Linux Advisory Watch – October 15, 2004

Alvaro Martinez Echevarria found a vulnerability[2] in the CUPS Internet Printing Protocol (IPP) implementation that allows remote attackers to make CUPS stop listening on the IPP port by sending an empty UDP datagram packet to the IPP port, causing a denial of service situation.

http://www.linuxsecurity.com/advisories/conectiva_advisory-4948.html

This announcement fixes two denial of service vulnerabilities via certain malformed requests[2] and via a SAM_UAS_CHANGE request with a big length value[3] when domain logons are enabled.

http://www.linuxsecurity.com/advisories/conectiva_advisory-4949.html

This security advisory corrects DSA 458-2 which caused a problem in the gethostbyaddr routine.

http://www.linuxsecurity.com/advisories/debian_advisory-4917.html

Severl problems have been discovered in MySQL, a commonly used SQL database on Unix servers.

http://www.linuxsecurity.com/advisories/debian_advisory-4931.html

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols.

http://www.linuxsecurity.com/advisories/debian_advisory-4936.html

This advisory corrects DSA 563-1 which contained a library that caused other programs to fail unindented.

http://www.linuxsecurity.com/advisories/debian_advisory-4937.html

Davide Del Vecchio discovered a vulnerability mpg123, a popular (but non-free) MPEG layer 1/2/3 audio player. A malicious MPEG layer 2/3 file could cause the header checks in mpg123 to fail, which could in turn allow arbitrary code to be executed with the privileges of the user running mpg123.

http://www.linuxsecurity.com/advisories/debian_advisory-4941.html

Ulf Harnhammar has reported two vulnerabilities in SoX, a universal sound sample translator, which may be exploited by malicious people to compromise a user’s system with a specially crafted .wav file.

http://www.linuxsecurity.com/advisories/debian_advisory-4942.html

This advisory is an addition to DSA 563-1 and 563-2 which weren’t able to supersede the library on sparc and arm due to a different version number for them in the stable archive.

http://www.linuxsecurity.com/advisories/debian_advisory-4950.html

An information leak has been detected in CUPS, the Common UNIX Printing System, which may lead to the disclosure of sensitive information, such as user names and passwords which are written into log files.

http://www.linuxsecurity.com/advisories/debian_advisory-4952.html

This update fixes a potential DoS against squid that was reported by Secunia.

http://www.linuxsecurity.com/advisories/fedora_advisory-4920.html

In situations where an untrusted local user can affect the environment of a privileged process, this behavior could be exploited to run arbitrary code with the privileges of a setuid or setgid application.

http://www.linuxsecurity.com/advisories/fedora_advisory-4922.html

This update fixes a few problems in the PCMCIA init script.

http://www.linuxsecurity.com/advisories/fedora_advisory-4933.html

The GIMP (GNU Image Manipulation Program) is a powerful image composition and editing program, which can be extremely useful for creating logos and other graphics for webpages.

http://www.linuxsecurity.com/advisories/fedora_advisory-4934.html

This package contains data files with rules for various timezones around the world.

http://www.linuxsecurity.com/advisories/fedora_advisory-4940.html

This update fixes many bugs, mostly in the LDAP backend and the Python bindings.

http://www.linuxsecurity.com/advisories/fedora_advisory-4944.html

Backport fix for CAN-2004-0918 (Remote Denial of Service attack)

http://www.linuxsecurity.com/advisories/fedora_advisory-4945.html

when renaming users, ensure that groups forget about the old user name (#135280)

http://www.linuxsecurity.com/advisories/fedora_advisory-4946.html

K3b provides a comfortable user interface to perform most CD/DVD burning tasks. While the experienced user can take influence in all steps of the burning process the beginner may find comfort in the automatic settings and the reasonable k3b defaults which allow a quick start.

http://www.linuxsecurity.com/advisories/fedora_advisory-4951.html

This update fixes the bug that catches the wrong values of bpp in the BMP plugin.

http://www.linuxsecurity.com/advisories/fedora_advisory-4953.html

Chris Evans discovered a number of integer overflow bugs that affect libtiff. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause the application linked to libtiff to crash or possibly execute arbitrary code.

http://www.linuxsecurity.com/advisories/fedora_advisory-4954.html

The w3m program is a pager (or text file viewer) that can also be used as a text-mode Web browser.

http://www.linuxsecurity.com/advisories/fedora_advisory-4955.html

A security fix [CAN-2004-0755]. ruby-1.8.1-cgi_session_perms.patch: sets the permission of the session data file to 0600. (#130063)

http://www.linuxsecurity.com/advisories/fedora_advisory-4956.html

CUPS leaks information about user names and passwords when using remote printing to SMB-shared printers which require authentication.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4926.html

The ed utility is vulnerable to symlink attacks, potentially allowing a local user to overwrite or change rights on arbitrary files with the rights of the user running ed, which could be the root user.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4927.html

compress and uncompress, which could be used by daemon programs, contain a buffer overflow that could lead to remote execution of arbitrary code with the rights of the daemon process.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4928.html

Multiple vulnerabilities have been discovered in libXpm, which is included in LessTif, that can potentially lead to remote code execution.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4929.html

The gettext utility is vulnerable to symlink attacks, potentially allowing a local user to overwrite or change permissions on arbitrary files with the rights of the user running gettext, which could be the root user.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4930.html

Chris Evans discovered several stack and integer overflows in the libXpm library which is provided by X.Org, XFree86 and LessTif.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4932.html

Multiple heap-based overflows have been found in the tiff library image decoding routines, potentially allowing to execute arbitrary code with the rights of the user viewing a malicious image.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4943.html

WordPress contains HTTP response splitting and cross-site scripting vulnerabilities.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4947.html

BNC contains an input validation flaw which might allow a remote attacker to issue arbitrary IRC related commands.

http://www.linuxsecurity.com/advisories/gentoo_advisory-4957.html

The Internet Printing Protocol (IPP) implementation in CUPS before 1.1.21 allows remote attackers to cause a denial of service via a certain UDP packet to the IPP port.

http://www.linuxsecurity.com/advisories/other_advisory-4938.html

Several vulnerabilities exist in the libpng library, the most serious of which could allow a remote attacker to execute arbitrary code on an affected system.

http://www.linuxsecurity.com/advisories/other_advisory-4939.html

New rsync 2.6.3 packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to a fix security issue when rsync is run as a non-chrooted server.

http://www.linuxsecurity.com/advisories/slackware_advisory-4935.html

Kurt Lieber reported that libsasl honors the environment variable SASL_PATH blindly, allowing a local user to compile a “library” locally that is executed with the EID of SASL.

http://www.linuxsecurity.com/advisories/trustix_advisory-4919.html