+----------------------------------------------------------------------+ | LinuxSecurity.com Linux Advisory Watch | | December 10th, 2010 Volume 11, Number 50 | | | | Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> | | Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> | +----------------------------------------------------------------------+ Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available. Review: The Official Ubuntu Book -------------------------------- If you haven't used Linux before, are new to Ubuntu, or would like a quick update on the latest in open source advancements for the desktop, then The Official Ubuntu Book is a great place to start. http://www.linuxsecurity.com/content/view/153159 --> Take advantage of the LinuxSecurity.com Quick Reference Card! <-- --> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <-- ------------------------------------------------------------------------ * EnGarde Secure Community 3.0.22 Now Available! ---------------------------------------------- Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy. http://www.linuxsecurity.com/content/view/145668 ------------------------------------------------------------------------ * Debian: 2131-1: exim4: arbitrary code execution (Dec 10) -------------------------------------------------------- Several vulnerabilities have been found in exim4 that allow a remote attacker to execute arbitrary code as root user. Exploits for these issues have been seen in the wild. [More...] http://www.linuxsecurity.com/content/view/153918 ------------------------------------------------------------------------ * Mandriva: 2010:251: firefox (Dec 9) ----------------------------------- Security issues were identified and fixed in firefox: Security researchers Yosuke Hasegawa and Masatoshi Kimura reported that the x-mac-arabic, x-mac-farsi and x-mac-hebrew character encodings are vulnerable to XSS attacks due to some characters being converted to [More...] http://www.linuxsecurity.com/content/view/153910 * Mandriva: 2010:250: perl-CGI-Simple (Dec 9) ------------------------------------------- A vulnerability was discovered and corrected in perl-CGI-Simple: The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows [More...] http://www.linuxsecurity.com/content/view/153903 * Mandriva: 2010:249: clamav (Dec 7) ---------------------------------- Multiple vulnerabilities were discovered and corrected in clamav: Multiple unspecified vulnerabilities in pdf.c in libclamav in ClamAV before 0.96.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted [More...] http://www.linuxsecurity.com/content/view/153879 * Mandriva: 2010:248: openssl (Dec 7) ----------------------------------- A vulnerability was discovered and corrected in openssl: OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which [More...] http://www.linuxsecurity.com/content/view/153878 * Mandriva: 2010:247: kernel (Dec 3) ---------------------------------- A vulnerability was discovered and corrected in the Linux 2.6 kernel: The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit [More...] http://www.linuxsecurity.com/content/view/153861 ------------------------------------------------------------------------ * Red Hat: 2010:0967-01: seamonkey: Critical Advisory (Dec 9) ----------------------------------------------------------- Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having critical [More...] http://www.linuxsecurity.com/content/view/153908 * Red Hat: 2010:0969-02: thunderbird: Moderate Advisory (Dec 9) ------------------------------------------------------------- An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/153909 * Red Hat: 2010:0968-01: thunderbird: Moderate Advisory (Dec 9) ------------------------------------------------------------- An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/153905 * Red Hat: 2010:0966-01: firefox: Critical Advisory (Dec 9) --------------------------------------------------------- Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having critical [More...] http://www.linuxsecurity.com/content/view/153906 * Red Hat: 2010:0958-01: kernel-rt: Important Advisory (Dec 8) ------------------------------------------------------------ Updated kernel-rt packages that fix multiple security issues and three bugs are now available for Red Hat Enterprise MRG 1.3. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/153892 * Red Hat: 2010:0950-01: apr-util: Moderate Advisory (Dec 7) ---------------------------------------------------------- Updated apr-util packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/153881 * Red Hat: 2010:0898-01: kvm: Moderate Advisory (Dec 6) ----------------------------------------------------- Updated kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/153865 * Red Hat: 2010:0945-01: quagga: Moderate Advisory (Dec 6) -------------------------------------------------------- Updated quagga packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/153866 ------------------------------------------------------------------------ * Slackware: 2010-343-01: mozilla-firefox: Security Update (Dec 10) ----------------------------------------------------------------- New mozilla-firefox packages are available for Slackware 13.0, 13.1, and -current to fix security issues. [More Info...] http://www.linuxsecurity.com/content/view/153912 * Slackware: 2010-343-02: mozilla-thunderbird: Security Update (Dec 10) --------------------------------------------------------------------- New mozilla-thunderbird packages are available for Slackware 13.0, 13.1, and -current to fix security issues. [More Info...] http://www.linuxsecurity.com/content/view/153913 * Slackware: 2010-340-01: openssl: Security Update (Dec 7) -------------------------------------------------------- New openssl packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix security issues. [More Info...] http://www.linuxsecurity.com/content/view/153868 ------------------------------------------------------------------------ * SuSE: 2010-058: acoread (Dec 8) ------------------------------- Specially crafted PDF documents could crash acroread or lead to execution of arbitrary code. acroread was updated to version 9.4.1 which addresses the issues. http://www.linuxsecurity.com/content/view/153891 * SuSE: Weekly Summary 2010:023 (Dec 8) ------------------------------------- To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. List of vulnerabilities in this summary include: libxml2, tomboy, krb5, php5, cups, java-1_6_0-openjdk, epiphany, encfs. http://www.linuxsecurity.com/content/view/153890 ------------------------------------------------------------------------ * Ubuntu: 1031-1: ClamAV vulnerabilities (Dec 9) ---------------------------------------------- Arkadiusz Miskiewicz and others discovered that the PDF processingcode in libclamav improperly validated input. This could allow aremote attacker to craft a PDF document that could crash clamav orpossibly execute arbitrary code. (CVE-2010-4260, CVE-2010-4479) [More...] http://www.linuxsecurity.com/content/view/153907 * Ubuntu: 1019-1: Firefox and Xulrunner vulnerabilities (Dec 9) ------------------------------------------------------------- Jesse Ruderman, Andreas Gal, Nils, Brian Hackett, and Igor Bukanovdiscovered several memory issues in the browser engine. An attacker couldexploit these to crash the browser or possibly run arbitrary code as theuser invoking the program. (CVE-2010-3776, CVE-2010-3777, CVE-2010-3778) [More...] http://www.linuxsecurity.com/content/view/153904 * Ubuntu: 1030-1: Kerberos vulnerabilities (Dec 9) ------------------------------------------------ It was discovered that Kerberos did not properly determine theacceptability of certain checksums. A remote attacker could use certainchecksums to alter the prompt message, modify a response to a KeyDistribution Center (KDC) or forge a KRB-SAFE message. (CVE-2010-1323) [More...] http://www.linuxsecurity.com/content/view/153902 * Ubuntu: 1029-1: OpenSSL vulnerabilities (Dec 7) ----------------------------------------------- It was discovered that an old bug workaround in the SSL/TLSserver code allowed an attacker to modify the stored session cacheciphersuite. This could possibly allow an attacker to downgrade theciphersuite to a weaker one on subsequent connections. (CVE-2010-4180) [More...] http://www.linuxsecurity.com/content/view/153882 * Ubuntu: 1026-1: Python Paste vulnerability (Dec 7) -------------------------------------------------- It was discovered that Python Paste did not properly sanitize certainstrings, resulting in cross-site scripting (XSS) vulnerabilities. Withcross-site scripting vulnerabilities, if a user were tricked into viewingserver output during a crafted server request, a remote attacker couldexploit this to modify the contents, or steal confidential data, within [More...] http://www.linuxsecurity.com/content/view/153880 ------------------------------------------------------------------------ Distributed by: Guardian Digital, Inc. LinuxSecurity.com To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx with "unsubscribe" in the subject of the message. ------------------------------------------------------------------------
