+----------------------------------------------------------------------+ | LinuxSecurity.com Weekly Newsletter | | November 6th, 2009 Volume 10, Number 45 | | | | Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> | | Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> | +----------------------------------------------------------------------+ Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines. This week, advisories were released for typo3, libhtml, expat, pyxml, mimetex, squidguard, yelp, gnome-python, gnome-web-photo, kazehakase, mozvoikko, miro, mugshot, pcmanx, ruby-gnome, xulrunner, epiphany, evolution, firefox, galeon, wireshark, jetty, wget, kernel-rt, pidgin, mozilla-firefox, and poppler. The distributors include Debian, Fedora, Mandriva, Red Hat, Slackware, SuSE, Ubuntu, and Pardus. --- >> Linux+DVD Magazine << In each issue you can find information concerning the best use of Linux: safety, databases, multimedia, scientific tools, entertainment, programming, e-mail, news and desktop environments. Catch up with what professional network and database administrators, system programmers, webmasters and all those who believe in the power of Open Source software are doing! http://www.linuxsecurity.com/ads/adclick.php?bannerid=26 --- Review: Googling Security: How Much Does Google Know About You -------------------------------------------------------------- If I ask "How much do you know about Google?" You may not take even a second to respond. But if I may ask "How much does Google know about you"? You may instantly reply "Wait... what!? Do they!?" The book "Googling Security: How Much Does Google Know About You" by Greg Conti (Computer Science Professor at West Point) is the first book to reveal how Google's vast information stockpiles could be used against you or your business and what you can do to protect yourself. http://www.linuxsecurity.com/content/view/145939 --- A Secure Nagios Server ---------------------- Nagios is a monitoring software designed to let you know about problems on your hosts and networks quickly. You can configure it to be used on any network. Setting up a Nagios server on any Linux distribution is a very quick process however to make it a secure setup it takes some work. This article will not show you how to install Nagios since there are tons of them out there but it will show you in detail ways to improve your Nagios security. http://www.linuxsecurity.com/content/view/144088 --> Take advantage of the LinuxSecurity.com Quick Reference Card! <-- --> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <-- ------------------------------------------------------------------------ * EnGarde Secure Community 3.0.22 Now Available! (Dec 9) ------------------------------------------------------ Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy. http://www.linuxsecurity.com/content/view/145668 ------------------------------------------------------------------------ * Debian: New Linux 2.6.26 packages fix several vulnerabilities (Nov 5) --------------------------------------------------------------------- http://www.linuxsecurity.com/content/view/150601 * Debian: New TYPO3 packages fix several vulnerabilities (Nov 4) -------------------------------------------------------------- http://www.linuxsecurity.com/content/view/150599 * Debian: New libhtml-parser-perl packages fix denial of service (Oct 29) ----------------------------------------------------------------------- http://www.linuxsecurity.com/content/view/150535 ------------------------------------------------------------------------ * Fedora 10 Update: expat-2.0.1-5.fc10.1 (Nov 4) ---------------------------------------------- This update fixes a security vulnerability: A buffer over-read flaw was found in the way Expat handles malformed UTF-8 sequences when processing XML files. A specially-crafted XML file could cause applications using Expat to crash while parsing the file. (CVE-2009-3720) http://www.linuxsecurity.com/content/view/150592 * Fedora 11 Update: PyXML-0.8.4-16.fc11 (Nov 4) --------------------------------------------- Switched to using system expat library. Updated expat packages are needed to fully resolve this flaw. http://www.linuxsecurity.com/content/view/150593 * Fedora 11 Update: mimetex-1.71-1.fc11 (Nov 4) --------------------------------------------- - Fixes a buffer-overflow as detailed in #511049. - Updates to 1.7. http://www.linuxsecurity.com/content/view/150590 * Fedora 10 Update: squidGuard-1.4-8.fc10 (Nov 4) ----------------------------------------------- Fixes language file issue, but more importantly. . . --------------- squidGuard upstream has released patches fixing (quoting from upstream advisories): a, This patch fixes one buffer overflow problem in sgLog.c when overlong URLs are requested. SquidGuard will then go into emergency mode were no blocking occurs. This is not required in this situation. http://www.linuxsecurity.com/content/view/150591 * Fedora 11 Update: expat-2.0.1-6.fc11.1 (Nov 4) ---------------------------------------------- This update fixes a security vulnerability: A buffer over-read flaw was found in the way Expat handles malformed UTF-8 sequences when processing XML files. A specially-crafted XML file could cause applications using Expat to crash while parsing the file. (CVE-2009-3720) http://www.linuxsecurity.com/content/view/150589 * Fedora 10 Update: yelp-2.24.0-14.fc10 (Nov 4) --------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150588 * Fedora 10 Update: gnome-python2-extras-2.19.1-35.fc10 (Nov 4) ------------------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150577 * Fedora 10 Update: gnome-web-photo-0.3-23.fc10 (Nov 4) ----------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150578 * Fedora 10 Update: google-gadgets-0.10.5-11.fc10 (Nov 4) ------------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150579 * Fedora 10 Update: kazehakase-0.5.6-4.fc10.7 (Nov 4) --------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150580 * Fedora 10 Update: mozvoikko-0.9.5-15.fc10 (Nov 4) ------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150581 * Fedora 10 Update: Miro-2.0.5-5.fc10 (Nov 4) ------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150582 * Fedora 10 Update: mugshot-1.2.2-14.fc10 (Nov 4) ----------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150583 * Fedora 10 Update: perl-Gtk2-MozEmbed-0.08-6.fc10.6 (Nov 4) ---------------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150584 * Fedora 10 Update: pcmanx-gtk2-0.3.8-14.fc10 (Nov 4) --------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150585 * Fedora 10 Update: ruby-gnome2-0.19.3-3.fc10 (Nov 4) --------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150586 * Fedora 10 Update: xulrunner-1.9.0.15-1.fc10 (Nov 4) --------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150587 * Fedora 10 Update: epiphany-2.24.3-11.fc10 (Nov 4) ------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150571 * Fedora 10 Update: evolution-rss-0.1.4-5.fc10 (Nov 4) ---------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150572 * Fedora 10 Update: gecko-sharp2-0.13-13.fc10 (Nov 4) --------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150573 * Fedora 10 Update: firefox-3.0.15-1.fc10 (Nov 4) ----------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150574 * Fedora 10 Update: epiphany-extensions-2.24.3-6.fc10 (Nov 4) ----------------------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150575 * Fedora 10 Update: galeon-2.0.7-15.fc10 (Nov 4) ---------------------------------------------- Update to new upstream Firefox version 3.0.15, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.15 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox / XULRunner. http://www.linuxsecurity.com/content/view/150576 ------------------------------------------------------------------------ * Mandriva: Subject: [Security Announce] [ MDVSA-2009:293 ] squidGuard (Nov 3) ---------------------------------------------------------------------------- Multiple vulnerabilities has been found and corrected in squidGuard: Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote attackers to cause a denial of service (application hang or loss of blocking functionality) via a long URL with many / (slash) characters, related to emergency mode. (CVE-2009-3700). Multiple buffer overflows in squidGuard 1.4 allow remote attackers to bypass intended URL blocking via a long URL, related to (1) the relationship between a certain buffer size in squidGuard and a certain buffer size in Squid and (2) a redirect URL that contains information about the originally requested URL (CVE-2009-3826). squidGuard was upgraded to 1.2.1 for MNF2/CS3/CS4 with additional upstream security and bug fixes patches applied. This update fixes these vulnerabilities. http://www.linuxsecurity.com/content/view/150554 * Mandriva: Subject: [Security Announce] [ MDVSA-2009:292 ] wireshark (Nov 3) --------------------------------------------------------------------------- Vulnerabilities have been discovered and corrected in wireshark, affecting DCERPC/NT dissector, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a file that records a malformed packet trace (CVE-2009-3550); and in wiretap/erf.c which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted erf file (CVE-2009-3829). The wireshark package has been updated to fix these vulnerabilities. http://www.linuxsecurity.com/content/view/150553 * Mandriva: Subject: [Security Announce] [ MDVSA-2009:291 ] jetty5 (Oct 29) ------------------------------------------------------------------------- A vulnerability has been identified and corrected in jetty5: Directory traversal vulnerability in the HTTP server in Mort Bay Jetty before 6.1.17, and 7.0.0.M2 and earlier 7.x versions, allows remote attackers to access arbitrary files via directory traversal sequences in the URI (CVE-2009-1523). This update fixes this vulnerability. http://www.linuxsecurity.com/content/view/150534 * Mandriva: Subject: [Security Announce] [ MDVSA-2009:290 ] firefox (Oct 29) -------------------------------------------------------------------------- Security issues were identified and fixed in firefox 3.0.x: Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code containing a very long string to be converted to a floating point number which would result in improper memory allocation and the execution of an arbitrary memory location. This vulnerability could thus be leveraged by the attacker to run arbitrary code on a victim's computer (CVE-2009-1563). Security researcher Jeremy Brown reported that the file naming scheme used for downloading a file which already exists in the downloads folder is predictable. If an attacker had local access to a victim's computer http://www.linuxsecurity.com/content/view/150531 ------------------------------------------------------------------------ * RedHat: Important: kernel security and bug fix update (Nov 3) ------------------------------------------------------------- Updated kernel packages that fix several security issues and multiple bugs are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/150559 * RedHat: Important: kernel security update (Nov 3) ------------------------------------------------- Updated kernel packages that fix security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/150556 * RedHat: Important: kernel security and bug fix update (Nov 3) ------------------------------------------------------------- Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/150557 * RedHat: Moderate: wget security update (Nov 3) ---------------------------------------------- An updated wget package that fixes a security issue is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/150558 * RedHat: Important: kernel-rt security, bug fix, (Nov 3) ------------------------------------------------------- Updated kernel-rt packages that fix several security issues, multiple bugs, and add enhancements are now available for Red Hat Enterprise MRG 1.1. This update has been rated as having important security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/150555 * RedHat: Moderate: pidgin security update (Oct 29) ------------------------------------------------- An updated pidgin package that fixes several security issues is now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/150529 * RedHat: Moderate: pidgin security update (Oct 29) ------------------------------------------------- Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. http://www.linuxsecurity.com/content/view/150530 ------------------------------------------------------------------------ * Slackware: mozilla-firefox (Nov 2) ------------------------------------ New mozilla-firefox packages are available for Slackware 12.2, 13.0, and -current to fix security issues. The Firefox 3.0.15 package may also be used with Slackware 11.0 or newer. More details about the issues may be found on the Mozilla website: http://www.mozilla.org/security/known-vulnerabilities/firefox30.html http://www.mozilla.org/security/known-vulnerabilities/firefox35.html http://www.linuxsecurity.com/content/view/150548 * Slackware: poppler (Oct 29) ----------------------------- New poppler packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3605 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3609 http://www.linuxsecurity.com/content/view/150527 * Slackware: xpdf (Oct 29) -------------------------- New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues. More details about the issues may be found in the Common Vulnerabilities and Exposures (CVE) database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3605 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3609 http://www.linuxsecurity.com/content/view/150526 ------------------------------------------------------------------------ * SuSE: IBM Java 6 (SUSE-SA:2009:053) (Nov 4) ------------------------------------------- http://www.linuxsecurity.com/content/view/150595 * SuSE: Mozilla Firefox (SUSE-SA:2009:052) (Nov 4) ------------------------------------------------ http://www.linuxsecurity.com/content/view/150594 * SuSE: Linux kernel (SUSE-SA:2009:051) (Nov 2) --------------------------------------------- http://www.linuxsecurity.com/content/view/150546 ------------------------------------------------------------------------ * Ubuntu: poppler vulnerabilities (Nov 2) ---------------------------------------- USN-850-1 fixed vulnerabilities in poppler. This update provides the corresponding updates for Ubuntu 9.10. Original advisory details: It was discovered that poppler contained multiple security issues when parsing malformed PDF documents. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. http://www.linuxsecurity.com/content/view/150547 ------------------------------------------------------------------------ * Pardus: [UPDATED] Gd: Integer Overflow (Nov 3) ---------------------------------------------- [UPDATE] Same issue was fixed in Pardus 2008, please update your system. http://www.linuxsecurity.com/content/view/150549 * Pardus: [UPDATED] Perl-HTML-Parser: (Oct 30) -------------------------------------------- A vulnerability has been found in Perl HTML-Parser module which causes denial of service (infinite loop) via crafted input. http://www.linuxsecurity.com/content/view/150536 ------------------------------------------------------------------------ Distributed by: Guardian Digital, Inc. LinuxSecurity.com To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx with "unsubscribe" in the subject of the message. ------------------------------------------------------------------------
