulnerability in Mailman, which
can be exploited by malicious people to conduct cross-site scripting attacks.
Input is not properly sanitised by “scripts/driver” when returning error
pages. This can be exploited to execute arbitrary HTML or script code
in a user’s browser session in context of a vulnerable site by tricking
a user into visiting a malicious web site or follow a specially crafted
link.

http://www.linuxsecurity.com/content/view/118038

A buffer overflow vulnerability was discovered in the xpdf PDF
viewer, which could allow for arbitrary code execution as the user viewing
a PDF file. The vulnerability exists due to insufficient bounds checking
while processing a PDF file that provides malicious values in the /Encrypt
/Length tag. The updated packages have been patched to prevent these problems.

http://www.linuxsecurity.com/content/view/118060

A buffer overflow vulnerability was discovered in the xpdf PDF
code, which could allow for arbitrary code execution as the user viewing
a PDF file. Cups uses xpdf code and is susceptible to the same vulnerability.
The updated packages have been patched to prevent these problems.

http://www.linuxsecurity.com/content/view/118061

A buffer overflow vulnerability was discovered in the xpdf PDF
code, which could allow for arbitrary code execution as the user viewing
a PDF file. Tetex uses xpdf code and is susceptible to the same vulnerability.
The updated packages have been patched to prevent these problems.

http://www.linuxsecurity.com/content/view/118062

A buffer overflow vulnerability was discovered in the xpdf PDF
code, which could allow for arbitrary code execution as the user viewing
a PDF file. Gpdf uses xpdf code and is susceptible to the same vulnerability.
The updated packages have been patched to prevent these problems.

http://www.linuxsecurity.com/content/view/118063

A buffer overflow vulnerability was discovered in the xpdf PDF
code, which could allow for arbitrary code execution as the user viewing
a PDF file. Koffice uses xpdf code and is susceptible to the same vulnerability.
The updated packages have been patched to prevent these problems.

http://www.linuxsecurity.com/content/view/118064

A buffer overflow vulnerability was discovered in the xpdf PDF
code, which could allow for arbitrary code execution as the user viewing
a PDF file. Kdegraphics uses xpdf code and is susceptible to the same
vulnerability. 10.1 packages also include a fix for ksvg kde bug #74457.
The updated packages have been patched to prevent these problems.

http://www.linuxsecurity.com/content/view/118065

A number of vulnerabilities are fixed in the 2.4 and 2.6 kernels
with this advisory.

http://www.linuxsecurity.com/content/view/118066

A vulnerability was discovered in BIND version 9.3.0 where a
remote attacker may be able to cause named to exit prematurely, causing
a Denial of Service due to an incorrect assumption in the validator function
authvalidated(). The updated packages have been patched to prevent this
problem.

http://www.linuxsecurity.com/content/view/118089

New KDE packages are available to address various bugs.

http://www.linuxsecurity.com/content/view/118096

Max Vozeler discovered an integer overflow in the camel-lock-helper
application.

http://www.linuxsecurity.com/content/view/118098

A bug in the upsd initscript used by nut exists where it starts
the upsd/powerdown script earlier in the halt/shutdown process to ensure
it still has access to USB.

http://www.linuxsecurity.com/content/view/118099

A permissions flaw was found on /etc/sysconfig/mdkonline which
prevented users from reading the file.

http://www.linuxsecurity.com/content/view/118100

Updated kernel packages that fix several security issues in
Red Hat Enterprise Linux 2.1 are now available.

http://www.linuxsecurity.com/content/view/118016

Updated
kernel packages that fix several security issues in Red Hat Enterprise
Linux 2.1 are now available. http://www.linuxsecurity.com/content/view/118017

Updated Xpdf package that fixes a stack based buffer overflow
security issue is now available.

http://www.linuxsecurity.com/content/view/118069

An updated less package that fixes segmentation fault when viewing
binary files is now available.

http://www.linuxsecurity.com/content/view/118070

Several exploitable security problems were identified and fixed
in the Linux kernel, the core of every SUSE Linux product.

http://www.linuxsecurity.com/content/view/118018

eEye Security in October 2004 discovered a flaw in the .rm RealMovie
stream handling routines which allows a remote attacker to exploit an
integer overflow vulnerability using a special .rm file. This might
allow a remote attacker to execute code as the user running RealPlayer.

http://www.linuxsecurity.com/content/view/118028

These vulnerabilities may allow remote attackers to execute
arbitrary code via malformed PDF files.

http://www.linuxsecurity.com/content/view/117986